Provenance Diligence
Log in

What we hold, and for how long

The same rule as in the terms: every clause is written twice, in plain words and in full.

1. Controller

In plain words. The founder is the person responsible for your data.

Grig (Grigorii) Kochedykov, trading as Provenance Diligence, sole trader (empresário em nome individual), Torres Vedras, Portugal (identification in the Legal notice). Contact: support@provenancediligence.com, or the contact page.

2. What we collect

In plain words. What you type in the form, the listing you send, and payment confirmation — that's it.

  • From the form: your name, email, the listing link/details, and anything you choose to write. To pre-select your country on the order form, we read the country of your internet connection as reported by Cloudflare; we store only the country you submit.
  • From the case portal (case.provenancediligence.com): your name, email, the listing link or description, your notes, and the files you choose to upload — see 3.
  • During an engagement: documents you send about the target business (which may contain third-party data — see 6).
  • From payment: payment, refund and dispute events from Stripe; we keep the Stripe session and payment numbers and the amount. We never see or store your card number.

From this website itself: your browser keeps your answer to the cookie window and, only if you press Allow, the advertising tags from the link you arrived by. The answer is a single word, yes or no, kept so that we do not ask you again; it identifies nobody. It is kept in your browser and also as a small cookie, pd_consent, for provenancediligence.com and its subdomains, so that the order page does not ask you a second time. Your browser sends that cookie with requests to our pages; we do not record it and use it for nothing except not asking again. It lasts 180 days. The advertising tags are the ones listed below (utm_source, utm_campaign and the like, plus Google’s click number); they are kept in this browser tab only and erased when you close it, so that if you place an order from another page of the site, the order form still learns which ad you came from. Press Decline and they are erased at once. Without Allow, the link to the order form carries only the campaign and keyword from the address of the page you are on: nothing is kept in your browser, and Google’s click number never goes. If you then send a request, the campaign, the keyword and the site button you came from are saved with it, so that we know which ad brought it. Press Decline and it is stored just the same, as a record of your refusal, and any Google cookie already present is erased. The one piece of third-party code here is the Google Ads tag, and it loads only after you press Allow in the cookie window. Decline it, or ignore the window, and the advertising code is never loaded and no Google cookie is set. What it measures is one thing: how many people arrive from a Google ad. You can change your answer whenever you like — reopen the cookie window. The recipient in the European Economic Area is Google Ireland Limited (Google privacy policy). The site keeps a privacy-respecting, first-party visit count to see which pages are read and whether answer-engines cite the site. It is cookieless: your IP address is turned into a one-way hash with a salt that changes every day (so a visitor cannot be re-identified or followed across days), and only these are stored: the page path, the referring site, the advertising tags carried in the address (utm_source, utm_campaign, and the keyword from our own ad list that the search matched) and that daily hash — never a raw IP, never a name. The click identifier that Google adds to an advertising address (gclid) is deliberately kept out of this record. This first-party analytics record is not shared with any third party, and it is used neither for advertising nor for profiling. The hosting provider also keeps standard short-lived security logs, as every host does.

Visit counter. The site counts visits itself, without cookies and without storing anything in your browser. For each visit it records the page, the site you came from, the ad campaign and keyword if you arrived from an ad, the type of device (phone, tablet or computer — not the browser name), and which kind of button you pressed: order, add to Chrome or Edge, sign in or sign up. Instead of your IP address it keeps a code made from it that changes every day, so visits on different days cannot be linked. Robots and our own checks are not counted. We use these numbers only to see which pages work. These records are deleted after 24 months. After that only the totals for each day remain: plain counts, with no IP address, no code and no name.

3. The case portal (case.provenancediligence.com)

In plain words. Paid work is followed in your account at my.provenancediligence.com. Uploaded files are stored in Cloudflare R2 with EU jurisdiction configured; they and your notes are deleted no later than 90 days after the report is delivered. A copy of each order goes to the founder by email, and a short signal without your name or email goes to his phone.

Paid engagements begin on the case portal. When you submit a deal there, we collect your name, email, the listing link or description, any notes you write, and the files you choose to upload. If you came from one of our ads, the campaign, the keyword and the site button you came from are kept with the request — Google’s click number only if you pressed Allow in the cookie window. You receive an order number, and the case is kept in your account at my.provenancediligence.com: you sign in with your email and a password, or with Google or LinkedIn. If you sign in with Google or LinkedIn, we receive a sign-in token from them and keep only your verified email and your name (up to 120 characters). The link in our answer email signs you in to the case once and expires after 8 days; do not forward it.

