Privacy Policy

This policy explains what personal data ScanMalware collects, why, who receives it, how long we keep it and what rights you have. It applies to scanmalware.com, its API, the MCP server at mcp.scanmalware.com and the sign-in service at auth.scanmalware.com. It follows the EU General Data Protection Regulation (GDPR) and Swedish law.

1. Who is responsible for your data

The data controller is Triop AB (org. no. 556768-7321), Rörosvägen 31, 846 72 Funäsdalen, Sweden. Email privacy@scanmalware.com for anything in this policy, including requests under section 8. We have not appointed a data protection officer, because the law does not require one for our processing.

2. What we collect, why, and on what legal basis

The legal basis is shown for each kind of data. "Legitimate interest" (GDPR article 6(1)(f)) means we have weighed our interest against your privacy and found that it does not override it. You can ask for that assessment, and you can object (section 8). "Contract" (article 6(1)(b)) means we need the data to provide something you asked for.

2.1 Visiting the website

Every request reaches us through Cloudflare, which protects the site against attacks. Our web servers log the IP address, the time, the page or API address requested (which shows what you looked up), the browser's user agent and the referring page. We use the logs to keep the service secure, apply rate limits, stop abuse and fix problems. Legal basis: legitimate interest in running a secure service. When you visit, the page checks with our sign-in service whether you are signed in, which sets the sign-in cookies listed in section 7.

2.2 Lookups, the API and the MCP server

What you look up on the website or through the API, such as a domain, URL, IP address or search query, is part of the request and is logged as described in section 2.1. In addition:

• Usage statistics: we count how often each domain is looked up per day, without IP addresses. The public statistics page shows only totals per registered domain (such as example.com), never individual hostnames and never who asked. Lookups made with theHarvester or BBOT are not counted. Requests made with an API key are also counted per key and day.
• Choosing what to scan: hostnames that appear in lookups go into an internal list, without IP addresses, that helps us decide what our own scanner analyses next. Scans we start this way are unlisted, never public. Lookups made with theHarvester or BBOT are left out.
• Failed requests: when the API answers with an error, we record the IP address and user agent with it for 7 days, to find faults and abuse.
• MCP server (used by AI assistants): each request is logged with the tool used, its arguments (long values shortened), the IP address, the user agent and the client name. This log is rotated by size, which at current volume keeps about ten months of requests. The server's other logs hold complete requests and results for about two weeks.

Legal basis: legitimate interest in running, securing and improving the service. Apart from the totals on the statistics page, we do not publish what you look up.

2.3 Submitting a URL for a scan

When you submit a URL, we store it with the visibility you chose, the time, your IP address and user agent, and your account if you are signed in or use an API key. Our browser then visits the URL and stores what it finds: screenshots, the page's content and code, the network traffic, files the page downloads, and our analysis. We never show who submitted a scan.

• Public (the default): anyone can see the scan, it appears in listings, search and the API, and it is posted to our accounts on X and Mastodon with the site's name, the AI verdict and a link.
• Unlisted: anyone with the link can open it, but it is not listed or posted.
• Private: only you can see it. This requires an account.

A public or unlisted scan shows the URL exactly as you entered it, so do not submit a URL that contains your own or someone else's personal data, a password or an access token unless you choose private. Legal basis: legitimate interest in analysing websites for threats and sharing the results to protect internet users; for private scans, contract. We use your IP address and user agent to prevent abuse and to tell our own automated scans apart from scans by others.

2.4 Votes and reports on scans

When you vote on a scan or report it, we store your vote or report, any text you add, your IP address, your user agent, your network (AS number) and a random identifier that your browser keeps (section 7), so that each browser can vote once. Votes are shown only as totals. The number of independent reports on a site may be given to the AI that writes the verdict; your text and identity are not. Legal basis: legitimate interest in improving our verdicts and preventing manipulation of the votes.

2.5 Your account

An account is optional. The sign-up page may ask your browser to pass a Cloudflare security check, which sets the cf_clearance cookie (section 7). An account holds your email address (also your user name), your name if you enter one, your password in hashed form, and any two-factor devices, recovery codes and passkeys you set up. If you sign in with a Google, Microsoft or GitHub account, we receive your email address and name from that service (from a Microsoft work or school account without an email address, its sign-in name instead), and from GitHub also your user name. We do not keep the access tokens these services issue. Their own privacy policies apply to what they do. With an account you can create API keys (we store only a hash of each key, the time and IP address it was last used, and a log of key events) and follow hunts (we store which hunts you follow and the address alerts go to). Legal basis: contract.

When you set or change a password, we check it against a list of common passwords on our own server, and we send the first 5 characters of the password's SHA-1 hash to a breach-check service, which answers with the hashes of leaked passwords that start the same way. Your password and its full hash never leave our server. Legal basis: legitimate interest in protecting accounts.

We record security events on your account: each sign-in and failed sign-in attempt, sign-outs and renewals of a signed-in session, password resets and requests for them, changes to your password, two-factor devices, passkeys, email address or linked Google, Microsoft or GitHub accounts, lock-outs after repeated failed attempts, and the creation of the account. Each record holds the time, the IP address, the approximate location derived from it (the country, the network and a rough position), the app used, the sign-in method and any error, but never the email address or user name that was typed. We keep these records for 180 days and use them for the sign-in history on your account page, for security emails such as a notice when your account is signed in to from a new place, and to spot misuse of your account. A password-reset request for an address that has no account is recorded the same way, without an account. Our sign-in service also keeps its own log of these events, with IP addresses, for 30 days. Legal basis: legitimate interest in protecting your account and our service.

