Privacy Policy

We collect account information, project website URLs, scan configuration, audit findings, usage records, support communications, and technical data needed to operate and secure Scanlyst.

• Account details such as name, email address, authentication events, and preferences.
• Website targets, scan results, findings, evidence, remediation notes, schedules, and report settings.
• Service telemetry such as IP address, browser type, device information, timestamps, logs, and security events.
• Subscription status and billing identifiers. Payment card details are processed by Dodo Payments and are not stored directly by Scanlyst.

• Provide, maintain, troubleshoot, and improve the service.
• Run authorized scans, generate reports, monitor usage limits, and deliver requested alerts.
• Authenticate users, prevent abuse, investigate incidents, and protect our infrastructure.
• Process subscriptions, provide support, and send operational communications.
• Comply with legal obligations and enforce our agreements.

We use carefully selected providers for infrastructure, payments, transactional email, monitoring, and analytics. They may process data only to provide contracted services and subject to their own security and privacy commitments.

• Dodo Payments for checkout, subscription administration, tax handling, and payment records.
• Resend or another configured email provider for account and service messages.
• Cloud hosting, database, logging, and monitoring providers used to operate Scanlyst.

Scanlyst processes public website content and any credentials or integration secrets you intentionally provide for an authorized scan. Sensitive configuration is encrypted where supported and is restricted to the scan workflow. Do not submit credentials or data you are not authorized to use.

We retain account and scan data while your account is active and as reasonably necessary for service delivery, security, dispute resolution, and legal compliance. You may request account deletion. Some records may remain in backups or be retained where required by law, fraud prevention, or financial reporting obligations.

We use administrative, technical, and organizational safeguards designed to protect personal data. No online service can guarantee absolute security. You are responsible for protecting your account credentials and promptly reporting suspected compromise.

Depending on your location, you may have rights to access, correct, export, restrict, object to processing of, or delete personal information. You may also withdraw consent where consent is the legal basis for processing. Contact us to exercise a request; we may verify your identity before responding.

Scanlyst and its providers may process information in countries other than your own. Where required, we use appropriate safeguards for international data transfers.

Scanlyst is intended for business users and is not directed to children under 16. We do not knowingly collect personal information from children.

We may update this policy as the service, laws, or our practices change. Material changes will be communicated through the service or by email when appropriate.