Privacy Policy

This policy explains what personal information Outpost ("Outpost", "we", "us") collects through outpostscan.com, why, who it is shared with and the choices you have. We collect as little as the service needs. We do not sell personal information, show advertising or use tracking or analytics cookies.

What we collect

If you use the site without an account

• The domain names you investigate and the resulting reports. A report describes the public configuration of a domain; it is not information about you. A preview started without an account can be opened by anyone who has its unguessable link.
• Your IP address, used to apply rate limits and protect the service from abuse, and recorded briefly in server and security logs.

If you create an account

• Your email address, to identify your account, confirm it belongs to you, send password-recovery links and contact you about your account or purchases.
• Your password, stored only as a salted one-way hash. We cannot read it.
• Your investigations: the domains you investigated, their reports, your monitoring schedules and alerts, and which reports you have unlocked. These are private to your account.
• Your credit history: purchases, credits spent and refunds.

If you buy credits

Payment is handled by Paddle.com, the merchant of record. Paddle collects your payment details, billing country and any tax information directly; we never receive or store your card number. We receive from Paddle a transaction reference, its status, the amount and currency, and notices of refunds or chargebacks, which we keep against your account.

If you write to us

We keep your message and email address so that we can answer.

Cookies

We set one cookie, and only when you log in: a session cookie that keeps you signed in. It is essential to the service, is not used for tracking, and ends when you log out or after at most 30 days. Paddle's checkout window, which opens only when you choose to buy, may set its own cookies to process the payment and prevent fraud.

How we use information

• to run investigations, show you your reports and operate monitoring;
• to operate your account, fulfil purchases and handle refunds;
• to send messages the service needs: email confirmation, password recovery and notices about your account or these policies. We do not send marketing email;
• to keep the service secure: limiting abuse, investigating misuse and keeping backups;
• to meet legal obligations, such as keeping records of transactions.

Where the law requires a legal basis: we process account and purchase information to perform our contract with you; security and abuse-prevention information because we have a legitimate interest in protecting the service; and transaction records to comply with legal obligations.

Who we share it with

We share personal information only with the providers that the service depends on, and only as far as each needs:

• Paddle.com: payment processing, tax and receipts, as merchant of record. Paddle handles your payment information under its own privacy policy.
• Resend: delivery of account emails (your email address and the message).
• Hostinger: hosting of the servers on which the service and its database run.
• Cloudflare: domain name service, and receiving email sent to our support address.

When an investigation runs, the domain name being investigated is sent to public data sources such as domain registries and vulnerability databases, and requests are made to the domain's own servers. Your identity is not included in those requests.

We may disclose information if the law requires it, or to protect the rights, safety or security of our users, the public or the service. If the service were ever transferred to another operator, account information would move with it under this policy, and we would tell you first.

How long we keep it

• Account, reports, monitors and credit history: for as long as your account exists.
• Sessions: up to 30 days, or 7 days without use.
• Rate-limit records (which include IP addresses): about two days. Server and security logs are kept for a limited period for security and troubleshooting.
• Backups: database backups are kept for 14 days, so deleted information can persist in backups for up to that long.
• Purchase records: kept after an account is deleted, without your email address, for as long as accounting and tax law require.

Security

Connections to the site are encrypted. Passwords and login sessions are stored only as hashes, private reports are served only to the account that owns them, and access to the servers is restricted. No system is perfectly secure; if a breach affected your personal information we would tell you and the relevant authorities as the law requires.

Your choices and rights

You can ask us to give you a copy of your personal information, correct it, or delete your account and its data, by writing to support@outpostscan.com from your account's email address. Depending on where you live (for example the EEA, the UK or California) you may also have the right to object to or restrict certain processing, to data portability, and to complain to your data-protection authority. We do not sell or share personal information for advertising, and we do not treat you differently for using these rights. We answer requests within 30 days.

If a domain you own has been investigated by someone else and you have a concern about it, write to us at the same address.

Where information is processed

Our servers and providers may be located outside your country, including in the United States and the European Union. Where personal information is transferred internationally, we rely on our providers' safeguards for such transfers, such as standard contractual clauses.

Children

The service is for adults. It is not directed to anyone under 18, and we do not knowingly collect personal information from children.

Changes

We may update this policy. The date at the top shows the latest version, and we will tell account holders about material changes by email or on the site.

Contact

Outpost · support@outpostscan.com