Privacy & Data Protection

1. Overview

This Privacy & Data Protection Policy explains how Spidanest™ ("Spidanest," "we," "us," or "our") collects, uses, shares, protects, and retains information when you use our website, threat-analysis engine, and related services (the "Service"). It also describes the choices and rights you have over your information.

We designed the Service to collect only what is needed to detect threats, operate accounts, and improve accuracy. This policy applies to all users and works together with our Terms & Conditions.

2. Information We Collect

We collect the following categories of information:

• Account information — your email address, an encrypted (hashed) password or a federated identifier if you sign in with Google, and your plan and role.
• Content you submit for analysis — the URLs, messages, images, or text you ask the Service to scan, together with the results generated.
• Usage and diagnostic data — scan counts and timestamps, feature interactions, and error logs used to operate and secure the Service.
• Technical data — IP address (which we store only in a hashed, non-reversible form for abuse prevention), browser and device characteristics, and similar connection metadata.
• Payment data — when you purchase a plan, billing is handled by our third-party payment processor; we receive confirmation and limited transaction details but do not store full card numbers.

3. How We Use Information

We use information to:

• Provide the Service — perform scans, return results, and maintain your account and scan allowances.
• Verify identity and secure accounts — confirm ownership of your email address at sign-up and detect and prevent fraud and abuse.
• Improve accuracy and reliability — analyze aggregated patterns to reduce false positives and false negatives and to develop new detection capabilities.
• Communicate with you — send verification codes, service and security notices, and, where applicable, transactional messages about your account.
• Comply with law — meet legal obligations and enforce our Terms.

4. Legal Bases for Processing

Where the GDPR or similar laws apply, we process personal data on these legal bases: performance of our contract with you (to provide the Service you request); our legitimate interests (to secure, maintain, and improve the Service and prevent abuse), balanced against your rights; your consent (where we ask for it, such as certain communications); and compliance with legal obligations.

5. How We Share Information

We do not sell your personal information. We share information only as needed to run the Service:

• Service providers and processors — trusted vendors that provide hosting, AI analysis, threat-intelligence data, email delivery, and payment processing, acting on our instructions under contractual confidentiality and security obligations.
• Legal and safety — when required by law, legal process, or to protect the rights, safety, and security of our users, the public, or Spidanest.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this policy.

6. Content You Submit for Scanning

Content you submit is processed by our detection engine and trusted third-party AI providers solely to perform the analysis. The content you upload — including documents and images — is automatically deleted from our systems within 24 hours of the scan and is not retained beyond that window. We may keep a limited, non-identifying record of the analysis (such as a risk score, timestamp, and a one-way content fingerprint) to operate, secure, and improve the Service, but not the original content itself.

Please do not submit sensitive personal information, credentials, or regulated data that you are not authorized to share. You are responsible for the content you upload.

7. Cookies and Similar Technologies

We use strictly necessary cookies and similar technologies to keep you signed in, remember preferences, and secure the Service. We do not use them to build advertising profiles. You can control cookies through your browser settings, though disabling essential cookies may prevent parts of the Service from working.

8. Data Retention

We keep personal data only as long as necessary for the purposes described in this policy or as required by law. Content you submit through the scanner is automatically deleted within 24 hours and is never retained beyond that window. Account data is retained while your account is active. Limited, non-identifying scan metadata (such as a risk score and timestamp) may be retained to operate and improve the Service and may be aggregated or anonymized thereafter. Unverified sign-up records expire automatically shortly after they are created. When data is no longer needed, we delete or anonymize it.

9. Data Security

We apply administrative, technical, and organizational safeguards designed to protect personal data, including encryption in transit, hashing of passwords and IP addresses, access controls, and least-privilege practices. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

10. Your Privacy Rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you and request a copy.
• Correct inaccurate or incomplete data.
• Delete your data, subject to legal and legitimate-interest exceptions.
• Restrict or object to certain processing, and withdraw consent where processing is based on consent.
• Request portability of data you provided to us.
• Lodge a complaint with your local data-protection authority.

11. How to Exercise Your Rights

You can access and update much of your account information directly in your account settings. To make any other privacy request, contact us through the details on our About page. We will verify your identity before acting on a request and respond within the timeframe required by applicable law. You will not be discriminated against for exercising your rights.

12. International Data Transfers

We operate in the United States, and your information may be processed in the U.S. and other countries where we or our service providers operate. Where required, we use appropriate safeguards — such as standard contractual clauses — for transfers of personal data across borders.

13. Children’s Privacy

The Service is not directed to children under 18, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, please contact us and we will take steps to delete it.

14. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

15. Contact

For any questions or requests about this policy or your personal data, reach our team through the details provided on our About page.