§ 01 · ScopeWho this covers.
This Privacy Policy explains how AuditHunt ("we", "us") processes personal data when you visit our site, create an account, or run a scan. It applies to the marketing site and the authenticated application alike.
AuditHunt is a tool for security researchers and protocol teams. We deliberately collect as little as the product needs to function — the source you submit for analysis is treated as confidential working material, not as data to mine.
§ 02 · InventoryData we collect.
We group the data into four categories. Each is collected for a specific, stated purpose described in § 03.
2.1Account data
Your name (optional), email address, and an encrypted password hash — or, if you sign in with a wallet, your public wallet address. Used to create and secure your account.
2.2Scan submissions
The Solidity, Vyper, or Cairo source, deployed contract addresses, or repository links you submit for analysis, plus the findings we generate from them. This is your confidential working material. We do not use customer scan submissions to train models or share them with third parties.
2.3Billing data
For paid plans: the wallet address you connect to pay (via Reown/WalletConnect), the resulting on-chain transaction identifiers, and billing records kept for invoicing and tax purposes. All payments are on-chain; we do not process or store card numbers.
2.4Usage & technical data
Standard server logs (IP, user-agent, timestamps) for security and abuse-prevention, and minimal product telemetry to keep the engine healthy. See § 04 for the analytics posture.
§ 03 · PurposeHow we use it.
- Provide the service — run scans, return findings, maintain your account. Basis: performance of contract.
- Secure the platform — detect abuse, prevent fraud, protect submitted source. Basis: legitimate interest.
- Process billing — charge subscriptions and credit purchases. Basis: performance of contract.
- Communicate — transactional email (verification, receipts, scan-complete). Marketing only with consent. Basis: consent / legitimate interest.
- Comply with law — tax, sanctions screening on payments, lawful requests. Basis: legal obligation.
Where the UAE Personal Data Protection Law (Federal Decree-Law 45/2021) applies, we rely on the equivalent bases.
§ 06 · BordersInternational transfers.
Your data may be processed in countries other than your own. Where we transfer personal data out of the UK/EEA, we rely on the Standard Contractual Clauses (2021/914) to keep your protections intact, and we apply the equivalent transfer safeguards the UAE Personal Data Protection Law requires for transfers out of the UAE. We do not hold EU-US Data Privacy Framework certification.
§ 07 · LifespanHow long we keep it.
We keep personal data only as long as needed for the purpose it was collected, then delete or anonymize it.
- Account data — for the life of your account, then a 30-day grace period after closure, then irreversible erasure.
- Uploaded source, findings & reports — for the life of your account; deletable by you at any time; erased with the account.
- Temporary working copies made during an analysis — deleted automatically when the analysis finishes; not retained as part of your account data.
- Server and access logs — kept only as long as needed for security and abuse-prevention, then rotated or deleted.
- Error-monitoring events — kept for a limited window to diagnose and fix issues, then deleted automatically by our error-monitoring provider.
- Financial and transaction records — kept for 7 years after the transaction, as tax and accounting law requires; this survives account erasure as a non-identifying record.
- Encrypted backups — erased data can persist in encrypted backups for up to 6 months.
- Wait-list email — kept until you are invited or ask us to remove it.
§ 08 · ControlYour rights.
Depending on where you live, you have rights to access, correct, delete, port, restrict, and object to the processing of your personal data, and to withdraw consent at any time. California residents have the right to know, delete, correct, and opt out of "sale"/"sharing" — which we do not do.
To exercise any right, email privacy@audithunt.com. We respond within the timeframe the applicable law requires. You also have the right to lodge a complaint with your local data-protection authority.
§ 09 · DefenseHow we protect it.
We encrypt data in transit and at rest, scope access to the minimum personnel required, and treat submitted source as confidential. No system is perfectly secure, but security is the product — we hold our own house to the standard we hold yours. To report a vulnerability, see our Security & Disclosure page.
§ 10 · EligibilityChildren.
AuditHunt is a professional tool and is not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a minor has provided us data, contact us and we will delete it.
§ 11 · RevisionsChanges & contact.
We may update this policy as the product and the law evolve. Material changes are announced and the version stamp at the top of this page is updated. Continued use after an update means you accept the revised policy.