Privacy policy

ScriptProof is a software-as-a-service monitoring tool that keeps an inventory of the scripts on your payment pages, detects changes to page content and HTTP headers, and produces evidence reports in support of PCI DSS requirements 6.4.3 and 11.6.1. The service is operated by the ScriptProof operator (“we”, “us”, “our”), which acts as the data controller for the personal data described in this policy.

This policy explains what data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it. If anything is unclear, contact us at support@scriptproof.com.

We collect four categories of data:

• Account data. Your name, email address, and a salted hash of your password (we never store your password in plain text), plus your organization name and plan.
• Site and scan data. The site URLs you register, page URLs we crawl, script URLs and metadata, SHA-256 content hashes, HTTP response headers, change history, and the PDF Evidence Packs we generate for you.
• Billing data. Payments are processed by Dodo Payments as merchant of record. We receive and store your subscription status, plan, and invoice references — we never receive, process, or store card numbers or other cardholder data.
• Logs and usage data. IP addresses, browser user agent, timestamps, and request logs generated when you use the application, kept for security and debugging.

Our crawler, ScriptProofBot, only scans domains a customer has verified they own or control, plus individual URLs submitted to the public one-off free scanner. It reads publicly served page content; it does not log into sites or submit forms.

We process your data for the following purposes, on the following legal bases:

• Providing the service — running scans, maintaining your script inventory, generating alerts and Evidence Packs (performance of our contract with you).
• Communicating with you — email verification, change alerts, and digest emails you have configured (performance of contract).
• Billing and account management — managing subscriptions through Dodo Payments (performance of contract and compliance with legal obligations).
• Security and anti-abuse — protecting the service and our crawler from misuse, as described in section 4 (our legitimate interest in running a safe service).
• Improving the service — analyzing aggregate, non-identifying usage patterns (legitimate interest).

To keep the service safe and to prevent our crawler from being pointed at sites the requester does not control, we apply automated anti-abuse measures:

• Signup email vetting. When you sign up, we check that your email domain has valid mail (MX) records and screen it against lists of disposable email providers. Addresses that fail these checks may be rejected.
• Rate limiting. We limit the frequency of requests per IP address and per account — including free-scan submissions — to prevent abuse of the service.

These measures process your email address and IP address and are based on our legitimate interest in preventing fraud and abuse. They do not involve profiling that produces legal effects for you.

We use session cookies only, set by our authentication system (Better Auth) to keep you signed in. These are strictly necessary for the service to work.

We do not use advertising cookies, third-party tracking pixels, or cross-site analytics trackers anywhere on the site or in the application.

We never sell your personal data and we never share it for advertising. We share data only with the service providers we need to operate ScriptProof:

• Dodo Payments — our merchant of record, which processes payments and handles cardholder data on its own systems.
• Our transactional email provider — to deliver verification emails, alerts, and digests to the address on your account.
• Our hosting and infrastructure providers — which store the databases and files that make up the service.

Each provider processes data only on our instructions and under contractual confidentiality and data-protection commitments. We may also disclose data where required by law or to protect our legal rights.

• Account data is kept for as long as your account is active.
• Scan history, script inventory, and Evidence Packs are kept while the related site remains configured. Deleting a site removes its scans, inventory, and change history.
• Deleting your account removes your organization and all associated data from our production systems; residual copies in encrypted backups expire on a rolling schedule shortly afterwards.
• Logs are retained for a limited period for security and debugging, then deleted or anonymized.
• Invoicing records are retained by Dodo Payments as merchant of record for as long as tax and accounting laws require.

• All traffic to and from the service is encrypted in transit with TLS.
• Data is encrypted at rest on our infrastructure providers’ systems.
• Passwords are stored only as salted hashes.
• Access to production systems is limited to the people who need it to operate the service.
• By design, the service never requests, processes, or stores cardholder data, which keeps the most sensitive category of payment information entirely off our systems.

No system is perfectly secure, but if we become aware of a breach affecting your personal data we will notify you and the relevant authorities as required by law.

You can exercise the following rights over your personal data at any time by emailing support@scriptproof.com:

• Access — ask for a copy of the personal data we hold about you.
• Rectification — correct inaccurate data (most account details can be edited directly in the app).
• Deletion — delete individual sites or your entire account, in the app or by request.
• Export / portability — receive your data in a structured, machine-readable format.
• Objection and restriction — object to or ask us to restrict processing based on legitimate interests.

We respond to verified requests within 30 days. If you are in a jurisdiction with a data protection authority, you also have the right to lodge a complaint with that authority.

Our infrastructure and service providers may store or process data in countries other than your own. Where data protection law requires it, we rely on appropriate safeguards for such transfers — such as standard contractual clauses or equivalent commitments from our providers — so that your data receives a consistent level of protection wherever it is processed.

ScriptProof is a business tool and is not directed at children. You must be at least 16 years old to create an account. We do not knowingly collect personal data from anyone under 16; if you believe a child has provided us with personal data, contact us and we will delete it.

We may update this policy as the service evolves. We will post the updated version on this page with a new “last updated” date, and if a change materially affects how we handle your personal data we will notify you by email before it takes effect. Continued use of the service after a change takes effect means you accept the updated policy.

Questions, requests, or concerns about this policy or your data: support@scriptproof.com. We aim to reply within two business days.