Privacy Policy

darkweb-scanner (“darkweb-scanner,” “we,” “us”) provides automated dark-web and breach exposure scans and client-ready PDF reports — through our web application at darkweb-scanner.com. This policy explains what information we handle and how.

Account information: your name and email address, provided when you create an account (handled through our authentication provider).

Scan data: the domains you submit for scanning, your scan configuration, and the exposure results and reports we generate for you. These results are drawn from external and already-leaked data sources — we do not collect data from your own systems.

Payment information: when you purchase a scan, payments are processed by Stripe. We receive confirmation and billing metadata but never see or store your full card number.

Communications: messages you send us (e.g., support requests) and, if you request a sample report, the work email you provide.

Usage and device data: basic log and analytics data (such as IP address, browser type, and pages viewed) used to operate and secure the service.

To provide the service — run the domain scans you request, generate exposure reports, manage your account, and deliver results.

To process payments and prevent fraud.

To communicate with you about your account, scans, and support requests, and — where permitted — relevant product updates.

To maintain, secure, and improve the service.

To comply with legal obligations.

We do not sell your personal information. We share it only with service providers who help us run darkweb-scanner, under contract and only as needed:

• Google Firebase — authentication and data storage.

• Stripe — payment processing.

• Resend — transactional and report delivery email.

• Vercel — application hosting; and third-party intelligence sources (such as Hudson Rock Cavalier for infostealer logs, breach-data providers, and Shodan for attack-surface data) that we query to build your exposure report.

We may also disclose information if required by law, to protect our rights or users, or in connection with a business transfer.

You may only scan domains you own or are explicitly authorized to assess. You are responsible for having that authorization. We query only external, already-leaked data and never access your systems. Scan results are treated as your confidential data and are only used to provide the service to you.

We keep your account information and scan results for as long as your account is active or as needed to provide the service. You can request deletion of your data at any time (see Your rights). Some records may be retained where required for legal, tax, or security purposes.

We use industry-standard measures — encryption in transit, access controls, and reputable infrastructure providers — to protect your information. No method of transmission or storage is completely secure, but we work to protect your data and respond promptly to any issues.

Depending on your location, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise any of these, email us at support@darkweb-scanner.com and we’ll respond within a reasonable timeframe.

We use essential cookies to keep you signed in and operate the app, and limited analytics to understand usage. You can control cookies through your browser settings; disabling essential cookies may affect functionality.

darkweb-scanner is operated from the United States; by using it you consent to processing there. The service is intended for businesses and is not directed to anyone under 18, and we do not knowingly collect information from children.

We may update this policy from time to time. Material changes will be reflected by updating the effective date above, and where appropriate we’ll notify you.

Questions about this policy or your data? Email support@darkweb-scanner.com.