Privacy Policy
Last updated: June 24, 2026
1. What data we process
We process your email and account data (for authentication and billing), the URLs you scan, and the results of each scan (findings, score, technical evidence). Anonymous scans are stored temporarily and expire automatically.
2. Data processors
We use providers that process data on our behalf: Supabase (database and authentication), Vercel (hosting), Vercel Web Analytics and Vercel Speed Insights (usage telemetry, loaded only after you consent), OpenRouter (routing to AI models to generate remediation prompts on demand; it may direct the request to different model providers), Polar.sh (payments), Resend (transactional email), and Upstash (rate limiting). Each one only processes the data needed for its function. Some of these providers are located outside your country, so certain data may be processed through international transfers with the applicable safeguards.
3. What we use it for
To provide the service: run scans, display results, manage your plan, and send you transactional notices (for example, when a report is ready). We do not sell your data or use it for third-party advertising.
4. Cookies and analytics
Once you accept analytics in our consent banner, we load Vercel Web Analytics and Vercel Speed Insights to understand aggregate usage and page performance. These tools are designed to be privacy-friendly and cookieless, do not build advertising profiles, and collect only limited, aggregated data. They run only after you consent; if you decline, they are never loaded. You can change your choice at any time by clearing the pursecure_consent cookie in your browser, which brings the banner back. We do not sell or share your personal information, and we do not use it for cross-context behavioral advertising; for residents of California and similar jurisdictions, this is our "Do Not Sell or Share My Personal Information" statement: we do not sell or share it.
5. Legal bases for processing
We process your data on the following bases: performance of the contract (to provide the service you request, such as running scans and managing your plan); your consent (for optional analytics telemetry); our legitimate interests (security, abuse prevention, and improving the service, balanced against your rights); and compliance with legal obligations (for example, billing and tax records).
6. Data retention
Anonymous scans are stored temporarily and expire automatically after a short period. Data tied to an authenticated account (your email, account settings, and your scan history) is kept while your account remains active and is deleted on request or after account closure, except where we must retain certain records to meet legal or accounting obligations.
7. Your rights
You can request access, rectification, erasure, portability, and restriction of, or objection to, the processing of your personal data, and you may withdraw consent at any time. In accordance with Ley 21.719 (Chile), the LGPD (Brazil), and other data-protection regulations applicable in your country, exercise your rights by writing to [email protected]. We will respond within a reasonable period. You also have the right to lodge a complaint with the data-protection authority of your country or state of residence.
8. Security measures
We apply reasonable technical and organizational measures to protect your data, including encryption in transit, access controls, and the principle of least privilege. No method of transmission or storage is completely secure, but we work to protect your information against unauthorized access, loss, or misuse.
9. Data breach notification
If a security incident affects your personal data, we will notify the relevant data-protection authority and, where required by law, the affected users without undue delay, describing the nature of the incident and the measures taken.
10. Children
The service is not directed to minors under the age of majority for data-protection purposes in their country of residence. We do not knowingly collect personal data from children; if you believe a minor has provided us data, write to [email protected] so we can delete it.
11. Data controller
The data controller is Pursecure. You can contact us at [email protected].