Effective date: 18 October 2026 · Version: 1.2
This notice explains what personal data ScanDefend collects, why, how long we keep it, who helps us process it, and your rights. It covers:
- customers who buy scans or create accounts;
- website owners whose sites are scanned, and people who use our opt-out or abuse forms;
- people who email us (support, billing, abuse, security, privacy) or message us on WhatsApp;
- visitors to
scandefend.comandapp.scandefend.com; and - newsletter subscribers, if you have signed up.
1. Who is responsible for your data
The controller is IronSky Limited, trading as ScanDefend, a company registered in Ireland.
- Company number: 659967 (Companies Registration Office, Ireland)
- Registered office: First Floor, Penrose 2, Penrose Dock, Cork, Ireland
- Privacy contact: privacy@scandefend.com
- Data protection officer: we have not appointed one, as the law does not require it for our processing. Please send all privacy questions to privacy@scandefend.com.
- South Africa (POPIA): our Information Officer is IronSky Limited's director, who can be contacted at privacy@scandefend.com.
2. What we collect
We collect only what the features you use need.
| Category | What it is | Where it comes from |
|---|---|---|
| Purchase details | The email address you give at checkout; payment status, amount, currency, date and the number of credits; Stripe's references for the payment, refund or dispute; and the purchase event records Stripe sends us, which can include your name, country and billing details. We never receive your full card number. If you lose access to your email, support may ask for details such as the last 4 digits of your card, the purchase date and amount, and check them against Stripe's records. | You, through Stripe Checkout |
| Security and anti-abuse signals | Your IP address, the result of the Cloudflare Turnstile check (a check that you're a person, not a bot), request logs, and the limits we apply per website, payment, wallet or account | Your browser, Cloudflare, Stripe |
| Claim session | A random identifier in a secure cookie that links your browser to your wallet and scans before you have an account. We store only a one-way hash of it. | Set by us |
| Scan data | The website you asked us to scan, what our checks observed about the website's public configuration (for example its security settings, announced software versions and public domain records), the evidence behind each finding, and the report | Our checks of the public website and public sources |
| Account data | Your email address; your sign-in methods (passkey, email link or code, or a supported sign-in provider: Google or Apple); your sessions; your organisation and role; wallet balance and history. From a sign-in provider we receive only your provider account identifier, your name and, where the provider confirms it, your email address. We don't read your contacts or files, and we don't keep the provider's access tokens. | You, and the sign-in provider you choose |
| Profile and company details | Asked once after you first sign in, and editable in Account & security. Required: your full name; whether you buy for your business, for clients or for yourself; your company or trading name (not asked if you buy for yourself); your country. Optional: your role or job title; your company's size band; your company's website; a VAT or tax number (checked for format only); a phone number. We also record when you saved these and which version of this notice you were shown. We don't buy data about you or your company from anyone else. | You |
| Site-owner requests | The domain, your message, and a keyed one-way hash of the email address you give us on the opt-out or abuse form; the Turnstile result | You |
| Emails you send us | The message, its headers and attachments, and our replies | You |
| WhatsApp messages you send us | Your phone number, your WhatsApp profile name, the messages and files you send, and our replies | You (through WhatsApp) |
| Immediate-start confirmation | When you start scans straight away: that you asked us to start them and understood you lose your 14-day right to withdraw for each scan once it has been fully performed; the wording version, the order, your account (or, before you have one, your wallet) and the time | You |
| Marketing consent records (only if you sign up) | Your email address, what you agreed to, where you signed up, the wording version, when you confirmed and when you unsubscribed | You |
| Performance and page-usage measurements | For a sample of page views on scandefend.com: a page-speed measurement, the page it was taken on and how the page was opened. For every page view: a count against the page you viewed (viewed, read, clicked a link to the app, answered "Was this helpful?"). Neither is linked to you. See section 2.1. |
Your browser |
About website owners: a scan can pick up information that identifies a person, for example a contact email published on the site or in a DNS record. We collect only what the website or public sources already publish, and only in the course of the checks described at a high level in our Scan Authorization Terms and on our bot page.
2.1 Performance and page-usage measurement on our marketing site
On scandefend.com, about 1 in 10 page views sends a small first-party measurement to our own servers: the name and value of a page-speed metric (such as how long the main content took to appear), the page path (only from a fixed list of our own pages) and the navigation type (for example a normal visit or a reload). It uses no cookies, reads and stores nothing on your device, and we do not store your IP address or browser details with it. Your IP address is used only for a moment to apply rate limits. The measurements are kept in aggregate for up to 3 months.
