Privacy Policy

Account data: name, email, your organization name and password (stored only as an Argon2id hash, never in plaintext).

Usage data: domains you register, scan results, and technical metadata needed to provide the Service.

We do not collect card data: it is handled directly by Lemon Squeezy in its checkout.

To operate your account, run scans, generate reports, send you security alerts and transactional emails (verification, invitations), and manage your subscription. We only send marketing communications with your explicit consent, which you can withdraw anytime.

We rely on trusted third parties that process data on our behalf: Lemon Squeezy (payments and billing), Resend (email delivery), Groq (AI report generation), and Cloudflare together with our hosting provider (delivery and infrastructure). Each accesses only the data needed for its function.

Scans analyze only publicly accessible information about domains you verified as your own. We do not access private content of your systems or store sensitive data hosted on them.

We use strictly necessary cookies to keep you securely signed in (httpOnly session cookie). We do not use advertising or third-party tracking cookies.

We keep your data while your account is active. If you delete it, we erase or anonymize your personal data within a reasonable period, except what we must retain for legal or accounting obligations.

You can access, rectify, export or request deletion of your personal data, and object to certain processing, under applicable law (including GDPR and Ecuador's LOPDP). To exercise them, contact us.

We apply encryption in transit, strong password hashing, role-based access control, infrastructure isolation and audit logging. No system is infallible, but we handle your information with industry standards. See our Security page for details.

We may update this Policy; material changes will be notified by reasonable means. For privacy questions, write to [email protected].