Privacy Policy

The short version

• You do not need an account to run a free scan.
• We do not sell personal information or run advertising.
• This website contains no third-party trackers.
• When we scan a site, we store the host a request went to and a hash of its path — never the full URL, because query strings often carry personal data belonging to that site’s own visitors.
• We record the names of browser storage keys, never their contents.

What we collect

When you run a scan. The address you submitted, and the technical observations from visiting it: request hosts and hashed paths, cookie metadata (name, domain, lifetime, Secure, HttpOnly, SameSite), the names of browser storage keys, page screenshots, and timing.

When you hold an account. Your email address, your organisation and role, the domains you have verified, and your scan history.

When you pay us. Billing is handled entirely by Stripe. Card details never reach our systems. We keep a customer reference, plan and status so we know what you are entitled to.

Analytics. Aggregate, first-party counts only — how many people reached a page, how many scans ran. No cross-site tracking, no fingerprinting, no advertising pixels, no visitor profiles.

What we deliberately do not collect

• The contents of browser storage on scanned sites.
• Request payloads or POST bodies.
• Full URLs including query strings.
• Behavioural profiles of you or of the visitors to a scanned site.

How long we keep it

• Free scans: 30 days, then deleted automatically. They are not linked to a user account.
• Paid audits: 12 months, so you can compare against them.
• Monitoring history: for the length of your plan’s retention window.
• Account data: until you delete your account.

Who else processes data

• Vercel — website and application hosting.
• Supabase — database and authentication.
• Amazon Web Services — scan workers and evidence storage.
• Stripe — payments.

We do not share your data with anyone else, and we do not transfer it to advertisers or data brokers under any circumstances.

Security

Evidence files are stored privately and encrypted at rest; they are only reachable through short-lived signed links issued to an authenticated member of the owning organisation. Scan workers run in isolated, single-use containers with no access to our internal systems. Access to customer data is restricted at the database level per organisation.

Your choices

You can delete any scan, export your data, or delete your account and everything attached to it. Cancellation is a button in your billing settings — no phone call, no retention script. To make a request or ask a question, contact us through Saasquatch Labs support.

Scanning someone else’s website

A basic scan visits publicly reachable pages the way any browser would. Deeper crawls, scheduled monitoring and stored history require you to verify control of the domain first. We honour robots.txt crawl-delay and never run concurrent scans against the same site.

Changes

If we change this policy in a way that affects what we collect, we will say so on this page and update the date above.

Sasquatch Privacy is operated by Saasquatch Labs LLC.