Privacy Policy

The short version

• You do not need an account to run a free scan.
• We do not sell personal information or run advertising.
• This website contains no third-party trackers.
• When we scan a site, we store the host a request went to and a hash of its path — never the full URL, because query strings often carry personal data belonging to that site’s own visitors.
• We record the names of browser storage keys, never their contents.

Who we are

Sasquatch Privacy is operated by SaaSquatch Lab LLC, Pacific Northwest, United States. For the personal data described here — your account, your payments, your messages to us — we are the controller. Privacy questions and requests go to privacyinfo@saasquatchlab.com.

What we collect

When you run a scan. The address you submitted, and the technical observations from visiting it: request hosts and hashed paths, cookie metadata (name, domain, lifetime, Secure, HttpOnly, SameSite), the names of browser storage keys, page screenshots, and timing.

When you hold an account. Your email address, your organisation and role, the domains you have verified, and your scan history.

When you pay us. Billing is handled entirely by Stripe. Card details never reach our systems. We keep a customer reference, plan and status so we know what you are entitled to.

When you contact us about a larger plan. The contact form collects your name, work email, company, website, and message, kept for 12 months and used only to reply to you.

Analytics. Aggregate, first-party counts only — how many people reached a page, how many scans ran. No cross-site tracking, no fingerprinting, no advertising pixels, no visitor profiles.

What we deliberately do not collect

• The contents of browser storage on scanned sites.
• Request payloads or POST bodies.
• Full URLs including query strings.
• Behavioural profiles of you or of the visitors to a scanned site.

Why we use it, and on what basis

If you are in the EU, the UK or elsewhere with similar law, these are the legal bases we rely on:

• To provide what you asked for — running scans and audits, your account, subscriptions and billing: performance of our contract with you.
• Free scans, replying to contact requests, keeping the service secure, preventing abuse and counting usage in aggregate: our legitimate interests in running a useful, safe service. These uses are narrow and do not profile you.
• Keeping payment and tax records: legal obligation.

We do not rely on consent for anything, because we set no cookies or trackers that would need it.

Data about other websites

A scan records what a website did, not who visits it. The observations are technical — hosts, hashed paths, cookie and storage-key names. Screenshots show a page as a first-time visitor sees it, so they can include anything the site itself publishes on that page. We use this data only to produce your report.

How long we keep it

• Free scans: 30 days, then deleted automatically. They are not linked to a user account.
• Paid audits: 12 months, so you can compare against them.
• Monitoring history: for the length of your plan’s retention window.
• Account data: until you delete your account.
• Contact requests: 12 months.
• Payment records: kept by Stripe, and by us only as long as tax and accounting law requires.

Who else processes data

• Vercel — website and application hosting.
• Supabase — database and authentication.
• Amazon Web Services — scan workers, evidence storage, and email delivery (SES).
• Stripe — payments.

Each acts on our instructions under a data processing agreement. We do not share your data with anyone else, and we do not sell it or pass it to advertisers or data brokers under any circumstances.

Where it is stored, and international transfers

We are a United States company and store data in the United States. Scans you run from the EU or UK regions execute in AWS Frankfurt or London so the site sees a local visitor, and their results are then stored in the United States. When personal data moves from the EU, the UK or Switzerland to the United States, we rely on the Standard Contractual Clauses (with the UK Addendum) in our providers’ data processing agreements, and on the EU–US Data Privacy Framework where a provider is certified under it.

Cookies

• sb-* — Supabase session cookies, set only once you sign in, so we can keep you signed in between requests.
• sp_ref — set only if you arrive via a referral link, so we can credit the affiliate who sent you if you buy an audit. httpOnly (client-side scripts cannot read or change it) and expires after 90 days.

We set no analytics or advertising cookies.

Security

Evidence files are stored privately and encrypted at rest; they are never at a public address, and are served only through the link for the scan that produced them, which carries a secret token. Scan workers run in isolated, single-use containers with no access to our internal systems. Access to customer data is restricted at the database level per organisation.

Your rights

Wherever you are, you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct anything that is wrong;
• delete it, including any scan and your whole account;
• export it in a portable format;
• stop or restrict a use you object to.

Email privacyinfo@saasquatchlab.com. We may ask you to confirm the request from your account email, and we answer within 30 days. There is no charge, and exercising a right never changes the service or price you get.

EU and UK residents can also complain to their data protection authority — in the UK, the Information Commissioner’s Office. We would rather hear from you first.

California and other US state residents: we do not sell or share personal information as those laws define it, do not use it for targeted advertising or profiling, and collect no sensitive personal information. You can use an authorised agent to make a request.

Cancellation is a button in your billing settings — no phone call, no retention script.

Scanning someone else’s website

A free scan visits a handful of publicly reachable pages the way any browser would. A paid audit crawls more deeply; by ordering one you confirm you own the site or are authorised to have it tested. Scheduled monitoring requires you to verify control of the domain first. We honour robots.txt and never run concurrent scans against the same site.

Children

Sasquatch Privacy is a business tool. It is not directed at children, and we do not knowingly collect personal data from anyone under 16.

Changes

If we change this policy in a way that affects what we collect or how we use it, we will update this page and the date above, and email account holders before a material change takes effect.