Consumers
Type their details into hundreds of forms, keep no record of who has what, and have no practical way to revoke. When spam starts, there's no receipt to point to.
why we built this
pryvc
Consent you can verify.
Not just claim.
The consent layer for personal data — cryptographically provable, revocable, and built as an open protocol while the only incumbent sells screenshots and trust.
Many Software Enterprises LLC · sales@pryvc.com
01 · the problem
Everyone trades personal data. Nobody can prove the terms.
Businesses
Sit on decaying, legally ambiguous contact data. "Proof of consent" is a screenshot in a vendor's vault — unverifiable, unfalsifiable, and increasingly insufficient for regulators and carriers.
Regulators
Are done with vibes. TCPA class actions, state privacy statutes, and the carriers and buyers who now audit consent before paying for a lead all demand evidence that names exactly who got what, when, and under which disclosure. Medicare has the most explicit rule; it is not the only place the bill arrives.
The market's answer is custody: "we recorded it, trust us."That's a trust product in an era that demands proof.
02 · the concept
OAuth for contact details — plus consent anyone can audit.
The Share button
One click shares exactly the fields a business requests — scoped, purposed, expiring, revocable. Update once, every active share refreshes. Revoke, and a tracked 10-business-day cease-contact clock starts. Silence becomes evidence.
Certified consent
A widget seals each form submission into a certificate binding the verbatim disclosure, the named entity list, the page, the timestamp, and the site's policies as they read that day — publicly verifiable at a URL by any carrier, buyer, or regulator. It requires no consumer adoption whatsoever: the visitor ticks the business's own box on the business's own form and need never have heard of PRYVC. This is the answer to the two-sided cold start — the revenue side works at zero network, and the network makes it better rather than possible.
Autofill with Proof
A browser extension that fills any form on the web from the user's encrypted profile and records a receipt — even on sites that never integrated PRYVC. Every fill feeds the consumer's Data trail and the removal-request funnel.
The Share Protocol (SP/1)
The mechanics are an open, published specification with test vectors (shareprotocol.org). PRYVC is the reference implementation — the standard-setting position, not just a vendor.
03 · why now
Three clocks started ticking at once.
regulatory
Unprovable consent keeps getting more expensive
The demand is commercial before it is regulatory: buyers, carriers and insurers increasingly refuse leads whose consent cannot be substantiated, and TCPA suits keep setting records. Note the precision — the FCC's one-to-one rule wasvacated in January 2025, so the thesis deliberately does not rest on it. Medicare simply has the rule written down; CMS's naming requirement is in force and unaffected by the vacatur.
structural
The category consolidated
ActiveProspect (TrustedForm) absorbed Jornaya, so the two established certification vendors are now one company. When a category has a single supplier and per-lead pricing, nothing forces the evidence model itself to improve — and it has not, in about a decade.
technological
AI agents need consent rails
Agents filling forms and exchanging personal data on users' behalf need machine-verifiable consent primitives. A protocol with published test vectors is exactly what agents can implement; screenshots are exactly what they can't.
04 · the two models
Custody, or proof. The industry chose custody.
Almost every consent record in existence is custodial: a vendor watched something happen, stored an artifact, and will vouch for it later. That works right up until the moment it is contested — because verifying it means asking the vendor to confirm its own record, and the party asking has no way to check independently.
| The custody model | What we built instead | |
|---|---|---|
| How it is verified | Ask the vendor; trust the answer | Recompute the hashes yourself, against a published spec |
| If the vendor disappears | The evidence goes with them | An evidence pack still verifies offline |
| Session replay | Yes — and genuinely useful | Not offered. We bet on recomputable over watchable |
| The disclosure text | Often a screenshot of a page that has since changed | Verbatim words and their SHA-256, hashed into the record |
| The site's terms that day | Not captured | Snapshotted, content-hashed, and re-checked daily afterwards |
| Every named recipient | A detail on the page | Sorted and hashed into the fingerprint |
| The end of consent | Out of scope | Revocation, cease deadlines, affidavits — first class |
| The person it is about | Not a participant | Free account, their own receipt, their own removals |
| Pricing | Metered per lead | Fixed annual, never metered |
We concede replay honestly — it is a real strength and we do not have it. A replay shows what a session looked like; a fingerprint proves what wasagreed to, and can be checked by a carrier, a regulator, or a court without asking us anything. The industry consolidated around custody because it was easier to sell, not because it was better evidence.
05 · what that forced us to build
Every one of these follows from refusing to be trusted.
Verifiable, not custodial
SHA-256 fingerprints over canonical facts, an append-only hash chain, and external Merkle anchoring with signed tree heads. Rewriting history means breaking two systems and a consistency proof. Consumer PII: envelope-encrypted per-user, keys held apart from the database, no staff read path, request-scoped and audited decryption. We word this precisely rather than claiming we are incapable of reading it, because we hold the keys and saying otherwise would be a lie.
