ScopeApproved – Privacy Policy
Effective 2 November 2026.
Who is responsible
The data controller is Musa Adam Lim EI (entrepreneur individuel), trading as LIM Agentic AI, SIREN 131 778 235, 130 boulevard Masséna, n° 3059, 75013 Paris, France. Contact for any privacy question or request: support@scopeapproved.dev.
What we collect
- Account: your email address, sign-in tokens, and session records.
- Free pre-check: the homepage and privacy-policy URLs you submit, and the resulting gap list. We fetch those public pages to check them; we keep the findings, not a copy of the pages. The fetched page text is not stored; only the result summary is kept for 30 days.
- Kits and renewals: the app name, Google Cloud project ID or OAuth client name, the scopes you declare, the descriptions of your app's features you give us, and the deliverables we generate for you (gap lists, justification drafts, scripts, checklists).
- Pre-scans: the domains you submit, verification tokens and the method that worked (DNS or file), pre-scan status, and finding metadata (check name, severity, observed header or setting, status codes).
- Billing: your offer, purchase and renewal status, the date and text of your consent to immediate supply and to any renewal, and the Stripe customer and subscription identifiers. Stripe collects your card details, billing name, country, and billing address directly. We see only limited details such as the card brand and last four digits.
- Support: messages you send to support@scopeapproved.dev, including any Google rejection email you send us for a refund claim.
- Technical: IP address, browser user agent, and request logs kept by our hosting providers for security and abuse prevention. A free pre-check made without an account also stores the requesting IP address with the pre-check until it is deleted, so one address cannot queue unlimited checks.
What we do not collect
We do not access your Google Cloud project, and we do not collect Google user data from your app. We ask you never to send us passwords, OAuth client secrets, refresh tokens or API keys, and we delete them if received. We do not store card numbers. We do not sell personal data, and we do not use advertising or tracking cookies.
Why we use it, and the legal basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Creating your account, running pre-checks and pre-scans, generating and delivering kits, managing renewals and refund claims | Performance of the contract |
| Billing, invoices, tax and accounting records, and proof of consumer consents | Legal obligation |
| Verifying domain ownership, preventing unauthorised scans and abuse, securing the service | Legitimate interest in keeping ScopeApproved and third parties safe |
| Service emails (sign-in links, kit ready, renewal reminders 45 days before each renewal, billing notices) | Performance of the contract and legal obligation (renewal reminders, French Consumer Code art. L215-1) |
| Product updates and tips by email, if we send them | Your consent, which you can withdraw at any time |
Who processes it for us
We use these processors, each bound by a data processing agreement:
- Stripe (Stripe Payments Europe Ltd., Ireland, and Stripe, Inc., USA): payments, renewals, invoices, customer portal. For some purposes, such as fraud prevention and legal compliance, Stripe acts as an independent controller under its own privacy policy.
- Supabase (Supabase Pte. Ltd., Singapore): database for accounts, pre-checks, pre-scans and kits. Region: EU (Frankfurt, eu-central-1).
- Cloudflare (Cloudflare, Inc., USA): website hosting, CDN, and security. Cloudflare Turnstile receives the bot check result and IP address when you run a free pre-check.
- Resend (Resend, Inc., USA): sign-in, notification and renewal reminder emails.
- Hetzner (Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany): runs the server, in the European Union, that performs the passive pre-scan of your verified domain. It is reached only through a Cloudflare Tunnel.
International transfers
Some of our processors are based outside the European Economic Area, or process data there:
- United States: transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.
- Singapore and other countries: transfers rely on the European Commission's Standard Contractual Clauses.
Sign-in links, kit notices, renewal reminders and billing notices are sent through Resend. We send only service emails unless you opt in to anything else.
Cookies
No session cookie is used. Stripe sets its own cookies on its checkout and customer portal pages for payment and fraud prevention, and Cloudflare Turnstile may use strictly necessary signals for its bot check. Because we use no analytics or advertising cookies, no consent banner is needed.
Retention
- Free pre-checks: results and the stored IP address are deleted 30 days after the check.
- Kits: deliverables and the app details you declared are kept for 12 months after purchase, or, if an annual renewal is active for that app, while it is active and for 90 days after it ends.
- Pre-scans: finding metadata is kept with the kit it belongs to. Verification logs are kept with the pre-scan, or up to 12 months where needed to handle a complaint about an unauthorised scan.
- Refund claims and support: kept for 12 months after the claim or conversation is closed, or longer where needed for a dispute.
- Account: kept until you ask us to delete it, or deleted after 24 months with no sign-in or purchase.
- Billing records: invoices, accounting records and proof of consents at checkout are kept for 10 years, as French commercial law requires (Commercial Code, article L123-22).
- Hosting logs: kept by our providers for their standard security retention periods, generally no more than 12 months.
Your rights
You can ask to access, correct, delete, or export your data, to restrict or object to processing, and to withdraw consent at any time. Write to support@scopeapproved.dev from your account email. We answer within one month. We may need to keep some data, such as invoices, where the law requires it.
If you are not satisfied, you can complain to the CNIL (www.cnil.fr), the French data protection authority, or to the authority in your country of residence.
Security
Data is encrypted in transit. Access to the production database is limited to the server, using a service key that is never sent to the browser. Row level security blocks the public keys from reading user data.
Changes
We will update the effective date when we change this policy, and we will email account holders about material changes.