1. Introduction
ADAGuard is committed to protecting your privacy. This policy explains how we collect, use, and protect your data.
2. Data we collect
You provide: Email, name, password (bcrypt-hashed), scan URLs, authentication session data (Fernet-encrypted), payment info (via Dodo Payments — we never see your full card number).
Automatically collected: IP address, browser type, device info, usage data, cookies.
Scans and sign-ups: for each scan you run and when you create an account, we record the approximate location it came from — country, region and city — worked out from your IP address, and a one-way hash of that address so repeat visits can be counted. We don’t store the IP address itself with these records. They’re kept for up to a year and deleted with your account. Location data: IP Geolocation by DB-IP (CC BY 4.0).
Site activity: to see which pages and features people use, our own server records the pages you visit and the steps you take on adaguard.io — for example starting a scan, choosing a plan or opening checkout — with the site you came from and any campaign tags in the link, and the same approximate location and IP hash as above. It sets no cookie, stores nothing on your device and records nothing you type. It’s kept for up to a year and deleted with your account. Google Analytics, which does set cookies, runs only if you choose “Accept all” in the cookie banner.
Third parties: Dodo Payments (payment processing), Resend (transactional email).
3. How we use your data
Service: Run scans, store results, authenticate to websites, process payments.
Improvement: Analyze usage, fix bugs, develop features.
Security: Prevent fraud, enforce Terms, comply with laws.
4. Data sharing
We do not sell your data.
Service providers: see the full, canonical list of sub-processors and what each one handles in our GDPR page. All providers are contractually bound to GDPR-compliant data handling.
5. Data security
Security: HTTPS/TLS in transit, encryption at rest, Fernet encryption for authentication sessions, bcrypt password hashing, firewall and DDoS protection.
Scan data retention by plan: Free (7 days), Starter (30 days), Professional (90 days), Business (1 year), Enterprise (5 years). Payment records: 7 years (legal requirement).
What retention deletes: at the end of your plan’s retention period we delete each scan’s detailed findings — the individual issues, the affected elements, and the per-page results. A short summary of the scan (its date, URL, score, and issue counts) is kept so your score history and trend charts stay available. Scans run without an account are deleted in full after 30 days. Deleting your account removes everything, including these summaries, immediately and permanently.
6. Your rights (GDPR/CCPA)
Access: Email privacy@adaguard.io or use Settings → Account → Export Data to download a full copy.
Delete: Settings → Account → Delete Account. This is immediate and permanent — there is no recovery period.
Export: Settings → Account → Export Data (ZIP archive of JSON files).
Correct: Settings → Profile → Edit your name, email, and company.
Object: Opt out of marketing emails via the unsubscribe link in any email we send.
We respond to rights requests within 30 days. For GDPR-specific requests see our GDPR page.
7. International transfers
Data may be transferred internationally to countries where our service providers operate. We use Standard Contractual Clauses (EU data) and encryption to safeguard transfers.
9. Third-party services
See the full list on our GDPR page. See their respective privacy policies. We’re not responsible for their practices.
10. Children’s privacy
Not for children under 13 (or 16 in EU). We delete children’s data immediately if discovered.
11. Data breaches
Notification within 72 hours (GDPR requirement). Email includes affected data details.
12. Changes
Updates posted here. Material changes: 30 days email notice. Continued use = acceptance.
13. Contact
Privacy inquiries: privacy@adaguard.io (Response: 5 business days)
California Residents (CCPA): Rights to know, delete, and opt-out of sales (we don’t sell data). Contact privacy@adaguard.io with “CCPA Request” in subject.