Privacy Policy

Last updated: 1 August 2026

This Privacy Policy explains how Nexgale Dynamics Private Limited, a company incorporated under the laws of India with its registered office in Vadodara, Gujarat, India ("Company", "we", "us", "our"), collects, uses, discloses, and protects information in connection with scanvify.com and its associated services (the "Service"). We are the data fiduciary / data controller for the personal data described in this policy. This policy should be read together with our Terms of Service.

1. Information we collect

We collect the following categories of information:

• Account information — if you create an account: your name, email address, and a securely hashed password (we never store your password in plain text). If you sign in with Google, we receive your name, email address, and Google account identifier from Google — we never see or store your Google password.
• Scan data — the URL(s) you submit, the resulting scores and findings, and screenshots of the publicly visible pages of that URL.
• Device / visitor identifier — a first-party cookie that lets you see your own scan history on a device without creating an account. It does not by itself identify you personally.
• Technical & security data — your IP address (used to apply rate limits, prevent abuse of free scans, and for security/audit purposes), browser/user-agent information, and standard web server logs.
• Payment & billing information — the plan purchased, amount paid, payment reference, and GST invoice details. If you purchase without signing in, we ask for your email address so we can send you your invoice and keep a record of the transaction. We do not collect or store your card, UPI, or bank account details — these are collected directly by our payment processor, Razorpay.
• Communications — messages you send us (e.g. support requests), and transactional emails we send you (password resets, invoices, report copies).

2. How we use your information

• To run your scan, generate and deliver your report, and show your scan history.
• To create and secure your account, and authenticate you when you sign in.
• To process payments and generate GST-compliant tax invoices, and to maintain accounting and tax records as required by Indian law.
• To detect and prevent abuse — including capping how many free scans a given IP address can run against the same domain per day.
• To send transactional communications: password resets, purchase receipts/invoices, and (only if you request it) a copy of your report by email.
• To respond to support requests and enforce our Terms of Service.
• To maintain and improve the reliability, security, and functionality of the Service.
• To measure the effectiveness of our advertising — only if you consent to advertising cookies (see Section 4) — so we understand which campaigns bring visitors and use our marketing budget responsibly.

We do not sell your personal data. We do not load third-party advertising trackers unless you consent to them via our cookie banner — see Section 4 (Cookies) for what "Accept" enables and how to opt out.

3. Legal basis for processing

We process your information on the following bases: performance of a contract with you (delivering the Service you request); our legitimate interests (for example, preventing fraud and abuse of free scans, and keeping the Service secure), balanced against your rights; compliance with a legal obligation (for example, retaining tax and invoicing records); and, where applicable, your consent.

4. Cookies

Essential cookies are always used because the Service needs them to function: a session cookie (set only when you sign in, marked HttpOnly and Secure), an anonymous visitor-identifier cookie (to associate your free scan history with your device), a first-party source label (to understand which channel referred you), and a currency-preference cookie (sv_currency, set from your approximate country so we can show prices and route your payment in the correct currency — ₹ in India, USD elsewhere; you can change it at any time from the pricing page). These do not by themselves identify you personally.

Analytics and advertising technologies are optional and consent-based. When you first visit, our cookie banner asks you to choose. If you select "Accept", we enable first-party usage analytics and load Google's advertising tag (Google Ads), which measures the effectiveness of our advertising campaigns and may set Google advertising/measurement cookies on your device. If you select "Essential only", none of these analytics or advertising technologies load. You can withdraw consent at any time by clearing the sv_consent value in your browser's local storage, after which the banner will let you choose again.

5. Who we share information with

We share information only as needed to provide the Service, with the following categories of service providers (data processors), each bound by their own terms and privacy practices:

• Razorpay — to process payments made in India (₹). Razorpay receives the information needed to complete your transaction; we do not receive your payment instrument details in return.
• Polar (Polar Software Inc., USA) — for purchases made outside India (USD). Polar acts as the merchant of record: your purchase is legally made from Polar, which collects your payment details, handles applicable taxes, and emails your receipt, under its own privacy policy. We receive the order details needed to deliver your report — never your payment instrument details.
• Google — if you choose Google Sign-In, to authenticate you.
• Google Ads — only if you consent to advertising cookies, we load Google's advertising tag to measure our ad campaigns and, where applicable, show remarketing. Google processes the related identifiers as an independent controller under its own privacy policy.
• Amazon Web Services (AWS S3) — where enabled, to store screenshots captured during scans.
• Our email delivery provider — to send password resets, invoices, and report emails.
• Our AI infrastructure provider — where the automated expert review is enabled, limited scan findings (never your account or payment details) may be processed by a third-party AI service to generate that review.
• Google PageSpeed Insights and Google Safe Browsing — the URL you submit for scanning may be sent to these Google APIs to run live performance and malware/blocklist checks.

We may also disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of the Company, our users, or the public.

6. International data transfers

Some of the service providers listed above may process data on servers located outside India (for example, in the United States). Where this occurs, we rely on those providers' own contractual and security safeguards for cross-border data transfer.

7. Data retention

We retain scan and account data for as long as your account is active, or as needed to provide the Service to you. Payment and invoicing records are retained for the period required under Indian tax and accounting law (currently up to 8 years). You may request deletion of your account and associated scan data at any time, as described in Section 9 — retained financial records required by law are an exception and cannot be deleted on request.

8. Security

We use industry-standard measures to protect your information, including encrypting data in transit (HTTPS/TLS), storing passwords using a salted one-way hash (never in plain text), and restricting access to production systems. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Your rights

If you are located in India, you have rights under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), including the right to: access the personal data we hold about you; request correction of inaccurate or incomplete data; request erasure of your personal data (subject to our legal retention obligations described in Section 7); withdraw consent where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal; nominate another individual to exercise your rights in the event of death or incapacity; and lodge a grievance with us (see Section 10) or, if unresolved, with the Data Protection Board of India. To exercise any of these rights, contact us at the email address below.

Regardless of location, you can also, at any time: use the free-scan features of the Service anonymously without an account; sign out; clear cookies to reset your on-device history; or ask us to delete your account.

10. Grievance officer / contact

In accordance with the Digital Personal Data Protection Act, 2023 and Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, our Grievance Officer is:

• Grievance Officer: Nexgale Dynamics Private Limited
• Email: [email protected]
• Address: Vadodara, Gujarat, India

To exercise any of the rights described in Section 9, or to raise any other privacy grievance, contact the Grievance Officer at the email above. We will acknowledge your grievance within 24 hours of receipt and aim to resolve it within 15 days, in line with applicable law.

11. Children's privacy

The Service is not directed at, and we do not knowingly collect personal data from, individuals under 18 years of age. If you believe a minor has provided us personal data, contact us and we will take appropriate steps to delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date above when we do, and, for material changes, provide additional notice where appropriate.

13. Contact

Privacy questions, grievances, or data requests: [email protected]. General questions: [email protected].

Data fiduciary: Nexgale Dynamics Private Limited · Vadodara, Gujarat, India