The open-protocol moat
SP/1 is published with normative test vectors. Standards attract integrators, auditors, and AI agents — and make PRYVC the reference implementation rather than one vendor among many.
Zero-integration distribution
The extension works on every site on day one — no business integration required. Consumers bring PRYVC to the web themselves, and every fill seeds the Data trail and removal funnel.
Structurally not a data broker
We never sell, rent, or broker data, and we are never a party to the disclosure — the consumer is. PRYVC records what they chose to share; it does not acquire it. That distinction is the licence to operate in a market where everyone else is suspected by default.
Both sides, or neither
A consent network representing only businesses is a data broker with better manners. The consumer side is free and stays free; the business side pays. Each makes the other worth more.
Revocation with teeth
Cease notices, tracked deadlines, escalation records, court-ready affidavit packages. Nobody else treats the end of consent as a product.
Consent that keeps being watched
The privacy policy and terms in force on the day someone consented are hashed and re-checked daily. When a site quietly rewrites them, every affected person is told — and the detection itself is written into the tamper-evident chain. No incumbent monitors the document after capture.
Built for agents, not just browsers
A Model Context Protocol server exposes consent records to AI agents under realm-scoped tokens — and deliberately offers no tool that can grant consent. Agents can revoke, read and update; agreeing still requires a person at a consent screen.
Fixed pricing
Metering consent per lead prices the right thing to do proportionally to how much of it you do. A flat annual fee does not.
06 · what exists today
The platform is live. The company hasn't launched.
- Consumer app, business portal, API, admin, MCP server — deployed on Cloudflare
- Certified consent + public verification pages (verify.pryvc.com) with view-as-evidence tracking
- Accountless withdrawal — anyone can revoke a certificate from its own page by proving control of the email, with a tracked ten-business-day cease obligation
- Terms-as-of-opt-in policy snapshots, hash-deduplicated — and re-checked daily, with change notices to everyone affected
- Device & network evidence on certificates and disclosures
- External Merkle anchoring live (15-minute chain checkpoints, locally verified consistency proofs)
- Share Protocol spec site with normative test vectors (shareprotocol.org)
- An independent Python verifier written from the spec text, not ported from our code — two implementations agreeing is what makes SP/1 a protocol rather than a file format
- Browser extension live on the Chrome Web Store (passed security review)
- Revocation engine with CSV import and White Glove removals
- Live demo issuing real certificates (demo.pryvc.com/try); SDK on npm
- Public audit explorer — anyone can verify the hash chain, no account, zero PII
- Portable evidence packs that verify offline, in a verifier we don't control
- Platform status page, per-minute health checks, and a build revision reported by every deployed surface
Pre-revenue, and deliberately so. Everything above is deployed and working in production — none of it has been sold. Horizontal go-to-market was frozen in July to build the evidence layer properly rather than chase a two-sided cold start with a thin product. First customer conversations start now, and the platform is no longer the constraint. Infrastructure cost at current scale is effectively zero-marginal serverless, so the runway question is people and distribution, not hosting.
07 · how we pay for it
Fixed subscriptions. Never metered, never your data.
consumer
$29/yr
White Glove: unlimited removal requests, deadline tracking, affidavit packages. Free tier (4 lifetime revocations) feeds it. Extension → Data trail → removals is the upgrade path.
business
$299/yr
Share button, always-fresh consented data, webhooks, audit-grade receipts. Fixed, never metered.
enterprise
$2,999/yr
Certified consent: accountless widget, certificate API, public verification, portable evidence packs. Directly displaces per-lead incumbent fees in any flow where a buyer, carrier or regulator audits consent.
Land with certified consent wherever a buyer already audits consent — a sale that closes on its own merits with no consumers required — then expand across lead-gen verticals and let the consumer network compound underneath. The Share button and the extension raise the ceiling; they are not the floor.
08 · who this is for
Anywhere a promise about personal data has to survive being questioned.
Insurance
Quote comparison means many recipients. Naming them, and proving which the person accepted, is the whole argument.
Mortgage & lending
Buyers want proof a borrower agreed to be contacted, not a screenshot of a page that has since changed.
Solar & home services
High ticket, high complaint. Evidence settles a dispute before it escalates.
Legal & mass tort
Intake volume plus plaintiff scrutiny makes an unprovable opt-in expensive.
Education
Enrollment leads change hands repeatedly. Consent has to travel with them.
Medicare
The one place the requirement to name each recipient is written down. It is the clearest case, not the only one.
And on the other side: anyone who has typed their details into a hundred forms and cannot say who holds them. That side is free, forever, because a consent network where only businesses are represented is just a data broker with better manners.
where this goes
Consent you can check,
not consent you're told about.
Everything here is built and running. It is not yet sold to anyone, and we would rather say that than imply otherwise. If you run forms that collect personal data, or you are simply tired of not knowing who has yours, both sides of this are open to you today — and the specification is open whether you use us or not.
pryvc.com ·the specification ·the public ledger
build ca5f0e3 · 2026-08-02 03:07 UTC