← BACK

Privacy Notice

Last updated: 7/23/2026

PrivacyScan ("we", "us") is the data controller for personal data processed through the Service. This Notice explains what we collect, why, and your rights.

1. Personal data we collect

• Account data — email, display name, hashed authentication credentials, OAuth identifiers.
• Workspace / collaboration data — workspace names, membership, invites, comments and assignments you create.
• Scan data — URLs and files you submit for scanning, findings produced, tags and notes you add.
• Usage / telemetry — IP address, user-agent, request timestamps, feature usage; used for security, fraud prevention, and product improvement.
• Support communications — messages you send us.

Payment and billing data (name, address, card details, tax info) is collected directly by Paddle as Merchant of Record and is not stored by us.

2. Purposes & legal bases

• Providing the Service and your account — performance of contract.
• Security, abuse prevention, and enforcing our Terms — legitimate interests.
• Product improvement and analytics on aggregated usage — legitimate interests.
• Transactional communications — performance of contract.
• Marketing communications (only where you have opted in) — consent.
• Compliance with legal obligations — legal obligation.

3. Recipients

We share personal data with:

• Service providers / subprocessors — hosting, database, and analytics infrastructure providers acting under contract.
• Paddle.com Market Ltd — our Merchant of Record for payments, tax compliance, invoicing and subscription management.
• Professional advisers — legal, accounting, or auditors, where necessary.
• Authorities — where required by law.

4. Retention

Account and scan data is retained while your account is active. On deletion, personal data is erased or anonymised within 90 days, except where longer retention is required by law (e.g. tax and accounting records).

5. Your rights

Subject to applicable law you have rights to access, rectify, erase, restrict, port your personal data, and to object to certain processing. Where processing is based on consent you may withdraw consent at any time. To exercise these rights contact us through the in-app support channel. If you are in the UK/EEA you may complain to your local supervisory authority.

6. International transfers

Where personal data is transferred outside your country we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

7. Security

We use appropriate technical and organisational measures including encryption in transit, access controls, and regular reviews.

8. Cookies

We use only strictly-necessary cookies to keep you signed in and to remember your workspace and theme preferences. No third-party marketing or analytics cookies are set without your consent.

9. Contact

Reach us through the in-app support channel.