Privacy Policy

Effective date: October 8, 2026

AbuseZero is operated by Scalith, LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States. Questions: support@abusezero.com.

1. Scope

This Policy applies to personal information processed by Scalith, LLC in connection with the Service. When you submit information about your end users to the Service, you control that processing; our Data Handling Addendum governs that Customer Data.

2. Information we collect

2.1 Account and organization information

Name, email address, authentication factors, linked sign-in providers, organization membership, roles, billing contacts, and security settings for dashboard users.

2.2 Customer configuration

Benefits, policies, API credentials, team settings, retention choices, and other information you enter in the dashboard.

2.3 Evaluation and API data

Identifiers, network and device signals, benefit history, rules, outcomes, and evidence you supply when requesting evaluations, including optional browser observations when enabled. Passive observations can include browser/OS information, screen, hardware hints, graphics, locale, input and storage capabilities, and detector results. Rendering measurements are hashed locally; raw images, audio buffers, browsing history, and page content are not collected.

2.4 Technical and security data

IP addresses, browser or client metadata, request logs, diagnostic events, and security monitoring records.

2.5 Communications

Support messages, recovery submissions, and transactional email delivery records. Email validation may send recipient addresses to Reoon and, when Reoon cannot answer, to ZeroBounce. Resend delivery events may include IP addresses, device information, and link metadata from signed webhook payloads.

We store password verifiers, not plaintext passwords. Sensitive secrets and protected records are encrypted where required by the Service design.

3. How we use information

We use personal information to:

• provide, operate, and secure the Service;
• authenticate users and administer organizations;
• evaluate benefit claims according to your configuration;
• process payments and manage subscriptions;
• send transactional messages and respond to requests;
• detect, prevent, and investigate misuse or security incidents;
• comply with law and enforce our agreements; and
• analyze reliability and improve the Service using aggregated or de-identified data.

We do not sell personal information or use it for third-party behavioral advertising.

4. Legal bases (EEA, UK, and Switzerland)

Where the General Data Protection Regulation or similar laws apply, we rely on contract performance, legitimate interests (such as securing the Service and preventing abuse), consent where required (for example, optional cookies or marketing if introduced), and legal obligations.

5. Disclosures

We may disclose personal information to:

• service providers that host or operate the Service, including Cloudflare, Railway, Upstash, Resend, MaxMind, Reoon, ZeroBounce, TypeSafe, and OpenRouter;
• TypeSafe and, when needed, OpenRouter process derived benefit-history counts, email classifications, and network signals for AI-assisted risk scoring. These requests exclude raw email addresses, IP addresses, and account identifiers;
• identity providers you choose (GitHub, Discord, or Google) during social sign-in;
• professional advisers, auditors, and payment processors;
• parties to a merger, acquisition, or asset sale; and
• law enforcement or other parties when required by law or to protect rights, safety, and security.

Providers receive only information needed for their role and are bound by contractual or legal duties.

6. Retention

Test environment. Test data is persistent but bounded: encrypted original evaluation requests remain for up to seven (7) days; Test activity and ordinary operational history for up to thirty (30) days; redacted Test security-administration events for up to ninety (90) days. Active Test configuration remains until changed or reset.

Live environment. Detailed evidence defaults to ninety (90) days, with thirty- (30) and sixty- (60) day options. Compact Live outcome and matching history remains for the configured eligibility lifetime. Live audit records remain for one (1) year unless otherwise stated in the Documentation.

Device evidence. Raw browser attributes are encrypted and restricted to evidence permissions. They expire after 7 days in Test and follow the selected 30/60/90-day Live setting. Derived similarity signatures follow benefit eligibility history; recipient, organization, and Test cleanup remove their associated signatures. Similarity does not establish a person’s identity.

Bot verification. Google reCAPTCHA processes browser signals when bot collection is enabled. Verified assessment facts follow evaluation evidence retention. Google’s retention is governed separately by its terms.

Email. Validation results, including blocked addresses, remain in a protected cache for seven (7) days. For email accepted by Resend, we retain delivery records for twenty-four (24) calendar months for billing, account and security, and authentication email. Billing and account and security records include an encrypted copy of the message. Authentication records do not retain message bodies in the email archive. Other email delivery records remain for ninety (90) days without an archived message body. Periods start when Resend accepts the message. The archive begins when this Policy’s email section takes effect and does not include complete historical delivery records before that date.

Account, billing, audit, security, and legal records may be retained longer when required by law or reasonably necessary after account deletion.

7. Security

We use access controls, encryption in transit, encryption at rest for protected records, scoped credentials, and monitoring designed to safeguard personal information. See the Data Handling Addendum for additional detail on Customer Data.

8. Your rights and choices

Depending on your location, you may have rights to access, correct, delete, restrict, or port personal information, and to object to certain processing. You may update account information, manage sessions, and adjust security settings in the dashboard. To exercise rights, contact support@abusezero.com. We may verify your request before responding. End users of our customers should contact the customer first for Customer Data processed on the customer’s instructions.

9. International transfers

We and our providers may process information in the United States and other countries. Where required, we use appropriate safeguards for cross-border transfers.

10. Children

The Service is a business offering not directed to children under 18. We do not knowingly collect personal information from children.

11. Changes

We may update this Policy by posting a revised version with a new effective date. We will provide reasonable notice before material changes take effect.

12. Contact

Privacy questions: support@abusezero.com or the Contact page.