Privacy Policy

What we collect

• Email address (to send your results and receipts)
• Target URL (to perform the scan)
• Scan results (findings from the security assessment)
• Basic usage data from our own first-party analytics: pages visited, buttons clicked, and how you arrived (for example, a referring site)
• Payments are processed by Stripe. We never see or store your full card number.

What we don't collect

• Your users' data
• Passwords or credentials
• Sensitive application data

Email and our newsletter

We use your email to send scan results, receipts, and messages about scans you run. We add you to our newsletter, a free monthly report on how AI-built apps get hacked, published by the team behind Nullscan, only if you choose to by ticking or clicking a clearly labeled newsletter option. You can unsubscribe at any time from any newsletter email.

Aggregated statistics

We may publish aggregated, anonymized statistics drawn from many scans, for example the share of scanned apps that had a certain type of issue. These statistics never identify a website, a person, or an individual finding.

Data retention

• Unpaid scan results: 30 days
• Paid scan results: indefinitely
• Newsletter subscription: until you unsubscribe

Data sharing

We do not sell your data. We share it only with the services that run Nullscan, and only as needed: Stripe for payments, our email provider to deliver email, our newsletter platform if you subscribe, and our hosting and AI model providers to run scans and write reports. Scan results are only accessible via unique, unguessable links.