We also count how our pages and articles are used, so we know which ones help. When you view or read a page on scandefend.com, your browser sends a small first-party message to our own servers: the page path, what happened (viewed, read to the end, clicked a link to the ScanDefend app, signed up to the newsletter, or answered "Was this helpful?"), the kind of place you came from (search, social, email or other, not the address itself) and any campaign tags in the link you followed. Links from our pages to the ScanDefend app carry the page they were on, so that when an account is created or an order is paid we can add one to the count for that page. For a checkout, that page path is held briefly on the pending payment record only so the paid order can be counted once; it is cleared as soon as the order is counted or the payment fails or expires (and in any case within two days), so it is not kept with the payment record. The counts are not linked to the account. This uses no cookies, reads and stores nothing on your device, and we do not store your IP address or browser details with it; each message only adds one to a daily count for that page. Your IP address is used only for a moment to apply rate limits and to ignore automated traffic. To limit abuse of the "Was this helpful?" buttons, we also keep a pseudonymous code made from your IP address and the date with a secret key. It changes every day and is deleted after 2 days. We do not count visits from browsers that send Do Not Track or Global Privacy Control. If you answer "No" you can write an optional note. When you send it, Cloudflare Turnstile runs a check that you are a person, as described in Cloudflare's Turnstile Privacy Addendum. Notes are pseudonymous: we keep the text (links, email addresses and long numbers are removed automatically) with the page and the date, and we ask you not to include names, emails or other personal details. If you do, contact us and we will delete the note. Daily counts are kept for up to 25 months and notes for 90 days. If you arrive from one of our ads, the link carries the ad campaign labels (source, medium, campaign, content and keyword) to the ScanDefend app, and when you start a checkout we keep those labels with the payment record for 90 days, so we can count which campaigns lead to paid orders (the daily per-campaign order and revenue counts are not linked to the account and are kept for up to 25 months). If you are outside the EEA, the UK and Switzerland, we also keep the ad click identifier (Google's gclid, gbraid or wbraid) with the payment record for the same 90 days, only to measure which ads lead to purchases; we never keep it for visitors in the EEA, the UK or Switzerland. None of this is stored on your device (no cookies, no local or session storage), it is not used for pricing, shown to you or put in emails or reports, and it is deleted with the account. It is not collected from browsers that send Do Not Track or Global Privacy Control.
3. Why we use it, and our legal basis
| Purpose | Data | Legal basis (GDPR Art. 6; POPIA s11) |
|---|---|---|
| Selling credits, running scans, producing and delivering reports | Purchase, claim session, scan and account data | Performing our contract with you |
| Running accounts and organisations: knowing who an account belongs to and showing the right company details | Profile and company details, account data | Performing our contract with you; our legitimate interests in running business accounts |
| Support, and checking that a request really comes from the account holder (support staff see your profile with the phone number partly hidden; each lookup is logged) | Profile and company details, account data, purchase details | Performing our contract; our legitimate interests in secure support |
| Understanding, in aggregate, what kinds of customers use ScanDefend (for example country, buying purpose or company size band) so we build and price the right things | Profile and company details | Our legitimate interests in developing our business. Used only in aggregate. You can object at any time. |
| Letting you resume or recover access (resume links, support recovery) | Purchase email, claim session, limited payment details | Performing our contract; our legitimate interests in secure access |
| Preventing fraud, abuse and unauthorised scanning, and keeping ScanDefend secure | IP address, Turnstile results, logs, payment and scan records | Our legitimate interests in security and abuse prevention |
| Checking public websites for our customers | Scan data about third-party websites | Our and our customers' legitimate interests in improving website security. We only read what the site or public sources already publish. |
| Handling opt-out and abuse requests from website owners | Site-owner requests | Our legitimate interests in respecting site owners' wishes and preventing misuse |
| Accounting, tax and payment records | Purchase details | Legal obligation |
| Answering your emails, abuse reports and security reports | Email data | Our legitimate interests in responding to you |
| Answering your WhatsApp messages | WhatsApp data | Our legitimate interests in responding to you, or performing our contract when you are a customer |
| Handling privacy requests | Email data, the data concerned | Legal obligation |
| Service emails (sign-in links, receipts, "your report is ready", capacity notices) | Email address | Performing our contract |
| Newsletter and product news | Email address, consent record | Consent (see section 6) |
| Measuring page speed and page usage on our marketing site | Performance and page-usage measurements | Our legitimate interests in a fast, working website |
| Establishing, exercising or defending legal claims, and complying with lawful requests from authorities | Any of the above, as needed | Legal obligation; our legitimate interests |
Where we rely on legitimate interests, we have weighed them against your rights. You can ask us for details, and you can object (section 10).
