Privacy Policy.

This policy applies to all users of Syrcha's Services worldwide. It covers information collected:

• When you visit our website or platform.
• When you register for an account.
• When you submit websites or apps for compliance scanning.
• When you communicate with us (support, sales, inquiries).

We collect the following categories of personal and service-related information:

a. Account Information

• Name, email address, company name, and billing details.
• Login credentials (encrypted).

b. Service Data

• URLs and application endpoints you provide for scanning.
• Scan results, compliance reports, and analysis logs.

c. Technical Data

• IP addresses, device identifiers, browser type, and operating system.
• Log files and diagnostic data.
• Cookies and similar technologies (see Section 9).

d. Payment Information

• Card details are entered with, and held by, Stripe. They never reach our servers and we cannot see them.
• We store what Stripe returns to us: the plan, the amount, the last four digits, and the invoice history.

e. Communication Data

• Records of support requests, feedback, or interactions with our team.

We process collected information for the following purposes:

• Service Delivery: To provide compliance scans, reports, and monitoring.
• Account Management: To register, authenticate, and manage user accounts.
• Payments: To process transactions and issue invoices.
• Service Improvement: To troubleshoot, analyze, and enhance our Services.
• Communications: To send service updates, security alerts, and product information.
• Legal Compliance: To comply with applicable laws, enforce agreements, and protect rights.

If you are located in the European Economic Area (EEA), we rely on the following legal bases:

• Contractual necessity (providing Services you request).
• Legitimate interests (improving Services, ensuring security).
• Consent (marketing emails, non-essential cookies).
• Legal obligations (compliance with financial and regulatory requirements).

We do not sell personal data. We may share information with:

These are every sub-processor we use, what each one does, and where it runs. If this list changes, this page changes with it.

• Hetzner (Germany) - hosting for the application, the database, and the scanner. All service data lives here.
• Stripe: payments, invoicing, and card handling.
• Resend: transactional email for sign-in links, scan notifications, receipts.
• PostHog (EU Cloud) - product analytics. Requests are proxied through our own domain, so your browser never contacts PostHog directly.
• Sentry: error monitoring. Receives stack traces and the request context attached to a fault.
• S3-compatible object storage: encrypted database backups.

Beyond those, we disclose personal data only:

• To legal authorities: where required by law, or to protect rights and safety.
• In a business transfer: on a merger, acquisition, or sale of assets.

We do not sell personal data, and we do not share it with advertising networks or data brokers.

• Account Data: Retained as long as your account is active.
• Scan Data: Retained for 12 months unless deleted earlier by the user.
• Logs: Retained for 90 days for security and diagnostics.
• Legal Records: Retained as required by law (e.g., tax obligations).

Users may request deletion of their data at any time (see Section 8).

We implement appropriate technical and organizational measures, including:

• Encryption in transit (TLS) and at rest.
• Access controls and authentication safeguards.
• Regular vulnerability assessments and monitoring.

However, no method of transmission over the Internet is 100% secure.

Depending on your location, you may have the following rights:

Under GDPR (EU/EEA):

• Access, rectify, or erase personal data.
• Restrict or object to processing.
• Data portability.
• Withdraw consent at any time.
• Lodge a complaint with a supervisory authority.

Under CCPA (California):

• Right to know what personal information we collect and how we use it.
• Right to request deletion of personal information.
• Right to opt out of sale of personal information (we do not sell data).
• Right to non-discrimination for exercising your rights.

To exercise your rights, contact us at privacy@syrcha.com.

We set cookies and similar storage for:

• Authentication and session management: strictly necessary, always set.
• Your preferences: such as your cookie choice itself, so we stop asking.
• Product analytics: PostHog, on EU infrastructure, loaded only after you accept. It records which pages and features are used. It does not follow you to other sites and we run no advertising or cross-site tracking.

Declining leaves the product fully functional: only the analytics group is optional, and declining is as easy as accepting. You can change your answer at any time from the cookie banner or your browser settings.

Your service data is stored in the EU. Syrcha operates from Australia, so our own staff access that data from outside the EEA, a transfer under Chapter V of the GDPR, covered by Standard Contractual Clauses.

Sub-processors outside the EEA are engaged under the same safeguards. We say this plainly because "EU hosting" on its own does not mean data never leaves the EU, and a scanner that checks other people's transfer disclosures should not fudge its own.

Our Services are not directed to children under the age of 16 (or 13, where applicable). We do not knowingly collect data from children.

We may update this Privacy Policy periodically. Updates will be posted on this page with the "Last Updated" date. We will notify users of significant changes by email or in-app notification.

If you have questions about this Privacy Policy or our practices, please contact us at:

Syrcha Privacy Team

Email: privacy@syrcha.com