Privacy notice

Last updated: 2026-10-14. Magyar változat: Adatvédelmi tájékoztató. Plain-language GDPR notice. Consumer-protection service; not investment advice.

1. Controller

The controller of your personal data is Sánta Gábor, sole proprietor (egyéni vállalkozó) registered in Hungary under the trade name “Proof of Scam”, operated from the Netherlands (Hungarian tax number 92356478-1-43, Hungarian registration number 62784791). As the service is operated by a sole proprietor, no separate company registration number and no statutory DPO are designated. Privacy inquiries: [email protected] (if the linked address does not display — e.g. with JavaScript off — write to: help [at] proofofscam [dot] com). Full registration details: Imprint.

Supervisory authority: You may lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), with the Hungarian supervisory authority, the NAIH (naih.hu), or with the supervisory authority in your country of residence.

Tax jurisdiction: under formal determination. The service is currently provided free of charge (beta); the exact tax and legal implications for a buyer's own jurisdiction are therefore not yet relevant. This question will be resolved before any paid launch. Until then, we make no jurisdiction-specific tax or legal representation.

2. What we collect & why (purpose, legal basis)

Your query (token / company / link you check) — to produce the scan. Basis: contract (providing the service you asked for). Queries about third parties are risk-research data, not marketing data.
Your email — to deliver the scan, run your account (registration, double opt-in confirmation, receipts). Basis: contract; for the optional product-news emails: consent (separate checkbox, withdrawable any time).
Registration metadata — acceptance of terms (what, when), confirmation status. Basis: legal obligation / legitimate interest (proof of consent).
Payment metadata — plan, amount, payment status and the payment reference from Stripe. Your card data goes directly to Stripe; we never see or store card numbers. Basis: contract + legal obligation (accounting).
Technical logs (IP-based rate-limiting, security logs) — to run and protect the service. Basis: legitimate interest.
Beta waitlist & invites. If you apply to the beta waitlist, we process the details you submit (email, optional name, your reason for joining, optional “what you would scan first”) solely to review and rank your application and to send you a personal invite code. Invite codes are single-use, bound to your email address and expire after 30 days; expired or used codes are deleted 30 days later. Waitlist applications are kept until the beta ends or you ask us to delete them ([email protected]). Basis: consent (Art. 6(1)(a) GDPR), withdrawable any time.

We do not sell your personal data. We do not share your data with advertisers except, if you consent to advertising cookies, the measurement data processed through Google Ads as described in section 6. We do not carry out profiling or automated decision-making that produces legal effects concerning you.

Minors: the Service is intended for adults (18+). We do not knowingly process personal data of persons under 18; if we learn that a minor has registered, we delete the account and its data.

3. Processors & recipients

Stripe (payments — independent controller/processor for card data)
Resend (transactional email delivery) and Google (Google Workspace / Gmail) (mailbox for support/privacy contact)
Cloudflare (hosting/CDN, edge API, DNS)
Google (Google Analytics / Google Ads) — only if you consent to analytics/advertising cookies (section 6): website measurement and, where enabled, advertising.

We share data with authorities only when legally required.

4. International transfers

Our processors (Stripe, Cloudflare, the email provider) may process data outside the EEA (typically in the US) under the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework, per their DPAs.

5. Retention

Free scan requests: kept while needed to deliver + improve the library, then deleted or anonymised.
Account data: while your account exists; deleted on account deletion (except what we must keep by law).
Payment records: retained for the statutory accounting retention period applicable to the operator (currently under determination).
Beta test data may be reset — see the Beta terms.

6. Cookies and analytics

By default we do not set advertising or analytics cookies. Under Google Consent Mode v2, analytics and advertising consent is denied by default, so no Google Analytics or Google Ads cookies are placed until you allow them in our cookie banner. If you accept, we load Google Analytics (GA4) and/or Google Ads, which may then set analytics and advertising cookies and share the related measurement data with Google; you can change or withdraw your consent at any time in the cookie settings, and withdrawal does not affect processing already carried out. Independently of your choice, we use only functional local storage (your language, and your email address if you tick "remember me"), which is kept in your browser and is not sent to us until you submit a form.

7. Your rights (GDPR)

Access, rectify, delete, or receive a portable copy of your data; restrict or object to processing based on legitimate interest.
Withdraw consent (e.g. unsubscribe) any time — it doesn't affect prior lawful processing.
Complain to a supervisory authority (in the Netherlands: Autoriteit Persoonsgegevens — autoriteitpersoonsgegevens.nl; in Hungary: NAIH — naih.hu; or the authority of your country of residence).

Requests: [email protected] (JS-off fallback: help [at] proofofscam [dot] com) — we answer within 30 days.

8. Security

Password protection: login works with either a password or a one-time email link (magic-link). Passwords are never stored in plaintext — only hashed with PBKDF2 and a unique per-user salt, so the stored value cannot be reversed to your password.
Encryption in transit: all traffic is served over HTTPS/TLS.
Session security: sessions use HttpOnly, Secure cookies; login links are single-use and expire in 15 minutes.
Per-user access control: your library (your scans and orders) is scoped to your account on the server side — other users cannot access it.
Operator access: the operator (the data controller) can access user data where necessary to run and support the service. Administrative access is restricted to designated admin accounts, enforced server-side and audit-logged.
No method is 100% secure, but we apply these technical and organisational measures to protect your data.

Consumer-protection information — NOT investment advice. We publish sourced, evidence-driven risk information; a “red flag” is not proven fraud.