Case records and uploaded files are stored with Cloudflare. Uploaded files are stored in a Cloudflare R2 bucket configured for EU jurisdiction. Case records — your name, email, listing line, notes, order number and access-link metadata — are stored separately in Cloudflare’s database and key-value store and are not covered by that R2 EU-jurisdiction setting.

Who is told about a new order. A copy of each order is sent by email through Brevo to the founder’s personal Gmail mailbox (Google). It holds the order number, the tier, the language of the form and of the report, your name and email, the business (name, activity, town, country), the listing links, the number of files (not the files themselves), the link to the order page, and where you came from: the campaign, the keyword, the site button and whether you came from an ad — never Google’s click number unless you pressed Allow. A request for the free check on the site reaches the same mailbox the same way, with the link and your email. The founder also gets a short signal on Telegram: the order number, the tier and price, the country of the business, the time, the form language, the number of links and files, the report language and where you came from — no name, no email, no link and no notes. Payment, when it opens in your account after the fit check, happens inside Stripe; we never see your card number.

Before uploading, redact third-party personal data your files do not need to carry. For staff, roles, start dates and salary bands are enough; do not include names, personal IDs or home addresses unless they are needed for the review.

3a. The browser extension

In plain words. From version 1.0.7, the extension sends us nothing from the pages you visit, with two exceptions. The first is the link to order a check. If you press it, the address of that listing is sent to our order form. This works in the extension panel and, from version 1.0.7, in the PDF report. It works whether or not you have linked your account. Second, once you link your account, the extension sends us the listings you saved. From then on, it also sends what it sees on those saved listings by itself, without you pressing anything. It does this only for listings you saved.

The extension reads the listing page inside your browser. On the sites named in its manifest it reads the page by itself and, if the page looks like a listing, shows a small button with our icon in the corner of the page; the panel opens only when you click it or the extension icon. On any other site, to spot a business for sale, the extension may look at the title, description, web address and text of each page you open, inside your browser; the check itself sends nothing outside your browser and saves nothing. On a long page, the check stops after the first 20,000 characters of text. If the check finds words about a sale, the extension may read the page to see whether it is a listing. Watching saved listings is described in section 3b.

The extension can make a PDF report of a listing. It puts the report together inside your browser; nothing is sent to our server to make it.

The extension has a link to order a check. If you press it, the address of that listing is sent to our order form at case.provenancediligence.com. This works in the extension panel and, from version 1.0.7, in the PDF report. It works whether or not you have linked your account. Nothing else from the page is sent with it. The link also carries a tag saying where you pressed it: the extension panel or the PDF report. The list below says what the extension sends about the listings you saved.

The extension saves nothing until you link your account. After you link it, your saved list is kept in your account, with a copy in this browser; the extension keeps the two in step.

The extension sends nothing to your account until it is linked. From version 1.0.9 it links by itself: when you sign in to My list in this browser and open it, the page gives the extension its own key (a random code that lets the extension act for your account) and a shortened form of your email address, such as j***@mail.com. Right after linking, the extension sends your account the listings you already saved in this browser: the link, the site's name, the title, the price and currency, the city, the country, the type of business and the number of flagged points. The saved copy of each listing page (the snapshot) goes later, the next time you open the side panel, with phone numbers and email addresses taken out of it. For sites where copying pages is not allowed, only the link and the date go. If the extension is already linked, nothing changes. If you press "Disconnect" in the side panel, it stays unlinked until you press "Connect to my cabinet". You can also link it by hand from the side panel.

Linking works like this. The extension shows one ordinary tab on my.provenancediligence.com. While you finish in that tab, the extension asks our server whether you are done. It asks every 2 seconds, for up to 3 minutes. It sends only a random one-time code, the same code that is in that tab's address, and nothing else. From the moment the link is made, the extension sends us:

