This policy describes how RimScan handles information when you use the service. It is a clear working template and should receive legal review before public launch.
Information we collect
We collect your email address, account and plan information, authentication records, target domains you submit, scan configuration, scan results, findings, triage status, and service activity needed to operate the account. We do not ask you to submit secrets or credentials for scanned systems.
How we use information
We use this information to authenticate users, run and display authorized monitoring, maintain findings and notifications, enforce quotas and security controls, provide support, and improve reliability. Lemon Squeezy processes payment and subscription information for paid plans; RimScan does not sell personal information to third parties.
External data sources
Depending on scan configuration, the recon engine may query crt.sh, Cert Spotter, AlienVault OTX, RapidDNS, the Wayback Machine, DNSDumpster, Anubis at jldc.me, and DNS resolvers. Nuclei and related checks make network requests required to inspect the authorized targets. Those providers may receive the domain or hostname being queried and process it under their own policies.
Retention and deletion
Account, target, scan, finding, and notification records are retained while your account is active so monitoring history and recurrence tracking work. When you delete your account through Settings, we delete or anonymize account-linked records according to the deletion workflow and retain only what is necessary for security, fraud prevention, legal compliance, backups, or dispute resolution. Exact backup expiration depends on the backup cycle.
Your choices and rights
You may review and manage account information in Settings, request account deletion there, and contact privacy@rimscan.cloud about access, correction, or other rights available under applicable law. We may need to verify requests before acting.
Security and changes
We use reasonable safeguards appropriate to the service, but no online system is guaranteed secure. We may update this policy when the service or legal requirements change and will publish the current version here.