2.6 Emails we send

If you have an account, we email the address you confirmed when you signed up:

• Security notices when your account is signed in to from a new place or someone repeatedly fails to sign in to it, when an API key is created, rotated or about to expire, or when a sign-in method changes. These are about the safety of your account, so they have no unsubscribe link.
• Three getting-started emails in the first month after you sign up. Each one has a one-click unsubscribe link.
• Hunt alerts, only for threat hunts you choose to follow. Each alert has links to stop them.

Our emails contain no tracking pixels or tracked links. We send them through an email delivery provider in the EU. Replies go to contact@scanmalware.com. Legal basis: contract for security notices and hunt alerts; legitimate interest for the getting-started emails, which you can stop at any time.

2.7 Contacting us

When you use the contact form, we store your name, email address, subject and message, with your IP address and user agent to stop spam. The message is forwarded to our mailbox through the same email provider. Legal basis: legitimate interest in answering you.

2.8 Analytics

We measure how the website is used with Matomo, which we run on our own servers. It uses no cookies and stores nothing on your device. It records the pages you view (with search terms and query strings removed), clicks, the tabs you open on result pages, browser errors, your browser and device type and an approximate location. Your IP address is shortened before it is stored, so it no longer points to you. If your browser sends a Do Not Track signal, nothing is recorded. Cloudflare's Web Analytics also measures how fast our pages load: a script without cookies that sends Cloudflare the page address, the referring page, your browser type and timing data. Legal basis: legitimate interest in understanding how the site is used and how it performs, so we can improve it.

3. People who appear in scanned pages

The pages we scan are written by others, and they and their URLs can contain personal data: a name or photo on a page, or the email address of a person a phishing link was sent to. We collect this data from publicly reachable websites and from URLs submitted to us or listed in threat-intelligence feeds. We keep it as part of the scan, and public scans show it, because a faithful record of what a malicious page did is what lets people recognise and block it. Legal basis: legitimate interest in protecting internet users against fraud and malware. If you appear in a scan and want it removed or hidden, write to privacy@scanmalware.com with the link; we decide case by case and tell you the result.

4. Who receives data

We do not sell personal data or share it for advertising. Most of the recipients below are processors: they work only on our instructions, under a data processing agreement. The lookup services, the social networks and the sign-in providers handle what they receive under their own responsibility. We describe the companies by what they do and where; email privacy@scanmalware.com and we will tell you which companies they are.

The websites we scan receive a normal visit from our servers; they do not learn who submitted the scan. We may also disclose data when the law requires it, for example to the police or a court, or when it is necessary to establish or defend a legal claim.

5. Transfers outside the EU and EEA

• United States (our network and security provider, the backup AI service, the lookup services, the email provider's parent company and the sign-in providers): these transfers rely on the EU–US Data Privacy Framework where the company is certified, and otherwise on the EU standard contractual clauses in the provider's data processing agreement.
• China (the AI service that writes the AI verdict): China has no EU adequacy decision, and the provider does not offer the EU standard contractual clauses for this service, so this transfer has no such safeguard. Chinese law can give authorities access to data held there. We send it only the content of scanned pages and their URLs, never data about the person who submitted the scan; a URL can still contain personal data (section 3).
• Other countries: X and Mastodon receive data that is public.

6. How long we keep data

7. Cookies and browser storage

We use only cookies and browser storage that are needed for security, for signing in or for something you chose, so we do not ask for consent (Swedish Electronic Communications Act, chapter 9, section 28). We use no advertising or tracking cookies, and our analytics use none.

8. Your rights

Under the GDPR you have the right to:

• get a copy of the personal data we hold about you (access);
• have incorrect data corrected; you can change your account details yourself on your account page;
• have data deleted, for example a scan you submitted or your account (you can delete your account yourself on your account page);
• have our use of your data restricted while a question about it is being settled;
• receive data you gave us in a machine-readable format (portability);
• object to processing based on legitimate interest; we then stop unless we have compelling reasons;
• stop the getting-started emails at any time, with the link in each one.

Email privacy@scanmalware.com. We answer within one month and may ask you to confirm your identity first. It is free of charge. Some data cannot be linked to you, such as shortened IP addresses in our analytics or a scan submitted without an account, unless you give us details that identify it, such as the scan link.

If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, imy@imy.se, imy.se, or to the supervisory authority where you live or work. We would appreciate the chance to resolve it with you first.

9. Automated decisions

Our verdicts are automated assessments of websites, not of people. We make no decisions about you based solely on automated processing that have legal or similarly significant effects. Rate limits and abuse protection apply automatically; a person decides on suspending an account.

10. Security

We protect data with encrypted connections, access control, hashed passwords and API keys, two-factor authentication and passkeys for accounts, isolated scanning containers and firewalls. If a personal data breach is likely to put you at high risk, we will tell you without undue delay.

11. Children

The service is not directed at children. You must be at least 13 years old to create an account, and we do not knowingly collect data from younger children.

12. Changes to this policy

We update this policy when our processing changes. The date at the top shows the latest version. We will tell account holders about significant changes by email before they take effect.

13. Contact

Triop AB (org. no. 556768-7321)
Rörosvägen 31
846 72 Funäsdalen, Sweden
privacy@scanmalware.com · contact form · triop.se