  • the listings you chose to save: the link, the listing title, the site, the price, currency and town it read, the number of points flagged, the country and the sector, a snapshot of what the page said, in its own words, except email addresses and phone numbers that the extension recognises and takes out (from version 1.0.6). The questions you marked as asked are sent too, if you marked them after you linked My list. The date kept for each is the date it first reached your account. If the panel finds no listing on the page, only the link, the title and the date you saved it go to your account;
  • the listings you saved before you linked My list: for each, the link, the site, the title, the number of points flagged, the country, the sector, the price with its currency and the town, and possibly a snapshot (a copy of what the panel read on the page). Questions you marked as asked before you linked My list are not kept. The date kept for each is the date it first reached your account. From a page the panel could not read, at most the link, the title and the date you saved it go to your account;
  • when you open a listing you already saved, no more than once a day, what we saw on it: the link, the price and the date the marketplace last pushed it back to the top, when the page shows them. With them goes a new snapshot of what the page said. From version 1.0.7, this once-a-day message changes when that page says the listing was removed and shows no price. It then carries the link and a note that the listing was removed, without the other details. Separately, from version 1.0.6, the panel can send the twelve points a check needs for that listing. It does so when it is open on that listing and your browser does not hold those points. For example, you may have saved it with an earlier version of the extension. This happens once for each such listing in this browser. With the points go the same kinds of details about the listing as when you saved it. These details are read from the page as it is now, including a new snapshot. The panel can send the points even if the page says the listing was removed. Before sending, the panel fetches your list from your account again. If the listing is no longer on it, nothing is sent;
  • from version 1.0.7, opening the My list page makes the extension check your saved listings right away. To check a listing, the extension requests its page from the marketplace in the background, without opening a tab. It checks each listing no more than once a day, and up to 25 listings each time the page asks. For each listing it checks, it sends us the link and the price if the page shows one. If the marketplace says the listing was removed, it sends a note about that instead of the price. Listings on sites whose terms do not allow watching listings are not checked;
  • in versions before 1.0.9, what its weekly check finds: the link and the price if the page shows one. It looks at each listing you watch about once a week, while the browser is open (up to ten listings). If the marketplace says the listing was removed, it sends a note about that instead of the price. If a check does not go through, the extension tries again on a later day while the browser is open.

From version 1.0.9 the extension checks the listings you saved. It does so when you open My list, and a few listings each hour while your browser is open. It checks only sites you let it read. A listing checked in the last hour waits its turn. The extension opens at most 50 pages a day. For each listing it sends the link and the price, if the page gives one in its data. If the page says the listing was removed, it sends a note about that instead of the price. No snapshot is sent with a check. Your account keeps one price note per listing in about 20 hours; a removal note is kept at once. If a check does not go through, nothing is recorded, and the extension tries again later. Listings on sites whose terms do not allow watching listings are not checked.

In versions before 1.0.7, when the extension is linked, "Copy the request" also saves the listing to your account, with the date and the points you asked about. If you had removed it from your list, it comes back. The request itself is not sent.

In versions before 1.0.7, the "report an error" button opens our contact page with the listing's address, even if your account is not linked.

The snapshot is not the whole page. It holds the lines the extension quoted and the numbers it read. It also holds the extension's notes on what the listing does not say. It also holds the points under "What a check needs", when they fit. In version 1.0.6 the panel lists them, and from version 1.0.7 the PDF report does. Where the extension found something for a point, what it found is added, cut short. In versions before 1.0.6, the snapshot holds no such points. In versions before 1.0.7, the snapshot can also hold the extension's comparison with the market. Before the snapshot is sent, the extension in your browser removes the email addresses and phone numbers it recognises. Seven or eight digits in a row can stay without a plus sign or word like "tel" just before them. Such numbers look like a price or a listing number. In versions before 1.0.6, the snapshot is sent without this removal. The extension does not remove email addresses or phone numbers from the listing's title or web address.

These sites' terms forbid copying or extracting their data: bizbuysell.com, bizquest.com, loopnet.com, rightmove.co.uk, leboncoin.fr. From these sites, version 1.0.7 of the extension sends nothing from the page but its link. Earlier versions send what they read from the listing page, and its snapshot, as from any other site.

Removing a listing only takes it off your list. Its link stays in your account until you delete the account. For listings from other sites, so do the title, price, town and the other details saved with them. If you save it again, it comes back with the date it first reached your account. Its snapshots and observations are deleted later, on no fixed schedule.

We do not see the pages you merely opened: only the ones you saved, once you have linked the account yourself; the ones you order a check on; and, in versions before 1.0.7, the ones on which you press "Copy the request" or "report an error". You can unlink every extension with one button in your account without deleting the list, and deleting the account erases your sign-ins, the saved listings, the snapshots, the watching and the linked extensions.

3b. My list and watching listings

In plain words. We keep the listing address, title and price at most until you delete your account. On sites whose terms do not allow watching listings, we keep the address but not the title or price. The price and date of each check are erased after they are a year old, in a cleanup that runs once a day. Only the date of the latest check stays with the listing.

