Privacy Policy

What we collect

• Account data: Name, email address, phone number, company name, and GSTIN (if provided) for account creation and GST-compliant invoicing.
• Gmail metadata: Sender addresses, subject lines, and header fields. During scanning, message body text is analysed in memory and discarded immediately after classification; it is not collected or stored, and attachments are not accessed — neither their contents nor their file names. If you choose to report a message, we re-fetch the complete message, including its body and attachments, to build a cybercrime evidence pack.
• Universal Scanner submissions: Text, URLs, UPI IDs/VPAs, payment screenshots, and voice/audio clips you submit for analysis.
• WhatsApp submissions: Messages and media forwarded to our scan number.
• Threat detection output: Detected threat categories, confidence scores, indicator-of-compromise (IOC) URLs, and timestamps, stored per-customer in an encrypted database. Ninety days after detection, links on threat records are reduced to the website’s host name.
• Usage and security data: Sign-in records (IP address and browser), an audit log of account and security actions (with the IP address and browser used), and product-usage analytics linked to a pseudonymous account ID.

Email data handling

We connect to Gmail via secure sign-in using a single read-only scope, gmail.readonly, which does not allow us to send, change, or delete your email. We use the Gmail History API for incremental synchronisation, accessing only what has changed since the last scan rather than your full inbox history.

The email body is processed in memory at scan time to detect fraud indicators and is discarded immediately after classification; scanning never writes it to disk or database. The only exception is a message you choose to report, which is re-fetched for a cybercrime evidence pack as described below. The subject line and a masked version of the sender's email address are retained for up to 90 days so you can locate and verify a flagged message in your own mailbox.

Cybercrime Evidence Pack

When you choose to report a fraudulent email, we will re-fetch that message from your connected Gmail mailbox at that time to generate a cybercrime evidence pack. We do not retain the raw email content except inside the finished pack. The pack includes full email headers, sender authentication results (SPF/DKIM/DMARC), a rendered copy of the message, attachments, and the original .eml file. We retain the finished evidence pack for up to 12 months from creation (with an optional one-time extension to 24 months if you indicate an ongoing case), after which it is deleted.

If you request a Section 63 certificate, a designated ScamShield reviewer will read the contents of your evidence pack, including the original email, before approving or rejecting the certificate. This human review occurs only when you request a certificate and provide explicit consent in the portal. No additional retention applies — the same 12-month (with optional one-time extension to 24 months) window applies to the finished pack.

The reviewer’s decision on your request (who decided, when, and the outcome — not the contents of the pack) is kept in our audit log until you delete your account.

Vendor payment fraud detection

ScamShield AI helps our customers detect a common fraud pattern in which a criminal impersonates a known supplier and requests payment to a new, unfamiliar bank account. To provide this service, we process bank account and UPI identifiers that appear in correspondence our customers choose to route through our platform, in their capacity as the party responsible for that business relationship.

How this data reaches us: This data reaches us automatically, when our email scanner reads a low-risk message from a vendor that mentions a bank account number or UPI ID, as part of correspondence our customer has authorised us to scan. This currently happens for Gmail mailboxes only (Zoho Mail is coming soon).

How this data is processed: For vendor matching, we convert the account number or UPI ID into a one-way fingerprint (a salted hash) and store only that fingerprint, linked to the vendor's email domain. A fingerprint is deleted 12 months after we last see that account. The fingerprint is not the only place such a number can appear while we provide the service:

• Text submitted to the ScamShield scanner is kept with that scan and cleared after 7 days.
• Email alert records keep the sender and the subject line for 90 days. After that, the sender is reduced to its domain (for example, @example.com) and the subject line is removed. An alert about a change to a supplier's payment details that has not yet been acknowledged is kept in full until it is acknowledged, and for no longer than 12 months. The risk score, category and our analysis of the message stay with the alert until your account is deleted.
• Text read from payment screenshots you scan, including any transaction ID, is cleared 7 days after the scan.
• If you generate a cybercrime report, the copy of the email and the report file are stored encrypted, as is any payment account number you enter for a transaction, of which only the last four digits are shown back. The email's subject line and any notes you type into the report are stored as entered. Reports are deleted after 12 months, or 24 months if you extend them.

