solacess/ scanScan free

DRAFT — NOT LEGAL ADVICE. Template only; have a lawyer review before publishing, especially for GDPR/UK-GDPR/CCPA applicability. Notes for the reviewing lawyer are kept in the source file, not on this page.

Privacy Policy (DRAFT)

Last updated: [DATE]

This Privacy Policy explains what information Solacess collects when you use the service, and — because Solacess's product is itself a tool that touches *your* application's data during a scan — it also explains what we do with the target-application data a scan necessarily encounters.

1. Information we collect about you (the customer)

  • Account information: name, email, and billing details you provide when you sign up or

purchase a plan. Payment processing is handled by our payment provider ([Paddle / Lemon Squeezy / other — placeholder, pending the operator's choice]); we do not store your full card number.

  • Usage data: which scans you run, when, on which domains, and which plan features you

use — used for billing, product improvement, and abuse prevention.

  • Support communications: anything you send us via email or a support form.

2. Information a scan collects about your target application

This is the part specific to a security-testing product, and the part most important to be precise about:

  • Domain-ownership verification data: the DNS TXT record or file token you create to

prove you control the target domain (L0 in our check system). This proves ownership; it is not itself sensitive.

  • Passive scan data (Quick Scan): what's already served to any visitor's browser —

response headers, the shipped JavaScript bundle, TLS configuration, robots/security.txt presence. No login or account is required for this tier.

  • Active scan data (Deep Scan / Monitor): using test credentials you provide, Solacess

logs in and makes API calls to your application (via your Supabase anon key and, for payment checks, a Stripe test-mode key) to test for the check categories listed on our What we check page. This can include: request/response pairs proving a finding, database row samples fetched to prove an RLS/IDOR issue, and Stripe test-mode webhook events.

  • Test account credentials: stored encrypted (Supabase Vault) for the duration of the

scan and deleted after the scan completes. We do not use, store, or repurpose these credentials outside the scan you requested.

  • Redaction before storage: any secret or personal data captured as proof of a finding is

redacted/masked before being written to a report or log. Target source code is never persisted.

  • What we do NOT collect: real end-user data belonging to your customers. Our safety

design requires you to supply dedicated test accounts (Acceptable Use Policy, Section 2) specifically so a scan never needs to touch real user records. If a check nonetheless surfaces real user data as evidence of a leak (which can happen — that's the point of an IDOR check, for example), that specific finding is reported privately to you only, never shown to another customer or logged publicly, and is redacted before storage.

3. How we use this information

  • To run the scan you requested and produce your report.
  • To bill you according to your plan.
  • To detect abuse of the Acceptable Use Policy (e.g. a scan targeting a domain that fails

ownership verification repeatedly).

We do not use your scan data, findings or target application data to train models or to build datasets across customers. Solacess runs no AI model at scan time; its checks are deterministic.

4. Who we share information with

  • Sub-processors: Vercel (web hosting), Supabase (database, authentication and encrypted secret storage), Resend (transactional email) and our payment provider (currently Paddle). We will update this list before adding any other sub-processor.
  • We do not sell your data or your target application's data to third parties.
  • We disclose information if required by law, or if necessary to investigate suspected misuse

under the Acceptable Use Policy (see Acceptable Use Policy).

5. Data retention

  • Test credentials: deleted at the end of each scan (not retained between scans — a Monitor

subscription requires you to keep credentials current in your account, but scan-time use is still deleted after each run). Credentials are stored encrypted in Supabase Vault and the scan worker deletes them when the scan ends, whether it succeeds, fails or is stopped.

  • Reports: retained [PLACEHOLDER — X months/years] so you can access scan history, or until

you delete your account.

  • Billing records: retained as required for tax/accounting purposes.

6. Your rights

[PLACEHOLDER — this section needs jurisdiction-specific language. If selling to EU/UK/CCPA- covered customers, this needs GDPR/CCPA-compliant rights language (access, deletion, portability, etc.) and a lawful-basis-for-processing statement, which is not included in this draft.]

7. Security of the data we hold

We encrypt test credentials at rest (Supabase Vault), redact secrets/PII before storing scan proof, and restrict report visibility to the account that requested the scan. All traffic to Solacess uses HTTPS. Row Level Security is enabled on every database table so each organisation can read only its own data, and secrets are stored only server-side.

8. Children's privacy

Solacess is a B2B tool not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe we have, contact us and we will delete it.

9. Changes to this policy

We will post any change on this page and update the date at the top. For a material change, we will also email the account owner of every organisation at least 14 days before it takes effect.

10. Contact

[PLACEHOLDER — privacy contact email.]