Privacy Policy

1. Who we are

Puremedia operates ScamSec ("we", "us"). We are responsible for the personal information described in this policy. Contact our privacy team at support@scamsec.com.

2. What we collect

Your account

Your name, email address and password (stored only as a secure hash), and if you turn them on, your two-factor authentication and passkey details. We also record your plan and usage, such as how many emails you've checked this month.

Emails you forward to us

When you forward an email, we receive its sender and recipient addresses, subject, technical headers, message body (text and HTML) and any attachments. This can include other people's personal information, and anything sensitive the message contains. We only want it so we can check whether it's a scam.

Our analysis

The result of each check: the verdict, risk level and score, the reasons and short supporting excerpts, and the summary we send you.

Payments

Payments are handled by Stripe. We keep your subscription status and billing details such as your plan and invoice history, but not your full card number.

Technical information

Standard server and security logs, such as IP address, browser type and the pages you request, and cookies needed to keep you signed in. We do not run advertising trackers.

3. Why we use it

• to analyse the emails you send and reply with our assessment;
• to run your account, take payment and enforce plan limits;
• to keep the service secure, prevent abuse and fix problems;
• to contact you about your account, billing and important service changes; and
• to meet our legal obligations.

We do not sell your personal information, and we do not use the content of your emails for advertising or marketing.

4. How long we keep your emails

We keep the content of an email only as long as it's useful for the check, plus a short safety margin for retries and support questions.

• Body, headers and attachments are permanently deleted 7 days after we receive the email. Attachments are deleted from our storage at the same time.
• The sender, subject and our analysis result are kept so that you can see your history in your dashboard, until you delete your account or ask us to remove them. The analysis includes brief excerpts from the email that explain our reasoning.
• Backups of our systems may hold deleted content for a short additional period before they are overwritten.

You can ask us to delete a specific email, or all your data, earlier by writing to support@scamsec.com.

Account details are kept while your account is open. After you close it we delete or de-identify them, except for what the law requires us to hold, such as tax and billing records (generally seven years in Australia).

5. Who we share it with

We share information only with the providers that help us run the service, and only what they need:

• Email delivery and receiving provider (Emailit): receives the emails you send to us and delivers our replies and account emails.
• AI model providers: the content of each email, including its text, sender details and links, is sent to an AI provider so it can be assessed. We use their business interfaces, which under their terms do not use this content to train their models, and we don't permit them to.
• Payment provider (Stripe): processes payments and calculates GST.
• Hosting, storage and infrastructure providers: run our servers, databases and file storage.
• Professional advisers and authorities: where needed to get legal or accounting advice, or where the law requires or authorises us to disclose information.
• A buyer or successor: if our business is sold or restructured, in which case this policy would continue to protect your information.

To check where links lead, our systems may also open web addresses found in an email. Those websites can see a request from our servers, but not your identity.

We never publish the emails you send us, and we won't use them to contact the people named in them. We will not reply to a sender whose address appears to have been forged.

6. Security

We use encryption in transit, access controls, hashed passwords and optional two-factor authentication and passkeys, and we restrict who on our team can see stored content. Suspicious emails are treated as untrusted: attachments are stored and scanned, never executed. No system is perfectly secure. If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires.

7. Your rights (Australia)

Under the Privacy Act 1988 and the Australian Privacy Principles you can:

• ask for access to the personal information we hold about you;
• ask us to correct information that is inaccurate, out of date or incomplete; and
• make a complaint about how we've handled your information.

Email support@scamsec.com and we'll respond within 30 days. If you're not satisfied with our response, you can complain to the OAIC at oaic.gov.au or 1300 363 992.

8. Customers outside Australia

Where your data goes

We're based in Australia, but our providers (for example email, AI, payment and hosting services) operate in other countries, including the United States and parts of Europe. When your information goes overseas, we take reasonable steps to make sure the recipient protects it consistently with the Australian Privacy Principles, and, where required, we use safeguards such as standard contractual clauses.

European Economic Area and United Kingdom

Where the GDPR or UK GDPR applies to you, we process your personal information on these legal grounds: to perform our contract with you (running your account and checking your emails), our legitimate interests (securing the service and preventing fraud), legal obligation (tax and billing records), and your consent where we ask for it. You also have the right to access, correct, erase, restrict or object to our use of your data, to receive a portable copy, and to withdraw consent at any time. You can lodge a complaint with your local data protection authority. To use these rights, email us at the address above.

New Zealand, California and elsewhere

If you live in New Zealand, the Privacy Act 2020 gives you similar rights to access and correct your information, and you can complain to the Office of the Privacy Commissioner. If you live in California, you can ask what we've collected, ask us to delete it, and be free from discrimination for doing so. We do not sell or share personal information for advertising. Residents of other places can contact us about the rights they have under local law.

Information about other people

The emails you forward often contain other people's personal information. By forwarding them, you confirm you are entitled to share them with us for the purpose of checking for scams. If you use a business plan for your team, you're responsible for letting your team members know how their forwarded emails are handled.

9. Cookies

We use only the cookies needed to keep you signed in and to protect forms against forgery. We don't use advertising or cross-site tracking cookies.

10. Children

ScamSec is not directed at children under 13, and we don't knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the service changes. We'll post the new version here with an updated date and, for significant changes, tell you by email or in the app.

12. Contact us

Questions, requests or complaints: support@scamsec.com, Puremedia, Australia.