Privacy Policy

Last updated: November 2026

1. Data We Collect

  • Account data: email address (for API key and magic link auth)
  • Usage data: API call paths, timestamps, IP hashes (SHA-256, not reversible), response codes
  • Analytics data: page paths, referrer URLs, country (from IP geolocation), device type — collected server-side (Cloudflare Analytics Engine, PostHog) and, with your consent, via Google Analytics 4 (client-side, consent-gated)
  • Read-depth beacon: when you leave or hide a story page after at most 10 minutes, your browser sends the story's address slug and the number of seconds you spent on it to our server. We read nothing else from this request (no cookie, no identifier); it is stored in Cloudflare Analytics Engine as one data point holding only the slug and the seconds
  • Sponsorship: we may display contextual, privacy-respecting sponsorship messages. No cookies or tracking scripts are used for advertising
  • Payment data: processed by Stripe; we store only Stripe customer IDs, not card numbers
  • Cookies: session cookie for dashboard auth (scand-session, HttpOnly, Secure); analytics cookies (_ga, _ga_*) set by Google Analytics only if you consent via the cookie banner

2. Legal Basis for Processing (GDPR Art. 6)

  • Art. 6(1)(b) — Contract performance: processing your email and API key data is necessary to provide the API service you signed up for.
  • Art. 6(1)(f) — Legitimate interest: aggregation and analysis of publicly available data (tweets, Reddit posts, news articles) for controversy monitoring. This does not include private or non-public data.
  • Art. 6(1)(a) — Consent: analytics cookies (Google Analytics 4) are placed only after explicit opt-in via the cookie banner. Email alerts are sent only when you explicitly opt in.

3. Public Data Aggregation

SCAND.Ai aggregates publicly available content from Twitter/X, Reddit, Hacker News, Bluesky, Polymarket, RSS feeds, and news sites. We do not collect private messages, login credentials, or non-public data from any platform.

4. How We Use Data

  • Provide and improve the controversy monitoring service
  • Enforce rate limits and prevent abuse
  • Send email alerts (if you opt in)
  • Generate aggregate usage statistics

5. Data Sharing & Sub-processors

We do not sell personal data. We share data only with the following sub-processors:

  • Stripe, Inc. — payment processing (PCI DSS compliant)
  • Cloudflare, Inc. — infrastructure hosting, CDN, Workers runtime, D1 database, KV storage, transactional email delivery (Email Service)
  • Google LLC — AI classification, source-relevance checks, star profiles, and fallback analysis of public content (Gemini API). The texts sent are public posts and articles, which can include the names and public handles of the people in them; no data about our readers or account holders is sent.
  • Alibaba Cloud (Model Studio, Qwen models) — AI analysis of the texts of public stories. These texts, which can include the names and public handles of the people in them, are sent to and processed in Alibaba Cloud's China (Beijing) region, outside the EU and the US.
  • PostHog, Inc. — server-side product analytics (US region, no cookies or client-side tracking; only anonymized page view events with daily-rotated hashed identifiers)
  • Google LLC (Analytics) — website analytics via Google Analytics 4 (consent-gated, US/EU data processing)

6. Data Retention

  • API call logs: 30 days
  • Analytics data: 90 days (Cloudflare Analytics Engine), 1 year (PostHog), 14 months (Google Analytics 4)
  • Account data: until account deletion
  • Aggregated content: indefinitely (public data)

7. Your Rights (GDPR Art. 12-23)

  • Access (Art. 15): request a copy of your personal data.
  • Rectification (Art. 16): correct inaccurate personal data.
  • Erasure (Art. 17): request deletion of your personal data.
  • Data Portability (Art. 20): export your data in machine-readable format via /api/export/ (Pro/Enterprise) or by contacting us.
  • Restriction (Art. 18): request restriction of processing.
  • Objection (Art. 21): object to processing based on legitimate interest.

API key deactivation removes access immediately. To exercise these rights, contact us at contact@scand.ai.

8. Automated Decision-Making (GDPR Art. 22)

SCAND.Ai uses AI (Qwen by Alibaba Cloud and Gemini by Google) to classify and analyze public controversy data. These automated assessments determine topic categorization, noise levels, and state transitions. No automated decisions are made that produce legal or similarly significant effects on individuals.

9. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, in accordance with GDPR Art. 33-34.

10. Security

All data is encrypted in transit (TLS). API keys are stored as SHA-256 hashes. IP addresses are hashed before storage. Session cookies are HttpOnly and Secure.

11. Contact

Privacy inquiries: contact@scand.ai.