4. Automated decisions and AI
Automated fraud and abuse controls. To protect the service, some decisions are made automatically: Stripe screens payments for fraud and may decline one; Cloudflare Turnstile may stop a request it judges to come from a bot; and our systems automatically refuse scans of opted-out or blocked websites, of addresses that aren't public websites, or above per-site, per-customer or capacity limits. These controls can stop a purchase or a scan. If you think one has affected you wrongly, email support@scandefend.com or privacy@scandefend.com and a person will review the decision, and you can give us your point of view. Apart from these controls, we make no decisions about you based solely on automated processing that have legal or similarly significant effects.
AI. We do not send your account details, payment details, scan data or emails to AI providers. We may use AI models from Anthropic to help write general content such as blog articles, which does not involve your personal data. If we start using AI to process personal data, for example to explain reports, we will update this notice before we do.
5. We don't sell your data
We don't sell your personal data, and we don't share it with anyone for their own advertising.
6. Marketing
- Buying a scan never signs you up for marketing. Neither does creating an account.
- We send newsletters or product news only if you tick an unticked box and confirm by clicking a link in an email (double opt-in).
- Every marketing email has a one-click unsubscribe link. Unsubscribing takes effect before any further marketing email is sent.
- Marketing email is sent from a scandefend.com address, separately from service email, which comes from
no-reply@scandefend.com. - Service emails (sign-in links, receipts, report-ready notices) are part of the service and aren't marketing.
See Marketing Consent Wording for the exact wording.
7. How long we keep it
| Data | How long |
|---|---|
| Anonymous (unclaimed) scan reports and evidence | Deleted after 30 days if not saved to an account. A record that the scan took place (the domain, the time and the outcome) is kept with our payment and abuse records. |
| Claim session cookie | Up to 7 days; ended when the wallet is saved to an account |
| Resume links and email sign-in links | Single use; expire after 15 minutes (sign-in codes after 10 minutes) |
| Saved reports and findings | While your account exists. You can delete them sooner. When you delete your account, the website names are also removed from the scan records we keep for payment purposes. |
| Scan evidence | Kept with the report it belongs to, and deleted when you delete that report or your account |
| Homepage screenshots (verified domains only: one picture of the homepage as a visitor sees it, taken without cookies or sign-in) | Up to 30 days, and deleted sooner with the report or your account |
| Account data, profile and company details | While your account exists. Deleted when you delete your account (company details are deleted with the organisation when you are its only member). |
| Sign-in provider tokens | Not kept |
| Consent to start scans immediately (and give up the right to withdraw) | 6 years from the end of the financial year of the order, with the order and payment records, to show the consent was given. Kept even if you delete your account, separated from your scans. |
| Payment, refund, dispute and tax records, including Stripe's purchase event records | 6 years from the end of the financial year of the transaction, as Irish tax and company law requires. These are kept even if you delete your account, separated from your scans. |
| Audit records (who did what in our systems) | 2 years |
| Service and security logs, including IP addresses | Up to 30 days, with personal data removed where possible |
| Emails to our known addresses (support, billing, abuse, security, privacy) | 90 days, or longer while the matter (such as a dispute, abuse case or legal claim) is open |
| WhatsApp conversations with our support line | Up to 90 days after each message, or longer while the matter is open; you can also delete the chat on your own phone at any time |
| Emails to unknown addresses at scandefend.com (headers and the start of the message only) | 30 days |
| Records of privacy requests and how we handled them | 2 years after the request is closed |
| Site-owner opt-outs | For as long as the opt-out applies, so we keep honouring it |
| Abuse reports and case records | 2 years after the case is closed |
| Unconfirmed newsletter sign-ups | Confirmation link expires after 48 hours; the sign-up is deleted after 14 days |
| Marketing consent records | While you are subscribed and afterwards, for as long as we need to show we had your consent |
| Unsubscribe (suppression) list | Indefinitely, as a one-way hash of your email address, so we never email you marketing again |
| Performance measurements (section 2.1) | Up to 3 months, not linked to any person |
| Page-usage counts (section 2.1) | Daily counts for up to 25 months; "What was missing?" notes up to 12 months; not linked to any person |
| Ad campaign labels and click identifier on a payment record (section 2.1) | 90 days; the click identifier only for visitors outside the EEA, the UK and Switzerland |
We may keep data longer where the law requires it, or where we need it to establish, exercise or defend a legal claim.