My list is a separate free service with its own sign-in. You sign in with your email address and a password. The password is stored only as an irreversible hash. The address is kept for signing in and for the confirmation and password-reset emails. The property card holds what the extension read from the listing: the link, the country, the town, the kind of business and the price.

In plain words. Listings you save are checked by themselves: by the extension when you open My list, and a few at a time while your browser is open, and by our server once a night. Sites that do not allow it are left out.

Saving a listing is all it takes: from then on it is checked by itself. Take it off My list and the checks stop.

The quick check asks the marketplace for the listing page and sends along your browser's own cookies for that site (cookies are small notes a site keeps in your browser). The marketplace may recognise your browser. If you use an account there in this browser, it can tell that your account asked for the page. Nothing is read from the cookies and nothing is sent to us.

If the marketplace does not answer the quick check, the extension opens the listing in a minimized window of your browser, reads whether it is on sale, and closes the window. You would see the same page by opening the link yourself, and nothing about you is added. If the site asks you to prove you are not a robot, the extension clicks nothing, waits a short time, and tries again later.

Once a night, the server that runs My list opens up to 50 of your saved listings, starting with the ones checked longest ago, to see whether they are on sale. It says openly who it is: its name is "ProvenanceDiligenceCheck", with a link to our privacy page. The marketplace sees our server's address, not yours, and nothing about you is sent to it. The server writes down only the price it finds, or a note that the listing was removed. Sites whose terms do not allow watching listings are not opened. If a site does not let the server in, nothing is written and the server tries again the next night; the extension in your browser may check that listing too, as described above.

When a listing is found removed, My list marks it removed for everyone who saved the same link. Only the link and the date travel; nothing about who saw it.

On the pages of our website in four of its languages, and in My list, we check whether the extension is already in this browser. The page loads the extension's small icon, and in My list it also asks the extension to answer. Both happen inside your browser, and the check itself sends nothing. If the extension is there, we stop offering to install it.

In versions before 1.0.9, a listing is checked by itself about once a week only after you press its "watch" button. On sites whose terms do not allow watching listings there is no button, and the list says so. From version 1.0.7, when you open the My list page, the extension also checks your saved listings. It checks each one at most once a day. This check skips sites whose terms do not allow watching listings. Section 3a describes it. While your list is linked, the extension also fetches your list from your account each time the panel updates while it is open (when you open it, come back to it, or move to another page or tab), to show which listings are already on it. It fetches your list by itself at most once a day, to know which listings are under watch. From version 1.0.7, it also fetches your list when the My list page asks it to check your listings. This tells it which ones to check. None of these requests carries anything about the pages you visit. Opening a saved listing yourself also records an observation, at most once a day, only while your list is linked. You do not have to press the "watch" button for that. On sites whose terms do not allow watching listings, opening it records nothing. In versions before 1.0.9, about once a week, while the browser is open, the extension in your browser looks at each listing you watch. It records an observation: the address, the date of the check and the price if the page shows one. If the marketplace says the listing was removed, the observation carries a note about that. In versions before 1.0.9, this weekly check runs on the extension's own schedule. If a check does not go through, the extension tries again on a later day while the browser is open. From version 1.0.7, opening the My list page can check the same listing too, at most once a day. The extension requests the page of a saved listing in the background, without opening a tab. It does so only on sites you allowed when your browser asked for permission, when you install it or later. That permission stays until you remove it in your browser's settings. Through the listing address such records also touch the seller — which is why we say how long they stay. Saved listings stay at most until you delete your account; removing one takes it off your list. A listing you removed stays in your account, with the details saved with it, until you delete your account. If you save it again, it comes back to your list. Observations older than a year, and the snapshots and observations of a listing you removed, are erased. We delete them in a cleanup that runs once a day. "Delete my account and data", at the bottom of the My list page, erases your saved listings at once, with their snapshots and observations. We send no emails about changes to your saved listings — you see them when you come into the list. When you save a listing, we keep a snapshot of what the page said at that moment. This lets you see later what changed.

Deleting the account erases it completely: your name, the password hash, the email-confirmation mark, sign-in tokens, the list, the snapshots, the observations, the links to extensions and the links from your account to your orders. Checks you ordered follow their own schedule in section 7: the documents you uploaded and your notes are deleted no later than 90 days after the report; the report, the invoices and a short order record are kept until 31 December of the tenth year after delivery, as tax law requires for invoices; a check that never started is deleted after 180 days. You can unlink every extension without deleting anything, with one button.

