Privacy Policy

1. Who we are

Profscann ("we", "us") provides website security and SEO scanning at profscann.com. For data protection purposes we are the data controller for the personal data described here.

2. What we collect, and why

If you create an account

When you run a scan

Technical data, automatically

If you use the defence features

The Sentinel and Tripwire features record the IP addresses of third parties — the people probing your site. You are responsible for handling those records lawfully in your own jurisdiction. In most cases recording them is justified by your legitimate interest in the security of your own systems.

3. Who we share data with

We do not sell your personal data. We share it only with the service providers below, each of which processes it on our behalf for a specific purpose.

We may change providers — particularly the AI provider, as that market moves quickly. Where we do, we will update the table above so the named provider is always the one actually in use. If a change materially affects how your data is handled, we will tell registered users by email.

Some of these providers are outside Ghana, the UK and the EEA. Where personal data is transferred internationally we rely on the provider's own transfer safeguards, typically Standard Contractual Clauses.

We may also disclose data where we are legally required to, or where it is necessary to investigate a breach of our Acceptable Use Policy — including reporting apparent attacks to the affected site owner or to law enforcement.

4. Source code you upload

The code audit feature accepts an archive of your source code. This deserves its own section because it is the most sensitive thing you can give us.

• The archive is extracted, scanned, and then deleted. Deletion runs in a finally block, so it happens even if the audit crashes partway through.
• We keep only the findings — file paths, line numbers, and issue descriptions. Not the code itself.
• Your source code is never sent to our AI provider, or to any other third party.
• Archives are checked for zip-slip and zip-bomb attacks before extraction.

That said: if your code contains hardcoded credentials, they will pass through our server in the course of the audit. That is unavoidable for a tool whose job is to find them. Treat any secret found by the audit as needing rotation regardless — which is what the report will tell you.

5. How long we keep things

6. Cookies and tracking

Cookies we need

• profscann-session — keeps you signed in and holds your session. Essential.
• XSRF-TOKEN — protects you from cross-site request forgery. Essential. It is readable by JavaScript by design; that is how the protection works.

Advertising

We run the Meta Pixel, which sets Meta's own cookies and tells Meta that you visited. We use it to measure advertising and to reach people who might find Profscann useful.

This is genuine third-party tracking and we are not going to describe it as anything else. If you would rather not be tracked, you can:

• use your browser's tracking protection or an ad blocker — both stop the pixel loading;
• adjust your ad preferences in your Meta account settings;
• enable "Do Not Track" or "Global Privacy Control" in your browser.

7. Your rights

You can exercise most of these yourself, immediately, from Account security — no request, no waiting:

• Access / portability — "Download everything we hold" exports your data as JSON.
• Erasure — "Delete my account" removes your account and everything attached to it. It is immediate and irreversible.
• Rectification — edit your name and email on your profile.

For anything else — objecting to processing, restricting it, or withdrawing consent — email support@profscann.com.

Depending on where you live you may have the right to complain to a supervisory authority: the Data Protection Commission in Ghana, the Information Commissioner's Office in the UK, or your national authority in the EEA. We would appreciate the chance to put things right first, but you do not have to come to us before going to them.

8. Security

Passwords are hashed with bcrypt. Traffic is served over HTTPS with HSTS. Session and CSRF cookies carry the Secure, HttpOnly (where appropriate) and SameSite attributes. Server agent tokens are stored hashed and shown once. We never store your server credentials, and the agent is one-way — Profscann cannot send commands to your machine.

No system is completely secure, and we are not going to claim otherwise on a page about a security product. If you find a vulnerability in Profscann, please tell us — see our Security & Disclosure page.

9. Children

Profscann is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us personal data, email us and we will delete it.

10. Changes

If we make a material change we will update the date at the top of this page and, where the change significantly affects you, email registered users. Continuing to use Profscann after a change means you accept it.