Privacy Notice

Draft pending legal review · updated 4 July 2026 · DPDP-aligned, plain

For the scan itself we store only the website address you enter and the sanitized result. No page content. Stored in India. In the invite-only beta we also store your Google account email to check you against the access allowlist, and your scans are saved to your account so you can see your history.

1. Who is responsible

The Service is owned and operated by SurakshaScan, in India, the data fiduciary for now. For any privacy request or grievance, email contact@surakshascan.com.

2. What we store, and what we don't

We do store

  • The website URL you enter
  • Sanitized findings (e.g. “CSP header: missing”)
  • Score, grade, timestamps, engine versions
  • Your scan history, linked to your account, so the dashboard can show your sites and trends
  • Your authorisation attestation and product-improvement consent (email, version, time)
  • If you use the watch list: the sites you watch and the changes we detect
  • Coarse request metadata to prevent abuse (e.g. source IP, transiently)
  • When you start a scan: a Google reCAPTCHA Enterprise result for the scan request. Google receives the device and interaction signals needed for that bot check; we receive only a pass/fail score.
  • Beta only: your Google account email + basic profile, for access control

We never store

  • Page content / HTML of the scanned site
  • Passwords or credentials (we never log in)
  • Tracking or advertising profiles
  • Anything we sell (we never sell your data)

Please do not put personal information inside a URL you submit.

3. Why we store it (purpose & consent)

Under DPDP 2023 we rely on your consent, given at sign-in and at the authorisation step before your first scan, for limited purposes: to run the scan and show the result, to keep your scan history so you can see how a site trends, to keep watch on sites you add to your watch list, to control beta access, to prevent abuse (rate-limiting / anti-botnet), and to improve the Service. The product-improvement record is a sanitised, non-personal record of what each scan found: the type of finding, the score, the site's platform. Never page content, never secret values, never your identity attached to it. We do not use sign-in data for ads, profiling, or marketing.

4. Who we share it with

We do not sell your data. Processors: Google Cloud (India) for hosting and storage; Google / Firebase Authentication for beta sign-in; and Google Web Risk for the reputation check, which receives just the URL being checked.

5. Cross-border transfer (sign-in)

Beta sign-in uses Firebase Authentication, a global Google service that does not offer regional data residency, so your email and Google profile may be processed on servers outside India (primarily the US). We use this only to verify your beta access. All scan data and the allowlist itself remain in India.

6. Where it lives & how long

Scan data lives in India. If you are signed in, scan results are kept so your history and trends stay available; ask us and we delete them. If you scan without signing in, the result is kept for up to 180 days and then deleted. Abuse metadata expires after it is needed. Your beta email is kept while you are on the allowlist and removed on request. Sanitised product-improvement records contain no personal data and no link back to your account; they are kept to improve detection and build aggregate benchmarks.

7. Your rights (DPDP)

Subject to law, you may access, correct, complete, update, or erase your personal data, withdraw consent (ask to be removed from the allowlist), and nominate someone to act for you. To exercise any right or raise a grievance, email contact@surakshascan.com. If unresolved, you may escalate to the Data Protection Board of India.

8. Children, cookies, and security

The Service is for owners and operators 18 and older and is not directed at children. We use no advertising or tracking cookies; beta sign-in uses session cookies / local storage only to keep you signed in. Report branding you set for partner reports stays in your browser's local storage and never reaches our servers. We store sanitized data only, on private infrastructure, encrypted in transit, and minimize by design.

Privacy questions, requests, or grievances: contact@surakshascan.com