Privacy Policy

Content you submit for checking. We send the content required to run a check to our servers. Depending on what you submit, relevant portions may be queried against URL-reputation services, phone/email/IP-reputation services, domain registries, certificate records, public blocklists, and local analytical checks. We do not send every submission to every provider. Provider availability and the kind of input determine which checks can return data.

Screenshots you upload. A screenshot is sent to our configured image-extraction service so that visible phone numbers, URLs, email addresses, and text can be identified. The reviewed application code does not store uploaded images in the application database or file storage. Please redact passwords, payment details, one-time codes, account numbers, and other sensitive information before uploading. Provider-side retention is governed by the relevant processor and is not represented here as an application-controlled retention period.

Result records and public access. New results are private by default. For text and mixed-content submissions, the application stores a non-reversible fingerprint instead of the raw submitted message. A person can choose after a result to create a public link; that link shows only a sanitised display label, verdict, risk score, and limited summary. Original messages, screenshots, detailed evidence, and full personal identifiers are not published. Shared links are noindex by default and can be unpublished by the service owner. If a result is inaccurate or you have a privacy concern, request a correction or removal review through our correction and removal route.

IP address (hashed). We record a one-way SHA-256 hash of your IP address for rate limiting and abuse prevention. We never store your raw IP address and cannot reverse the hash to identify you.

Community reports. If you submit a "scam" or "safe" community report, the report type and a hashed IP are stored alongside the check result. No personal information is required to submit a report.

Watch alert email address. If you choose to use the "Alert me" watch feature, your email address is stored to send you a notification if the entity you are watching receives new community reports. You can unsubscribe at any time by clicking the unsubscribe link in any alert email or by contacting us at hello@scammerscheck.com.

Dispute submissions. If you submit a dispute, your contact email and message are stored so we can review and respond. Dispute records are retained for 12 months after resolution.

Pro API subscriber email. If you subscribe to the Pro API, your email address and Stripe customer ID are stored to manage your subscription and deliver your API key. Payment processing is handled entirely by Stripe — we do not store card details.

Legitimate interests (Article 6(1)(f)). Processing submitted content for scam detection, storing hashed IPs for rate limiting, and maintaining limited, user-authorised sanitised result summaries are necessary for our legitimate interest in providing a fraud prevention service to the public.

Consent (Article 6(1)(a)). Storing your email address for watch alerts is based on your explicit opt-in. You may withdraw consent at any time.

Contract performance (Article 6(1)(b)). Processing Pro API subscriber data is necessary to fulfil the subscription contract.

We use the data we collect solely to operate and improve the ScammersCheck service: to perform scam checks, display results, prevent abuse, send watch alerts you have requested, respond to disputes, and manage Pro API subscriptions.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

Relevant inputs may be queried with third-party services to generate an evidence-led risk indicator. The current implementation can use services including VirusTotal, AbuseIPDB, Google Safe Browsing, IPQualityScore, and abuse.ch services where applicable. It can also query public registry, certificate, and blocklist data. The specific path depends on the input type and service availability.

Analytics. We use privacy-respecting analytics to understand how the site is used (page views, check volumes). Our analytics do not collect personally identifiable information.

Advertising. We display advertisements served by Google AdSense. Google and its partners may use cookies (including the DoubleClick cookie) to serve ads based on your prior visits to this and other websites. These cookies allow Google to serve ads to you based on your visit to our site and other sites on the internet. You may opt out of personalised advertising by visiting Google's Ads Settings or by visiting aboutads.info. For more information on how Google uses data when you use our site, please visit Google's Privacy & Terms.

Cookie choice. Advertising, conversion measurement, and analytics tags are blocked until you affirmatively accept non-essential technologies. If you decline, they remain blocked. A persistent Cookie Settings control lets you change or withdraw your choice; withdrawal removes application-injected non-essential tags and clears the measurement globals and known application-accessible advertising/measurement cookies where possible. Your browser or third-party provider may retain independent controls and records outside our application.

New check records expire after 30 days. The service provides an owner-only purge control for expired records. New share links expire with their originating check and are noindex by default. This retention rule applies prospectively; existing historical records are not automatically altered by the staged migration.

Hashed IP records used for rate limiting are pruned after 30 days.

Email addresses provided for watch alerts are retained until you unsubscribe.

Dispute records are retained for 12 months after resolution.

Pro API subscriber records are retained for the duration of the subscription and for 6 months thereafter for billing and compliance purposes.

If you are located in the United Kingdom or European Economic Area, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your personal data where there is no compelling reason to continue processing
• Right to restrict processing — request that we limit how we use your data
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — withdraw consent for watch alerts at any time

Because we store IP addresses only in hashed form, we cannot identify records belonging to a specific individual without additional information you provide. To exercise any of these rights, please contact us at hello@scammerscheck.com.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.