Privacy Policy

1. What we collect

Account data: your email, a hashed password (we never see or store it in plain text), and your organization name and branding (logo, color, contact info) if you set it.

Domain and scan data: the domains you add and the public DNS records our checks read (SPF, DMARC, DKIM, BIMI, MTA-STS), plus the scores, grades, and findings we compute from them. If you manually upload or configure automatic receipt of DMARC/failure/TLS reports, those reports — which can include sending-server IP addresses and limited message metadata, never message content — are stored and parsed.

Optional connections: if you connect a DNS provider (Cloudflare, GoDaddy), CRM (HubSpot or a webhook URL), PSA (ConnectWise, Autotask, HaloPSA), or a sending mailbox for inbox-placement testing (Section 4), we store the credential or token you provide so the Service can act on your instructions (Terms Section 5). We never use these connections except when you trigger the specific action they enable.

Billing data: handled by Stripe, Inc. — we receive and store only a subscription status and a Stripe customer reference, never your card number.

Embed widget visitors: if you enable the embeddable scan widget on your own site, a visitor who requests the full report submits their name, email, and optionally company, job title, and phone. You are the data controller for this information — we process and store it on your behalf, hand it back to you on your Leads page, and forward it to your connected CRM if you've set one up. We don't use it for our own marketing.

Usage data: ordinary web server logs (IP address, timestamp, requested URL) and, once enabled, error/performance data via Sentry.

Website analytics and advertising cookies: on our public website and signup pages only, and only if you accept them in the cookie banner, we load Google Analytics, HubSpot, the Meta pixel, the LinkedIn Insight Tag and Microsoft Clarity (which records how pages are scrolled and clicked). They record which pages you visit and which campaign or ad brought you here, so we can see what helps MSPs find ActiScan and show our ads to people who've visited. If you decline, none of them load. You can change your choice any time with “Cookie preferences” in the site footer. They never run inside the ActiScan dashboard or on report pages we host for your clients. Separately, if you arrive through a link carrying campaign tags (such as utm_source), we keep those tags in a first-party cookie for up to 90 days and attach them to your Stripe subscription if you subscribe, so we know which campaign led to it.

Website chat: if you ask STACEY a question on our public website, your question and the conversation so far are sent to Anthropic to write the answer. We don't save the conversation. To limit how many questions one visitor can ask a day, we store a one-way hash of your IP address with the time of each question, not the address itself and not what you asked.

2. How we use it

• To operate the Service: run scans, render your dashboard and reports, enforce plan limits, process billing
• To generate AI-written remediation text, Help-assistant answers and answers in the website chat (Section 3) — never to train a model, ours or anyone else's
• To send transactional email: signup confirmation, password reset, scan-finding alerts, and (Terms Section 3) trial-ending and billing notices
• To detect abuse and keep the Service secure and available

3. Who we share it with

We don't sell personal data. We share it only with the sub-processors that run the Service, each bound by their own data-processing terms:

• Supabase — database, authentication, and file storage
• Vercel — application hosting
• Stripe — payment processing
• Resend — outbound transactional email and, where configured, inbound DMARC/TLS report receipt
• Anthropic — generates AI remediation text, Help-assistant chat answers and website chat answers from scan/check data and your questions; never receives your account password or payment details
• Google (Safe Browsing API) — checks a submitted URL against known-phishing lists, only when you use the phishing-link tool
• AbuseIPDB — checks the reputation and country of the sending IP addresses that failed DMARC in your uploaded reports, only when you run a threat-intelligence check; receives those IP addresses only
• Recraft — generates cover images for our public blog posts from a short text prompt about the post's topic; receives no customer or account data
• Google, HubSpot, Meta, LinkedIn and Microsoft (Clarity) — website analytics and advertising, only if you accept cookies on our public website (Section 1)
• Any CRM, PSA, or DNS provider you personally choose to connect (Section 1)

We may also disclose data if required by law, subpoena, or to protect the rights, property, or safety of Securafy, our users, or the public.

4. Google user data (Gmail sending connection)

ActiScan's inbox-placement testing lets you connect a Google Workspace or Gmail mailbox on a domain you manage, so the Service can send a test message from that domain to our seed mailboxes and measure where it lands — inbox, spam, or undelivered. This section describes exactly what that connection grants and how we handle it. It applies only if you choose to connect a Google mailbox; nothing here happens otherwise.

The scope we request: gmail.send, and nothing else. This is the narrowest Gmail scope Google offers — it permits sending a message on your behalf and grants no other access. It does notlet us read, search, download, modify, or delete anything in your mailbox, and we never attempt to. We do not read your inbox, sent mail, drafts, contacts, or labels.

What we store: the connected mailbox's email address and an OAuth refresh token, encrypted at rest and scoped to the tenant and domain you connected it to. The token exists for one purpose: so a placement test you scheduled or triggered can send its test message.

What we do with it: send the test message you asked for. The placement result is measured at our seed mailboxes — the receiving side — not by inspecting your Google account. We do not use Google user data for advertising, we do not sell it, and we do not use it to train any AI or machine-learning model (ours or anyone else's). We do not transfer it to anyone except: to provide this feature, and only with your consent; for security purposes, such as investigating abuse; to comply with applicable law; or as part of a merger, acquisition, or sale of assets, and then only after obtaining your explicit prior consent. No Securafy employee reads Google user data unless you have given affirmative agreement for us to view the specific data in question (for example, when you ask us to investigate a support issue), it is necessary for security purposes such as investigating a bug or abuse, it is necessary to comply with applicable law, or the data is aggregated and used for internal operations in accordance with applicable privacy law.

Limited Use commitment: ActiScan's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access: disconnect the mailbox from your ActiScan dashboard at any time, which deletes the stored refresh token. You can also revoke ActiScan's access directly from your Google Account at myaccount.google.com/permissions. Either action stops all future test sends from that mailbox.

5. Data retention

We retain account and scan data for as long as your account is active, plus a reasonable period after cancellation in case you resubscribe, then delete it. You can request earlier deletion (Section 7). Server logs are retained for a limited period for security and troubleshooting, then automatically purged.

6. Security

Data is encrypted in transit (TLS) and at rest via our infrastructure providers. Access to production data is limited to what's needed to operate the Service. No method of transmission or storage is 100% secure, and we can't guarantee absolute security — see Terms Section 7.

7. Your rights and choices

You can access, correct, export, or delete most of your own account data directly from the dashboard. To request deletion of data we can't self-serve (e.g. after account closure) or to exercise a right your local law provides (access, correction, deletion, portability, or objection to processing), email privacy@securafy.com. If you're a visitor whose data was submitted through someone else's embedded ActiScan widget, contact that website's owner first, since they control that data — we'll assist them with a legitimate request.

8. Children's privacy

The Service is a B2B product for businesses monitoring their own or their clients' domains. It's not directed to children, and we don't knowingly collect data from anyone under 16.

9. International data transfer

Our infrastructure providers may process data in the United States and other countries. If you're accessing the Service from outside the U.S., you understand your data may be transferred to and processed in a country with different data-protection laws than your own.

10. Changes to this policy

We may update this policy as the Service evolves. For material changes, we'll notify active subscribers by email at least 15 days before the change takes effect.

11. Contact

Questions about this policy or a privacy request: privacy@securafy.com.