What we keep, and who sees it.

Scam Finder is run by [TODO: operator legal name and country]. Legal and privacy notices go to [TODO: operator address for legal and privacy notices].

This policy applies to www.scam-finder.net. The websites that Scam Finder checks, and any site a source link takes you to, have their own policies.

• Visiting: IP address, browser details, pages requested and security log entries.
• Checks: the website you submit, a rate-limit record, and the report and page copies it produces. A check link works as a private receipt, so treat it like a password if the website you checked is sensitive for you.
• Accounts: your email address, consent choices, session records and preferences such as theme, density, time zone and topics.
• Profiles: anything you add to an optional public profile, including an uploaded avatar. Avatars have their metadata stripped.
• Experiences: what you write, its revisions, your declarations about any affiliation or incentive, and any private evidence. Files can be JPEG, PNG or PDF.
• Saved websites: your saved list, private collections, private notes, alert choices and reminder choices.
• Cases: corrections, abuse reports, appeals, your reasons, evidence and any contact details you give.
• Website claims: the website, the proof result and expiry dates, and the replies you publish.

Where UK or EU data protection law applies, we rely on these legal bases:

• Providing the service you asked for: accounts, saved websites, publishing your contributions and running your cases.
• Legitimate interests: preventing abuse, fair use limits, security, accurate reports, correcting errors and explaining how the service performs in aggregate.
• Consent: website alerts, outcome reminders, a public profile, appearing in discovery feeds and publishing an experience. These are separate choices. Each is off until you turn it on, and you can withdraw any of them in your settings.
• Legal duties: keeping and acting on what the law requires, including responses to legal notices.

We don’t sell personal data. We don’t use it for advertising, and private reviews and evidence aren’t a training dataset.

A published experience shows your pseudonym, the month of the experience, its kind and outcome, your title and text, any issue tags, your declarations, and its publication and update dates. The pseudonym shows even if your profile is private. Making a profile private doesn’t withdraw an experience you already published.

Your email address, private evidence, saved websites, collections, notes, cases and any thanks you send stay private. Website representatives can’t see them.

If you withdraw something, we hide it at once and clear it from our pages, search and share previews. We can’t directly control copies held by outside search engines. We request removal where that’s available.

AI models and fixed rules are used to read public website text, screen experiences, replies, profile text and avatars, decide corrections and appeals, and answer questions in the optional help assistant from published help pages.

An automated decision can publish, change, withhold or reject content, or place a temporary, reasoned limit on your account. Each decision comes with its reason and a way to appeal, and we label it as automated. An appeal is a fresh automated assessment using separately configured models. We don’t promise that a person will review your case, and the service doesn’t assign one.

We don’t give you a hidden trust score. Automated suspicion alone can’t permanently ban you, and a shared IP address alone isn’t treated as proof of anything.

Any right the law gives you over automated decisions stands, and it is separate from this appeal process. See corrections and appeals.

We share personal data with these kinds of supplier:

• hosting, database, file storage and backup providers
• an email delivery provider
• AI model providers
• suppliers that fetch public web pages and permitted sources
• security, error monitoring and malware scanning services

Current suppliers: [TODO: named suppliers and their countries].

Some suppliers may process data outside your country. [TODO: transfer safeguards for each supplier].

We may also disclose data where the law requires it, and to protect people from harm or the service from abuse.

Reports can quote public websites, and those pages can include names or business contact details. Someone may also mention you in an experience. Private personal details break the community guidelines, and we restrict them when they’re found.

If you’re named, use corrections and appeals and point to the exact statement. You don’t need an account, a payment or a website claim.

Accounts, profiles and published contributions stay until you delete or withdraw them. For everything else:

[TODO: these periods are proposed defaults pending review under D12]

Sign-in links

15 minutes, single use

Signed-in sessions

7 days idle, 30 days at most

Uploads never attached to anything

24 hours

Security logs

30 days

Backups

30 days

“Check my draft” records, with no draft text

30 days

Stored copies of website pages

90 days

In-app notifications

90 days

Private evidence

30 days after the case and appeal window close

Audit records, with no deleted text

365 days

Deleted accounts

Hidden at once, purged after 7 days

A case under an active legal hold can stay longer. A hold has a reason, a scope and an expiry date, and it isn’t open-ended. Audit records keep what happened, without a copy of the content you deleted.

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to how it’s used, take a copy with you, and withdraw consent.

With an account, export and delete your data in your settings. We may ask you to sign in again first. Deleting hides your profile, ends your sessions and withdraws what you wrote by default. Anything the law requires us to keep stays private. For other requests, or if you have no account, use the contact page. We’ll ask only for enough to confirm it’s you.

You can also complain to a regulator. In the UK that’s the Information Commissioner’s Office. In the EU it’s your national data protection authority.

We send sign-in links, security notices and updates on your submissions and cases. If you opt in, we also send alerts about a website you saved and a reminder about an experience you shared. Alerts and reminders have separate settings, and unsubscribing from one doesn’t delete your account or affect the other.

If an alert we sent you turns out to be wrong, we may email you a correction.

Private files go through quarantine and malware checks and are stored encrypted, with short-lived access links. Session records and case links are stored as hashes. No security is perfect, so leave passwords, full card numbers and ID numbers out of what you send.

If a problem affects your data, we’ll contain it and tell you where the law requires it.

Accounts are for people aged 18 or over. We don’t collect birth dates. Anyone can read public pages and check a website without an account. If you believe a child has created an account, tell us on the contact page.

When this policy changes, we update the date at the top of this page. If a change affects what you consented to, we’ll ask you again before it applies.

Questions go through the contact page. Cookies have their own page: the cookie policy. The rules for using the site are in the terms of service.