Privacy Policy

1. Scope and Commitment to Privacy

UserScanner ("we," "us," or "our") is committed to transparent, principled data stewardship. This Privacy Policy governs our processing of information collected through our website, scanning platform, REST APIs, and forensic reporting tools.

Our infrastructure is built around the core engineering principle of data minimization: we collect, process, and retain only the minimal telemetry strictly necessary to authenticate legitimate users, execute point-in-time security audits, prevent automated fraud or credit exploitation, and comply with legal obligations.

2. Categories of Data Processed & Legal Basis

Depending on how you interact with UserScanner, we process the following categories of information:

• Account & Authentication Credentials: When you register or sign in, we process your verified email address, chosen display name, and authentication tokens. User directories and authentication sessions (including Google OAuth and passwordless magic links) are managed via Supabase with industry-standard cryptographic tokenization.
• Search Targets & Investigation Queries: When you execute a scan, you supply target identifiers (usernames, email addresses, or phone numbers). These queries are processed ephemerally in real-time across concurrent backend workers and streamed back to your client session via Server-Sent Events (SSE).
• Investigative History & Dossier Logs: For authenticated accounts, your search targets, module execution telemetry, and aggregated findings are stored in an encrypted PostgreSQL database protected by strict Row-Level Security (RLS). You retain full discretion to inspect, export (PDF, CSV, JSON), or wipe individual or bulk history items at any time through your dashboard.
• Threat & Breach Indicators: For deep email audits, our engine queries authorized external cybersecurity threat feeds (via trusted threat intelligence partners) to evaluate exposure to known malware infections or public breach leaks. UserScanner does not acquire, hold, decrypt, or distribute plaintext credentials or private communications.
• Anti-Fraud & System Telemetry: To enforce rate limits, prevent credential stuffing, detect distributed scraping swarms, and protect against unpaid credit exploitation, our edge proxy logs pseudonymized client IP hashes, user-agent signatures, and timestamped API quotas.

3. Target Privacy & Absolute Non-Monetization

Unlike conventional data brokers, UserScanner does not harvest, compile, or trade personal data for commercial advertising:

4. Third-Party Service Providers & Sub-processors

We engage vetted third-party service providers who assist us in operating our high-availability infrastructure:

• Supabase: Provides enterprise database infrastructure, Row-Level Security, and identity authentication services.
• Dodo Payments: Serves as our authorized Merchant of Record, processing payments, handling localized currency exchanges, and calculating applicable statutory taxes. UserScanner does not receive, process, or store credit card numbers or banking credentials.
• Cybersecurity Intelligence Partners: External threat intelligence providers supplying infostealer threat telemetry and breach exposure indicators.
• Network Routing & Residential Proxy Infrastructure: Outbound routing networks distribute probe traffic across residential IP nodes strictly for transport layer load balancing; proxy providers do not inspect, log, or store investigative query payloads.
• Transactional Communication (Brevo): Used strictly for transmitting security-critical verification messages, such as Two-Factor Authentication (2FA) verification codes.

5. Your Legal Rights, Data Erasure & Delisting Protocol

In compliance with global data protection frameworks and statutory privacy standards, users and data subjects enjoy specific statutory rights:

• Right to Access & Portability: You may review and export all historical scan findings from your dashboard in structured JSON, CSV, or formatted PDF formats.
• Right to Erasure (Right to Be Forgotten): You can wipe your search history from your dashboard at any time. To request total account deletion, email our privacy team.
• Right to Delist (Global Query Suppression): If you are an individual and wish to request that an identifier associated with you (such as a personal username, email, or telephone number) be suppressed from public scan queries across UserScanner, you may submit a formal Delisting Request.

To submit an account deletion or identifier delisting request, contact support@user-scanner.in with the subject line "Delisting Request". Validated requests are processed within seven (7) business days following verification of identity or domain control.

6. Cookies & Client-Side Session Storage

UserScanner utilizes local browser storage (such as localStorage and secure session cookies) strictly for essential functional operations, including maintaining your authenticated session, storing theme preferences, and caching currency selection. We do not use third-party advertising cookies, cross-site tracking beacons, or behavioural ad pixels.

7. Information Security Safeguards

We employ multi-layered technical and administrative safeguards to protect your data, including Transport Layer Security (TLS 1.3) encryption in transit, strict database Row-Level Security (RLS) isolation, memory-bounded rate limiters, tokenized secret handling, and secure ephemeral socket lifecycle management.