8. Who processes data for us
| Provider | What they do | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, databases and file storage, queues, bot checks (Turnstile), security, performance measurement, inbound email routing and service email sending | Global network; our databases and file storage are created in Cloudflare's EU jurisdiction. Cloudflare is based in the United States. |
| Stripe (including its Link service) | Payments, tax, receipts and invoices, fraud checks and disputes. Stripe is the merchant of record for credit purchases and acts as an independent controller for the payment data it collects; its own privacy notice applies. | Ireland, the United States and other countries where Stripe operates |
| Amazon Web Services (Amazon SES) | Sending marketing email, only if you have signed up | AWS data centres; AWS is based in the United States |
| WhatsApp Ireland Limited (Meta) | Carrying messages you choose to send our WhatsApp support line. WhatsApp acts under its own terms and privacy policy for its service. | Ireland and the other countries where Meta operates, including the United States |
| Anthropic | AI models for general content writing (no customer personal data, see section 4) | United States |
| Sign-in providers you choose (Google, Apple) | Confirming who you are when you sign in with them. They act as independent controllers under their own terms. | Their own locations |
Public sources our checks consult (public DNS resolvers and public vulnerability databases) receive the domain name or software versions being checked, not your personal details.
We may also disclose personal data to professional advisers, to a buyer or successor of our business, or to authorities, courts or law enforcement where the law requires it or where it is necessary to protect our rights, our customers or others.
9. Where your data is stored, and transfers
We create our databases and file storage in Cloudflare's EU jurisdiction. We don't guarantee that all data stays in any particular country. Some processing happens elsewhere: Cloudflare runs our code at the location nearest the visitor, and Stripe, Amazon Web Services, Anthropic, Meta (WhatsApp) and Cloudflare are US-based and may process data in the United States and other countries.
When personal data is transferred outside the EEA, we rely on a European Commission adequacy decision (including the EU-US Data Privacy Framework, where the recipient is certified under it) or on the European Commission's Standard Contractual Clauses, with additional safeguards where needed. For personal data of people in South Africa, we rely on these same binding agreements, which give an adequate level of protection as POPIA requires. You can ask us for a copy of the relevant safeguards at privacy@scandefend.com.
10. Your rights
Under the GDPR (and, where it applies, POPIA and other laws), you have the right to:
- access your personal data and get a copy of it;
- correct data that is wrong or incomplete;
- delete your data;
- restrict how we use it;
- object to our use of it where we rely on legitimate interests, including for the aggregate product analysis in section 3;
- data portability: receive data you gave us in a machine-readable format;
- withdraw consent at any time (for example by unsubscribing), without affecting what we did before;
- ask for human review of an automated decision (section 4); and
- complain to a supervisory authority: in Ireland, the Data Protection Commission (dataprotection.ie); in South Africa, the Information Regulator (inforegulator.org.za); or the authority where you live or work.
How to exercise them: use the export and delete options in your dashboard, or email privacy@scandefend.com. We may need to verify your identity first; for anonymous scans we may ask you to open a resume link sent to your checkout email. We'll reply within one month of receiving your request. Where a request is complex or we receive many, we may extend this by up to two further months, and we'll tell you why within the first month. These rights have limits set by law; for example, we must keep payment records for tax purposes even if you ask us to delete them.
11. Security
We protect data with measures such as encrypted connections, secure cookies that page scripts can't read, one-way hashing of sign-in tokens and identifiers, separation between customers' data, limited staff access with strong authentication, and tamper-evident audit logs. No system is perfectly secure.
If a personal data breach is likely to put your rights at risk, we'll notify the Data Protection Commission within 72 hours where the law requires, and tell you without undue delay where the risk is high. To report a security issue in ScanDefend, see our Vulnerability Disclosure Policy.
12. Children
ScanDefend is not intended for anyone under 18, and we don't knowingly collect children's personal data. If you believe a child has given us personal data, email privacy@scandefend.com and we'll delete it.
13. Changes
We'll update this notice when what we collect, why, or who processes it changes. The effective date at the top shows the current version. We'll tell account holders about material changes by email or in the product.
14. Contact
privacy@scandefend.com · IronSky Limited, First Floor, Penrose 2, Penrose Dock, Cork, Ireland