Privacy Policy
Effective date: August 11, 2026 · Last updated: August 28, 2026
1. Who we are
StackSecured (“StackSecured,” “we,” “us,” or “our”) is a security scanning service operated by Bullwiser Analytics Pvt Ltd (CIN: U62099MR2026PTC476963), a company registered at 51, Ramayan Nagar, Bhusawal 425201, Maharashtra, India, that audits web applications for vulnerabilities. Our service is available globally. Our primary contact email is contact@stacksecured.com.
2. What data we collect
Data you provide
- Email address — only if you create an account or purchase a report
- App URLs — the URL you submit for scanning
- Payment data — processed by our payment provider; we never see your card number
Data collected automatically
- IP address — for abuse prevention and rate limiting
- Scan results — the vulnerability findings for your submitted URL, stored in our database
- Browser & device info — standard web analytics (page views, browser type)
Data we do NOT collect
- Passwords or credentials for the apps you scan
- Source code — we only scan publicly accessible endpoints
- Data from inside your database or private files
3. How we use your data
- To run the security scan you requested and display results
- To store your scan history if you have an account
- To process payments for unlocked reports
- To send transactional emails (scan complete, report ready) — never marketing without consent
- To detect and prevent abuse of the scanning service
- To improve the accuracy and coverage of our scanners
- To publish aggregate, anonymized research — for example, “X% of scanned apps had an exposed API key.” We only ever publish statistics computed across many scans combined. We do not publish, and will never publish, an individual scan result, finding, or score tied to a specific site, URL, or user without that user's separate, explicit consent.
4. Who we share your data with
We do not sell your data. We share only what is necessary to operate the service:
| Provider | Purpose | Data shared |
|---|---|---|
| Supabase | Database & authentication | Email, scan results, account data |
| Vercel | Hosting & serverless functions | IP address, request logs |
| Resend | Transactional email | Email address, scan ID |
| Cashfree | Payment processing (India) | Email, phone, order amount — no card details stored by us |
| Lemon Squeezy | Payment processing (international) | Email, order amount — no card details stored by us |
5. Data retention
- Scan results — retained for 90 days, then permanently deleted
- Account data — retained while your account is active; deleted within 30 days of account closure
- Payment records — retained for 7 years as required by financial regulations
- Logs — retained for 30 days for abuse prevention
6. Cookies & analytics
We use session cookies to keep you logged in, and essential cookies for security (CSRF protection). We do not use tracking cookies or third-party advertising cookies, and we do not share browsing data with any ad network.
We run first-party, in-house pageview tracking (added August 2026) to understand traffic to stacksecured.com — no third-party analytics provider is involved. It records the page viewed, referring site, campaign parameters (if you arrived via a tagged link), your country (derived from IP address, which is not itself stored with this data), and a randomly generated identifier stored in your browser's local storage so we can distinguish repeat visits from new ones. This data is aggregated for traffic reporting and is not linked to your account, email, or scan history.
7. Your rights
Depending on where you are located, you may have the following rights:
- Access — request a copy of the personal data we hold about you
- Correction — request we fix inaccurate data
- Deletion — request we delete your personal data (“right to be forgotten”)
- Opt-out of sale — we do not sell data, so this right is automatically satisfied
- Portability — request your data in a machine-readable format
To exercise any right, email us at contact@stacksecured.com with “Privacy Request” in the subject line. We respond within 30 days.
8. Security of your data
We use industry-standard protections: HTTPS everywhere, encrypted database connections, row-level security on our database (Supabase RLS), and environment variable separation for secrets. No system is perfectly secure, and we cannot guarantee absolute security — but we take it seriously, which is why we built this product in the first place.
9. Children's privacy
StackSecured is not directed at children under 13. We do not knowingly collect personal data from anyone under 13. If you believe a child has submitted data to us, contact us and we will delete it immediately.
10. Changes to this policy
We may update this policy as the product evolves. If we make material changes, we will update the “Last updated” date at the top and, if you have an account, notify you by email. Continued use of the service after changes constitutes acceptance.
11. Contact
Questions about this policy? Email contact@stacksecured.com with “Privacy Policy” in the subject line.