1. Who we are

ScamBlock AI ("we") operates the website and the monitoring service. Contact: hello@scamblockai.com.

2. What we collect

• Account data: name, email, password hash, organisation name, role, sign-in times and IP address hashes for security.
• Brand data: brand names, spellings, official domains, social profile links, keywords and allow-lists you enter.
• Findings and evidence: public DNS records, certificate log entries, HTTP responses, page titles, text excerpts and hashes of pages on suspected lookalike hosts, and URLs you submit. These describe third-party public web content, not your customers.
• Lead and contact data: what you enter in our forms, with your consent, plus a hashed IP address and browser identifier for abuse prevention.
• Operational logs: audit logs of actions in your workspace and technical logs needed to run the service.

3. Why we use it

To provide the service you asked for, to secure accounts and prevent abuse, to respond to your requests, and, with consent, to tell you about results and related offers. We do not sell personal data and we do not use it to train third-party AI models.

4. Where it is stored and who processes it

Data is stored in a managed Postgres database and served from a cloud hosting provider. Transactional email, when enabled, is sent through a transactional email provider. These processors act on our instructions. Data may be processed outside Bangladesh; we choose providers with recognised security practices.

5. Retention

Account and brand data: for the life of the account and 30 days after deletion. Findings and evidence: for the life of the account, or as needed for an open case. Free exposure check results: 30 days. Leads: 24 months after last contact. Audit logs: 12 months. Backups are rotated within 35 days.

6. Your rights

You can access, correct, export or delete your data by emailing hello@scamblockai.com from your account email. Workspace owners can request deletion of their organisation and all its data from the owner's address; we verify identity before acting and complete deletion within 30 days. You can withdraw marketing consent at any time.

7. Cookies

We use strictly necessary session cookies for sign-in and security. We do not use advertising cookies.

8. Changes

We will post changes here and, for material changes, notify workspace owners by email or in-app notice.