AntiBaitby FluenceSecurity

Legal

Privacy policy

Your privacy is important to us. This policy explains how we collect, use, and protect your information.

Last updated: October 21, 2026 · We'll notify you of any significant changes to this policy

Information we collect

We collect minimal information necessary to provide our phishing detection services:

  • Email metadata. Headers, sender information, timestamps, and routing data for threat analysis
  • Account information. Email address, name, and billing details for registered users
  • Usage analytics. Service performance metrics, feature usage, and system logs
  • Technical data. IP addresses, browser information, and device identifiers for security
  • API usage. Request logs, authentication tokens, and rate limiting data
  • Scans without an account. To enforce daily limits and stop abuse, we derive keys from your IP address: the address is reduced to its network block (IPv4 /32 and /24, IPv6 /64 and /48) and stored only as a keyed hash (HMAC), never as the address itself. Cloudflare Turnstile checks that the request comes from a browser; to verify it, we send Cloudflare the Turnstile token and your IP address.

We do not store the emails you scan. The one exception is an email you choose to attach to a feedback report; see Data retention and storage below.

How we use your information

Your information is used exclusively for legitimate business purposes:

  • Threat detection. Analyzing email patterns to identify phishing and malicious content
  • Service improvement. Enhancing our AI models and detection algorithms
  • Account management. Providing access to your dashboard, API keys, and billing
  • Security monitoring. Detecting fraud, abuse, and unauthorized access attempts
  • Legal compliance. Meeting regulatory requirements and responding to valid legal requests
  • Communication. Sending security alerts, service updates, and billing notifications

We never sell, rent, or share your personal information with third parties for marketing purposes.

Data retention and storage

We implement strict data retention policies to protect your privacy:

  • Email content. Not stored. An email you scan is analyzed in memory and discarded once the verdict is returned. The exception is an email you choose to attach to a feedback report: it is kept until our team has reviewed the report, then deleted.
  • Analysis history. Signed-in analyses keep the sender, recipient, subject and verdict (including the model's explanation, which can quote the email) in your history until you delete your account. Scans without an account create no history.
  • Account data. Stored while your account is active, deleted within 30 days of account closure
  • Usage logs. Aggregated and anonymized after 90 days, retained for 2 years for security analysis
  • Billing records. Kept for 7 years as required by financial regulations
  • Cached verdicts. A verdict is cached for 7 days, so scanning the same email again returns it without a new analysis. For scans without an account the entry is encrypted with a key derived from the email itself: only someone holding the same email can read it, and it records nothing about who scanned it.
  • Limits and lockouts. For scans without an account, the hashed network keys hold daily scan counters (deleted after about two days), short burst counters (minutes) and, after abuse, lockouts of 15 minutes to 24 hours that expire on their own within a few days.
  • Pro trial record. When you start the 7-day Pro trial we keep a keyed hash (HMAC) of your normalized email address (lowercased, without a +tag, and for Gmail without dots) and the day of the trial, so the same address cannot start another trial. It is not linked to your account and stays after you delete the account; it is deleted three years after the trial. The data export shows whether it exists for your address.
  • Sender history (Pro). To show what your own history says about a sender, Pro and higher plans keep one entry per sender address: a one-way hash of the address, of the display name and of where replies went, the sender's domain as it is, message counts and the first and last date seen. It is seeded once from your analysis history, a sender unseen for 13 months is forgotten, and you can clear it or switch it off (which deletes it) in your privacy settings. It is included in your data export and deleted with your account.

All data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption. Our servers are located in secure, SOC 2 compliant data centers.

Data sharing and third parties

We share information only when necessary and with strict limitations:

  • Service providers. Cloudflare hosts the service, stores its data, runs Turnstile and runs the AI analysis (Workers AI); when we route analysis to OpenAI instead, OpenAI receives it. Either way, the content of the email you scan is sent to the AI provider for analysis. To check links, we may open URLs found in the email and look up its domains' registration records. Stripe processes payments.
  • Threat intelligence. Anonymized threat indicators shared with security research community
  • Legal requirements. When required by law, court order, or to protect rights and safety
  • Business transfers. In case of merger, acquisition, or sale (with privacy protections)

All third-party partners sign data processing agreements and are required to maintain the same privacy standards.

Security measures

We implement comprehensive security measures to protect your information:

  • Encryption. AES-256 for data at rest, TLS 1.3 for data in transit
  • Access controls. Role-based access, multi-factor authentication, and zero-trust architecture
  • Monitoring. 24/7 security monitoring, intrusion detection, and automated threat response
  • Auditing. Regular security audits, penetration testing, and compliance assessments
  • Incident response. Documented procedures for security breaches with notification within 72 hours

Our security team includes certified professionals (CISSP, CISM) and we maintain SOC 2 Type II compliance.

Your data protection rights

We respect your privacy and provide you with full control over your personal information.

  • Right to access. Request a copy of all personal data we hold about you
  • Right to rectification. Correct any inaccurate or incomplete information
  • Right to erasure. Request deletion of your personal data (right to be forgotten)
  • Right to portability. Export your data in a machine-readable format
  • Right to object. Opt-out of certain data processing activities
  • Right to restrict. Limit how we process your personal information

Privacy questions?

Contact our Data Protection Officer for privacy-related inquiries and requests.

Quick actions

Regulatory compliance

  • GDPR. EU data protection
  • CCPA. California privacy rights
  • SOC 2. Security compliance ready
Contact privacy teamPrivacy settings

Related documents