Privacy policy
This explains what we collect, why we collect it, who else sees it, and what you can require us to do about it. One thing is worth knowing before you read further: reports about domains are public, but what you personally looked up is not published and is not sold.
1. Who we are
SiteScano ("SiteScano", "we") publishes website reputation reports and security tools at sitescano.com. We are the business responsible for the personal information described here.
Postal address: SiteScano, 5th Floor, DLF Two Horizon Centre, Horizon Colony, DLF Phase 5, Sector 43, Gurugram, Haryana 122002, India. Privacy contact: [email protected].
2. What we collect
Information you give us
- Account details — email address, display name, password (stored hashed, never in readable form), and your notification settings.
- Submissions — scam reports, discussion comments and replies, correction requests, and any files you attach to them.
- Messages — what you write to support, press, partnerships or careers, including a CV if you apply for a role.
- Billing details for paid plans — name, billing address and the last four digits and type of your card. We do not receive or store full card numbers; payments are handled by our payment processor.
Information collected automatically
- Domains you check. The domain is recorded so we can build and update its report. It is not linked to your identity.
- Device and connection data — IP address, browser and operating system, referring page, and the pages you view.
- Cookies and similar technologies, described in section 4.
- Security logs — records used to detect abuse, scraping, credential stuffing and comment manipulation.
Information from other sources
- Registration and DNS records, security and blacklist providers, and link metrics from Ahrefs. This is information about websites, not about you.
- Our payment processor confirms whether a payment succeeded and the status of your subscription.
What we deliberately do not collect
We do not ask for government identity numbers, we do not want your card number or one-time passcodes in a scam report, and we do not build advertising profiles of visitors. If you send us something in this category, we delete it rather than store it.
3. How we use it
- To run the Service: produce reports, keep your account working, and deliver paid features you subscribe to.
- To moderate and publish Submissions, and to follow up with you about a report you filed.
- To detect and prevent fraud, abuse, scraping and coordinated review manipulation.
- To answer your messages and provide support.
- To improve accuracy — measuring where our scoring gets things wrong and adjusting the methodology.
- To send service messages, and, if you opt in, our newsletter. Every marketing email has an unsubscribe link that works.
- To comply with law and enforce our terms of use.
We do not use your personal information to train advertising models, and we do not sell it. See section 6.
6. Sale and sharing of personal information
Our position
We do not sell your personal data, and we do not share it with advertisers, in any form. We have not done so in the preceding twelve months.
Aggregated and de-identified statistics — for example, how many domains were checked in a month, or how scam categories are trending — are not personal information, and we may publish or license those. We do not attempt to re-identify de-identified data.
7. Your rights and choices
Under the Digital Personal Data Protection Act, 2023 you have the following rights over your personal data. We extend the same rights to everyone, wherever they live.
- Know and access — what we hold about you, where it came from, and who we disclosed it to.
- Delete — ask us to erase personal information we hold about you.
- Correct — ask us to fix inaccurate personal information.
- Portability — receive a copy in a portable format.
- Withdraw consent — as easily as you gave it, at any time.
- Nominate — name someone to exercise these rights on your behalf if you are unable to.
- Raise a complaint — with us at [email protected], and with the Data Protection Board of India if we fail to resolve it.
How to make a request
Email [email protected] from the address on your account, or write to the postal address in section 1. We verify requests before acting on them, usually by confirming control of the account email; for deletion of an account we may ask for one further confirmation.
We respond within 30 days. There is no charge unless a request is manifestly unfounded or excessive.
An authorised agent may act for you if you give them written permission and we can verify it. If we deny a request, you may appeal by replying to our decision with the word "appeal"; a different reviewer will consider it and respond within 45 days with written reasons.
Marketing
Unsubscribe from any marketing email using the link in it, or from your account settings. We will still send necessary service messages, such as billing notices and security alerts.
8. Content you choose to make public
Discussion comments are published
When you post a comment on a report or article and it is approved, the text becomes publicly visible with your display name and can be read, quoted, indexed by search engines and archived by third parties. Your email address is never published. Scam reports work differently: your name and email are never published, and what you describe can inform the findings on the public report page.
Write your submission on the assumption that it will be read by the business you are describing. Do not include your account numbers, order references containing personal data, or details that identify other people.
You can ask us to remove your submission at any time. We will remove it from our site, though we cannot recall copies that search engines or others already made.
9. How long we keep it
- Account data — while your account is open, then deleted within 30 days of closure, except where we must keep records longer.
- Published submissions — kept while published; the account link is removed when an account is deleted.
- Support and correction correspondence — 24 months, so we can show how a dispute was handled.
- Security and abuse logs — 12 months.
- Billing records — as long as tax and accounting law requires.
- Domain report data — retained indefinitely, since it concerns websites rather than people.
10. Security
We use encryption in transit, hashed password storage, access controls limiting staff access to what their role requires, logging of administrative actions, and regular dependency and infrastructure patching. Payment card data never reaches our servers.
No system is perfectly secure. If a breach affects your personal information we will notify you and the relevant authorities and the Data Protection Board of India as required, without unreasonable delay.
11. Where your data is processed
We are based in Gurugram, India, and our team works from there. Some of our service providers — hosting, email delivery and payment processing — operate infrastructure outside India, so your data may be stored or processed abroad by them under contract. Access is limited by role and logged.
By using the Service you understand that your data will be handled as described here.
12. Children
The Service is intended for users aged 18 and over. We do not knowingly collect personal data from children, and we do not direct the Service to children. If we learn that we have collected data from a child, we delete it promptly. A parent or guardian who believes a child has provided us with information should write to [email protected].
13. Changes and how to contact us
We update this policy when our practices change. The "last updated" date at the top always reflects the current version, and we give notice of material changes before they take effect.
Privacy questions and requests: [email protected].
Postal: SiteScano, 5th Floor, DLF Two Horizon Centre, Horizon Colony, DLF Phase 5, Sector 43, Gurugram, Haryana 122002, India.
Other contact routes are listed on our contact page.