What we collect

• Account details — your email, password (stored hashed), and optional company name.
• Scan activity — the domains you scan and the results we generate, so we can show history and run monitoring.
• Lead form submissions — if you ask for help fixing findings, the contact details and context you provide.
• Server logs — IP address and basic request data, used for security, abuse prevention, and rate limiting.
• A session cookie — required to keep you logged in. We do not use third-party advertising or cross-site tracking cookies.

How we use it

To provide the scanning and monitoring service, maintain your account, send monitoring alerts you request, contact you about billing for paid features, prevent abuse, and meet legal obligations. We do not sell your personal information.

When we share it

• Security providers (lead forms): if you submit the "get help fixing this" form, we may share your submission with one or more third-party security providers so they can contact you. Don't submit that form if you don't want to be contacted.
• Service providers: hosting and infrastructure vendors that operate the service on our behalf, under confidentiality obligations.
• Legal: where required by law or to protect the service, our users, or others.

We do not otherwise sell or rent your personal information.

Retention

We keep account and scan data for as long as your account is active, and logs for a limited period for security. You can ask us to delete your account and associated data at any time.

Your rights

Depending on where you live (including the EU/UK under GDPR and California under the CCPA/CPRA), you may have the right to access, correct, delete, or export your personal information, and to object to certain processing. To exercise any of these, email us and we'll respond as required by law. We will not discriminate against you for exercising these rights.

Security, children, and location

Passwords are hashed and sessions are protected. No system is perfectly secure, so we can't guarantee absolute security. The service is not directed to anyone under 18, and we don't knowingly collect their data. The service is operated from the United States; if you use it from elsewhere, your data is processed in the US.

Changes & contact

We'll post any changes here with a new "last updated" date. Questions or requests: george@tronkits.com.