Privacy Policy
Last updated:
1. Who processes data
Scantelio is operated by Individual Entrepreneur Ostapenko Daniil Viktorovich, Bishkek, Kyrgyzstan. Contact owner@scantelio.com about personal data. Provider details appear below.
The provider determines the purposes of processing account, support and website-operation data. Organizations submitting personal data as part of a tested project are responsible for the lawfulness of the transfer and their duties to data subjects; Scantelio processes submitted materials to deliver the requested service. If a separate data processing agreement is needed, arrange it before uploading such data.
2. Data we receive
Account data: GitHub profile identifier and name, workspace details, team memberships, roles, sessions and selected plan. We do not receive your GitHub password.
Testing data: project URLs and configuration, API schemas, routes, dependency versions, supplied test credentials, request results, finding evidence, reports and activity history. Target responses may contain personal data; avoid real customer data unless necessary and authorized.
Support data: subject, message, Telegram username or WhatsApp number, photos and handling history. You can submit a ticket without an account. Connecting personal Telegram alerts stores a chat identifier and delivery preferences.
Technical data: request, error and security-event information. When analytics is enabled, this includes the page or guide visited, referral source, device category, random session identifier and usage events. Server infrastructure may process IP addresses for request delivery and abuse prevention.
3. Purposes and grounds
We process data to fulfil your requests and provide the contracted service: authentication, project management, checks, reports, notifications and support. Necessary information is also processed for security, abuse prevention, mandatory record keeping and protection of rights.
Where applicable law requires consent for specific processing, that processing must be based on such consent. Withholding data necessary for a request may prevent the relevant feature from working. Telegram marketing messages depend on a separate subscription preference that you can disable.
4. Recipients and international processing
Authorized staff and infrastructure providers receive access as necessary to operate the service. GitHub provides sign-in. Queries to vulnerability databases may disclose package names and versions to match known issues.
Submitting a support ticket shares its text, contact and photos with staff in a private Telegram group. Personal notifications also use Telegram when connected. Staff may use WhatsApp to reply if you choose that contact method. These platforms have their own data processing terms.
Paddle processes payment and billing information for Paddle purchases under its own privacy notice. Scantelio does not ask for full card details or CVV in support forms. Do not send them to us.
Providers and communication platforms may process data outside Kyrgyzstan or your country. International-transfer requirements and safeguards depend on applicable law; contact the provider for recipient and processing information. Data may also be disclosed when legally required.
5. Cookies, browser storage and analytics
Session cookies support sign-in and workspace selection. Browser storage remembers interface language and guide referral context. When analytics is enabled, sessionStorage and localStorage hold random session identifiers and information connecting referrals to product usage.
Built-in analytics respects the browser’s Do Not Track setting. Clearing site data may sign you out and reset preferences. Disabling analytics does not prevent you from submitting a support ticket.
6. Retention and protection
Scan-result retention depends on your plan. Built-in analytics events are removed from the working database after 365 days. Account details, support tickets and necessary service records are retained to provide the service and resolve requests; legal duties and protection of rights may also affect retention. Contact the provider to request deletion.
Backups and messages held by external platforms have separate lifecycles; deletion from the primary database does not mean immediate removal of every copy. Uploaded photos are validated and re-encoded with metadata removed. Attachments are restricted to the authenticated ticket author and superadmins; guest attachments are available only to superadmins.
Controls include access restrictions, session protection and encryption of stored integration secrets and test credentials. No system provides absolute protection. Avoid uploading unnecessary secrets and report incidents.
7. Requests and rights
You may request information, access, correction, deletion or restriction of processing, or withdraw consent or object where applicable law provides those rights. Email owner@scantelio.com. We may verify your identity or authority to protect data.
Withdrawal of consent does not invalidate prior lawful processing. Some records may be retained under a binding legal obligation. You may also contact the competent data protection authority. Policy updates are published here with a revised date.
Provider details
Individual Entrepreneur Ostapenko Daniil Viktorovich
Bishkek, Kyrgyzstan
Tax ID: 22207200350494
Registration number: 033-2025-169-2040