Privacy Architecture & Data Policy
At AVENTIQ, privacy is treated as a fundamental cybersecurity control, not an afterthought.
Zero Raw Content Retention
When you paste a sensitive message or email, ScamCheck processes the text in volatile server memory to compute indicators, then discards the raw body immediately after analysis.
Metadata-Only Logging
Our databases retain only high-level threat telemetry: risk tier, score, indicator categories, and truncated target domains. Raw personal messages are never logged.
1. Data Minimization Principles
ScamCheck collects only the minimal technical data required to evaluate digital risks. We do not sell user data, train public foundation models on private user submissions, or expose one user's submissions to another.
2. Clear Distinction of Stored Data
Temporary Analysis: Processed in volatile memory for the requested security check. Raw message, email, or screenshot bodies are immediately purged once indicators are computed.
Saved Analysis: Structured technical metadata (risk tier, score, indicators, truncated target) is stored only when an authenticated user explicitly saves a check to their dashboard.
Shared Report: Sanitized, read-only snapshot stored specifically when a user chooses to generate a public link. Strips all personal user identifiers and private notes, and can be instantly revoked at any time.
3. User Data Rights & Erasure
Authenticated users retain complete control over their analysis history. You can remove individual report records from your dashboard at any time, which permanently cascades deletion across all related finding records.
3. Third-Party Threat Feeds
When external threat intelligence queries are dispatched (e.g., Safe Browsing), only the canonical URL or domain is submitted. Surrounding personal message text and identity markers are stripped prior to query dispatch.