This promise is not the same as the extension promise in clause 3a, and we keep them apart. The extension does not report the pages you merely open. It speaks to us only about the ones you saved, once you have linked the account yourself; the ones you order a check on; and, in versions before 1.0.7, the ones on which you press "Copy the request" or "report an error".

3c. The assistant on this site

What it is. The "Ask a question" window on our pages is an automatic assistant, not a person. It says so in its first message. It answers only from what is published on this site and in our terms. It does not take decisions: it cannot accept or cancel an order, give a discount or a refund, or judge a particular business. Anything that needs a decision goes to our founder.

What we store when you write to it.

  • the messages you type and the assistant's replies, with automatic translations into English and Russian (the founder reads Russian);
  • the language of your message, your browser language, the page of our site you wrote from (without any query string), and the time;
  • a technical log of which step answered (for example "ready answer" or "passed to the founder"). The log contains no email address.

If your message is a complaint, a suggestion or a question that needs the founder, we also keep a copy of it (up to 1,000 characters) with its Russian translation and the page. The founder reads it in our own admin page; the notification he gets on his phone says only the kind of message and its language, never its text. You may leave your email for a reply; we keep it only if you tick the consent box.

What we do not store. We do not store your IP address. To limit abuse (at most 5 messages a minute and 40 a day) we keep a one-way fingerprint of it, mixed with a secret that changes every day, and delete these counters after two days. The assistant sets no cookies. It keeps a random conversation number in your browser tab's session storage; it disappears when you close the tab.

Who processes it for us.

  • Anthropic (Claude): receives your message, up to the six previous messages of the same conversation and excerpts from our site, to understand the question, translate it and draft an answer. Anthropic is based in the US; this transfer is covered by the Standard Contractual Clauses under Anthropic's data processing addendum.
  • Cloudflare: runs the assistant and its database, and matches your question against our site texts (Workers AI). Cloudflare is certified under the EU-U.S. Data Privacy Framework.
  • Brevo (an EU company, based in France): sends the founder's reply to your email, only when he presses "Send".

The assistant makes no decision about you. It only drafts answers from what is already published on this site; nothing it does affects any request or order of yours. Decisions are always made by a person.

How long. Conversations and the technical log: 90 days. Complaints, suggestions, questions passed to the founder, and the email you left with them: 12 months. Counts of language-model usage (numbers only, no text): 400 days. Then they are deleted automatically.

Legal basis and your rights. Answering your question is our legitimate interest (Art. 6(1)(f) GDPR); you can object at any time by writing to us. Keeping your email is based on your consent (Art. 6(1)(a) GDPR), which you can withdraw the same way. To see, correct or delete what the assistant stored about you, write to support@provenancediligence.com. You can also complain to Portugal's data protection authority, the CNPD (cnpd.pt).

4. Why, and the lawful basis

In plain words. We use your data to answer you and to produce your memo. Nothing else.

To assess whether your deal is a fit and reply (pre-contractual steps at your request, Art. 6(1)(b) GDPR); to deliver the memo you purchased (performance of a contract, Art. 6(1)(b)); to keep invoices and tax records (legal obligation, Art. 6(1)(c)); and to keep delivered memos for the defence of legal claims (legitimate interest, Art. 6(1)(f)). No marketing use, no profiling, no automated decisions about you.

5. Processors and recipients

In plain words. Only the services that run the work touch your data — email, payment, hosting, sign-in, and the founder’s own mailbox and phone. All of them are named below. Nobody gets it for marketing. Ever.

Brevo (an EU company, based in France) sends all our email: to you (your name, email, the link to your order page and the invoice PDF), sign-in and password-reset links, emails to a seller at an address given to us by a partner, the assistant’s replies, and alerts to the founder. Google: a copy of each order, and each request for the free check (the link and your email), goes by email through Brevo to the founder’s personal Gmail mailbox; section 3 lists what it holds. Telegram: a short signal to the founder about each new order, with no name, email, link or notes (section 3); from the assistant, only the kind of message and its language; notifications from the partner portal may include the partner’s email, the name and town of the business, and the partner’s note. Stackmail hosts our founder@ and support@ mailboxes: your replies and anything you write to those addresses arrive there. Google and LinkedIn, if you sign in with them: we receive a sign-in token and keep only your verified email and your name (up to 120 characters). Stripe: payment; we pass it the order number and your email, and receive payment, refund and dispute events; we keep the session and payment numbers and the amount, and never see card numbers. Cloudflare: website hosting, the database, file storage (R2, under EU jurisdiction) and Workers AI for the assistant. Anthropic: the assistant, as described in 3c. Google Ireland: the Google Ads tag, only after you press Allow (section 2). Each works under its own data-processing terms; where one of them processes data outside the EEA, it does so under those terms, including standard contractual clauses where required. We do not sell or share personal data for marketing. There are no third-party analytics and no profiling: the one piece of third-party code is the Google Ads tag, loaded only after you press Allow, and the site counts visits itself, without cookies.

