Legal
Privacy Policy
DRAFT v0.1 · last updated 18 October 2026
This policy explains how [Business legal name, ABN] ("ShipCheck") collects and handles personal information, consistent with the Australian Privacy Principles and, where applicable, the GDPR.
What we collect
- Account and lead data: your email address, when you sign up or request a full report, and your plan/billing status.
- Billing data: handled by Stripe. We store your Stripe customer and subscription IDs, not your card details.
- Scan data: the URLs you scan, findings, health scores, redacted previews (first 6 characters) and one-way fingerprints of detected secrets, Supabase table names and row counts (never row contents), uptime results.
- Technical data: a keyed hash of your IP address for rate limiting and abuse prevention, and standard server logs from our host.
How we use it
- To run scans, show results, send report, alert and sign-in emails, and process payments.
- To send product updates and tips by email. We add sign-ups to our email marketing list (ActiveCampaign). Every marketing email has an unsubscribe link. [Terry to confirm: explicit opt-in checkbox vs. inferred consent]
- To publish anonymised, aggregate statistics (e.g. "X% of scanned apps had public tables") that never identify a site or person.
Who we share it with (service providers)
- Vercel (hosting), Neon (database), Resend (email delivery), Stripe (payments), ActiveCampaign (email marketing), Cloudflare/Google public DNS-over-HTTPS resolvers (DNS lookups of scanned sites).
- Some providers store data outside Australia (e.g. the United States).
- We never sell personal information and never share scan findings with third parties.
Retention
Scan results are kept while your account is active and deleted [90 days / on request] after account closure. Free scans that are never linked to an account are deleted after [30 days]. Uptime checks are kept for 30 days.
Your rights
You can request access to, correction of or deletion of your personal information, and unsubscribe from marketing at any time, by emailing [privacy email]. You may complain to the OAIC (oaic.gov.au) if you're not satisfied with our response.
Security
Data is encrypted in transit, sessions use HTTP-only cookies, sign-in tokens are stored hashed, and full secret values are never stored.
Contact
[Business name, address, privacy email]