SCORPR/LEGAL/PRIVACY POLICY

ZERO-KNOWLEDGE & LEAST-PRIVILEGE SECURITY ARCHITECTURE

Scorpr Privacy Policy

At Scorpr Inc. (“Scorpr”, “we”, “our”, or “us”), we take your privacy and source security as seriously as your production infrastructure. This Privacy Policy details our protocols for handling account credentials, target domain scan URLs, and runtime diagnostics across our security, QC, and GEO/AEO auditing platforms.

Last Updated: November 6, 2026

•

Effective: November 6, 2026

•

Engine Specification: v2.4.0

•

[email protected]

No Source Code Access

Scorpr audits public endpoints, HTTP response headers, and client bundles. We never require, clone, or store private Git source repositories.

Isolated RLS Databases

All scan reports, audit histories, and remediation prompts are protected by strict PostgreSQL Row-Level Security, isolated strictly to your authenticated workspace.

Zero AI Training

Your submitted scan targets, vulnerability logs, and prompt patches are never sold, rented, or fed into public artificial intelligence training datasets.

Scope & Zero-Trust Architecture

This Privacy Policy governs the access to and use of all software, APIs, command-line interfaces, web dashboards, and documentation provided by Scorpr Inc. (“Scorpr Platform”). Scorpr operates as an autonomous pre-flight inspection and remediation instrument for modern web applications and AI-generated SaaS projects (including applications developed with tools such as Cursor, Lovable, v0, Bolt, Windsurf, or Next.js).

Our architecture is anchored on a zero-trust model: Scorpr audits staging domains and production URLs by performing external HTTP/HTTPS evaluation and sandboxed headless Chromium browser execution. Scorpr does not require read, write, or administrative credentials to your private Git code repositories (e.g. GitHub, GitLab, Bitbucket), nor do our scanners inject persistent backdoors or modify your target systems.

Information We Collect

We collect information strictly necessary to provide reliable security assessments, calculate SEO and AI crawler readiness, and manage your billing access. We categorize collected information into four tiers:

A. User & Account Identity Information

When you register or authenticate via Google OAuth, GitHub OAuth, or email magic link, we receive your email address, full name, profile avatar URL, and provider identification token managed via Supabase Auth.

B. Target Domain & Audit Request Data

When you initiate a scan, we collect the target URL submitted (e.g. https://staging.yourdomain.com), timestamp, chosen audit engines, and workspace affiliation.

C. Diagnostic Telemetry & Scanned Artifacts

During audit execution, our headless worker nodes inspect and record: HTTP response status codes, header configurations (Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, CORS headers), public JavaScript chunk manifests, client-side console logs, unhandled React hydration errors, Core Web Vitals telemetry (LCP, CLS, INP, TTFB), robots.txt directives, and Schema.org JSON-LD definitions.

D. Billing & Transaction Details

For paid subscriptions (Pro Builder and Agency Fleet), payment transactions are handled entirely by Stripe. We store only subscription status, seat allocations, billing renewal dates, and obfuscated card brand and last four digits.

How We Use Your Data

Scorpr utilizes the information collected exclusively for the following operational, security, and analytical objectives:

Delivering the 4-Engine Inspection Suite: Running SHIELD (vulnerability probes), RADAR (GEO/AEO engine), PULSE (runtime QA), and ARCHITECT (AI fix studio) to identify database RLS misconfigurations, secret key leaks, and SPA invisibility.
Synthesizing AI Fix Prompts: Compiling specific diagnostic findings into copy-paste Cursor, Windsurf, and Claude Code remediation markdown instructions tailored to your application framework.
Preventing Abuse & Malicious Exploitation: Validating that target domains comply with our anti-SSRF protections, RFC-1918 internal IP blocking rules, and rate limits to protect public internet infrastructure.
Workspace Role-Based Access Control: Ensuring that team members (Owner, Admin, Security Auditor, Client Viewer) access only authorized scans and executive summaries.
Platform Communications: Transmitting transactional audit notifications, critical vulnerability alerts, CI/CD webhook triggers, and invoice receipts.

Notice on Artificial Intelligence Model Training:Scorpr never uses customer domain audits, leaked secret signatures, or custom AI prompt responses to train public or proprietary machine learning foundational models.

Data Storage, Encryption & RLS Isolation

Security is the fundamental foundation of our product. We enforce multiple layers of defense to safeguard your records:

Data Encryption in Transit

All communications between your browser, our edge API endpoints, and headless worker clusters are encrypted using TLS 1.3 with modern cipher suites and HTTP Strict Transport Security (HSTS).

Data Encryption at Rest

All persistent database records, audit artifacts, and user metadata are encrypted at rest using AES-256 via Supabase Enterprise Cloud infrastructure.

PostgreSQL Row-Level Security

Database tables enforce strict Supabase RLS policies. User queries can only execute within their verified authentication JWT context, preventing cross-tenant data leakage.

Stateless Headless Workers

Headless Chromium browser instances run inside short-lived, sandboxed containers. Cookies, local storage, and cached network traces are destroyed immediately after audit generation.

Third-Party Sub-processors

We collaborate with a limited selection of SOC2 and ISO-compliant cloud service providers to maintain platform availability, database persistence, and billing:

Sub-processor	Purpose & Scope	Location	Safeguards
Supabase Inc.	Managed PostgreSQL database, Row-Level Security (RLS) engine, and OAuth session authentication.	United States (AWS US-East)	SOC2 Type II, ISO 27001, AES-256 encrypted at rest & TLS 1.3 in transit.
Vercel Inc.	Edge network delivery, serverless execution runtime, and privacy-preserving Web Analytics.	Global Edge Network / United States	ISO 27001, SOC2 Type II, zero third-party cross-site cookies.
Stripe Inc.	Payment gateway and subscription billing for Pro Builder and Agency tiers.	United States	PCI-DSS Level 1 compliant service provider. Scorpr never receives raw payment card details.
Anthropic & OpenAI	AI inference providers powering the ARCHITECT remediation prompt generation studio.	United States	Enterprise API zero-data-retention agreements; customer audit inputs are never utilized for model training.

Data Retention & User Rights (GDPR & CCPA)

Regardless of your geographic location, Scorpr provides universal privacy rights aligned with the European General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA):

Right of Access & Portability: You may inspect and export your historical scan reports, remediation prompts, and account profile data in machine-readable JSON or Markdown formats directly from the dashboard.

Right to Erasure (“Right to be Forgotten”): You can delete any individual scan report at any time. When you request workspace or account termination, all corresponding scan records, domain mappings, and auth records are purged from our primary database within 72 hours.

No Sale of Personal Data: Scorpr has never sold, leased, or monetized personal user data or customer scan telemetry to third-party data brokers, and will never do so.

Cookies & Tracking Technologies

Scorpr utilizes only strictly necessary first-party cookies for authentication session management:

sb-access-token & sb-refresh-token: Secure, HTTP-only, SameSite cookies created by Supabase Auth to maintain your authenticated login state.
Vercel Web Analytics: Privacy-first, cookieless platform measurement. It collects aggregate pageviews and Core Web Vitals without recording IP addresses or persisting cross-site tracking IDs.

We do not embed third-party advertising tracking pixels (such as Meta Pixel or Google Ads trackers) anywhere on the Scorpr platform.

Contact Information & Privacy Officer

For privacy inquiries, data deletion requests, Data Processing Agreement (DPA) execution, or security vulnerability reports, please contact our dedicated security team:

Scorpr Privacy & Security Office

Scorpr Inc. • Data Protection Division

Official Inquiry Email: [email protected]

Response SLA: All verified privacy and data erasure inquiries receive response within 48 business hours.