6. Third-party data in the research (Art. 14 GDPR notice)

In plain words. Research about the business you're buying concerns other people too — we use only public sources for that, and the same care.

A risk screen necessarily processes information about the target business and the people publicly connected to it (owners, directors) — drawn from official public registers and public sources only (commercial registries, insolvency registers, published court decisions, licence censuses), on the lawful basis of legitimate interest (Art. 6(1)(f)), assessed and documented. Because informing each person individually would be disproportionate for a confidential one-off report and could prejudice its purpose, this section serves as the public information notice under Art. 14(5)(b) GDPR: categories = identification and role data as published in the registers named above; recipients = the instructing client only, and the services in section 5 that store and send the report; retention = as in section 7; rights = as in section 8, exercisable by anyone by writing to support@provenancediligence.com. Criminal-conviction data is not collected; references to insolvency or court records are limited to what the official public register itself publishes, cited to its source. The information stays inside the client's memo, is never published, and public samples are anonymised so no business or person is identifiable.

7. Retention

In plain words. Your uploaded papers and notes: gone within 90 days of the report. The report, the invoices and a short record of the order: kept for ten years, the period tax law sets for invoices, then gone.

Documents you upload to an order and the notes you write with it: deleted no later than 90 days after the report is delivered. Our report (PDF), copies of the invoices and a short order record — who ordered (name and email), what (the tier, the business and the listing), when, and the amount: kept until 31 December of the tenth year after the year of delivery or of the last invoice, whichever is later; a report delivered in 2026 is kept until 31 December 2036. The reason: Portuguese tax law requires invoices and records to be kept for ten calendar years (Código do IVA, art. 52(1); Decree-Law 28/2019, art. 19(1)); we keep the report for the same period so that we can answer any claim about it (Art. 17(3)(e) GDPR). The original invoices are also held by the Portuguese tax authority (Portal das Finanças). While a complaint, a dispute or an audit about an order is open, deletion is paused until it ends (Art. 17(3)(e) and 18(1)(c) GDPR). Orders that never reached work, and enquiries that did not become orders: deleted after 180 days. Orders paid but not yet delivered: kept while the work goes on. Orders placed by a partner: the contacts of the partner’s client (name and email) and the seller’s email are erased 90 days after delivery; the order record, the report and the invoice are kept as above. Deleting your account erases it completely: your name, the password hash, the confirmation mark, sign-in tokens, linked devices and the links to your orders. My list: saved listings stay at most until you delete your account; removing one takes it off your list. A listing you removed stays in your account, with the details saved with it, until you delete your account. If you save it again, it comes back to your list. Observations older than a year, and the snapshots and observations of a listing you removed, are erased. We delete them in a cleanup that runs once a day. While My list is linked, remove a listing in two places: first on the My list page, which takes it off your list in your account, then in the panel, which takes it off this browser. Removed only in the panel, it comes back as soon as the panel updates — when you open it, come back to it, or move to another page or tab. "Delete my account and data", at the bottom of the My list page, erases your saved listings at once, with their snapshots and observations. The visit counter stores no IP address, only a one-way code made from it with a salt that changes every day; these records are deleted after 24 months, and only the totals for each day (plain counts, with no code) are kept longer. Nothing is kept "just in case" beyond these schedules.

8. Your rights

In plain words. You can see, fix or delete your data — and complain to the regulator if we get it wrong.

Access, rectification, erasure, restriction, portability and objection — exercised by writing to support@provenancediligence.com (see the contact page), answered within one month. You can also complain to the Portuguese supervisory authority, the CNPD (Comissão Nacional de Proteção de Dados, cnpd.pt), or to your own country's authority.

What this site deliberately doesn't do

  • No analytics cookies and no profiling; the only cookie window is for the Google Ads tag, with Allow and Decline the same size
  • No marketing emails — we don't build a list; you hear from us only about your own deal
  • No data sales, no "partners", no lookalike audiences
  • No storing of card numbers — payment stays inside Stripe