What this feature does and does not do: We use these fingerprints to notice when a vendor asks to be paid into an account we have not seen that vendor use in the customer's earlier email. We do not verify with any bank, the NPCI, or any government registry that an account belongs to a real or legitimate business. Not having seen an account before does not mean it is unsafe, and having seen it before does not mean it is safe. It is one signal for the customer to weigh alongside their own verification, not a substitute for it.

Our role and our customer's role: ScamShield AI processes this data on the instructions of, and as a service to, the business customer using our platform. Our customer is responsible for ensuring they have an appropriate basis for processing their own vendor's payment information as part of their ordinary business correspondence, in the same way they would when using accounting, invoicing, or email software. Where a vendor's bank account belongs to an individual rather than a registered business, we apply the same safeguards described in this section as a matter of our own data handling standard, regardless of whether that data falls within the technical scope of applicable law.

Screenshot, UPI, and voice data handling

• Payment screenshots: Submitted images are processed for forensic analysis (Error Level Analysis, OCR, metadata checks). The extracted OCR text, including any transaction ID, is cleared 7 days after the scan. The image is retained as part of your account data for as long as your account remains active, and is permanently deleted (including the underlying image file) if you delete your account via Settings, or by emailing us to request deletion (see “Your rights under DPDP Act 2023” below).
• UPI IDs / VPAs: When a scan produces a fraud verdict, the submitted VPA is added to our shared fraud-reputation database, which benefits all customers by improving detection across the network. If you submit a data deletion request, the link between your account and any VPA you submitted is permanently removed; the VPA and its fraud signal remain in the shared reputation database in anonymised form, no longer traceable to you.
• Voice/audio clips: Submitted for synthetic-voice and digital-arrest-scam detection. The audio file exists only temporarily during processing and is deleted immediately after a result is returned, whether the scan succeeds or fails. As a safeguard, an automated hourly process also removes any temporary audio file that may remain due to an unexpected error. No audio recording is stored as part of your account data.

You can delete your account and all associated data at any time from Settings → Profile → Danger zone, or by emailing privacy@scamshieldai.in. Self-serve deletion is processed within 15 minutes, and you can cancel during that time; email requests are processed within 30 days. See “Your rights under DPDP Act 2023” below.

WhatsApp data handling

Messages and media forwarded to our WhatsApp scan number are processed to detect fraud. Message content (text and media) is not persisted after scanning. Sender phone numbers are stored in hashed form only, never in plaintext. We connect directly to Meta's WhatsApp Business Platform API. No third-party Business Solution Provider is used.

By forwarding a message to our WhatsApp number, you consent to that message being processed as described here and in accordance with WhatsApp's own Business Terms.

Vendor payment fraud detection, described above, currently applies to correspondence processed through our email scanning service. Payment identifiers in messages forwarded via WhatsApp are not currently included in this vendor-matching process.

Dark web monitoring and team breach check

Dark web monitoring: from the Dark Web screen you can add details you want monitored, such as email domains, GSTINs, company and executive names, UPI IDs, phone numbers, PANs and bank account numbers. We store what you add with your account until you remove it or delete your account. To confirm you control an email domain, we send a verification email to an address at that domain. No breach-intelligence provider is currently connected, so no monitoring scans are running; the Dark Web screen says so.

Team breach check (preview): an account administrator can check one team member’s email address at a time against XposedOrNot, an external service provider. The notice shown before each check reads: “By clicking Check, you consent to ScamShield sending the selected team member's email address to XposedOrNot, an external service provider, solely to check whether that email address appears in known data breaches. Only the address is sent. This lookup is optional. You may withdraw consent or request access, correction, or erasure of your personal data by contacting ScamShield at privacy@scamshieldai.in.” No breach result is stored by us — only a record that the check was authorised.

Google API Services User Data Policy

ScamShield AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Gmail data for advertising, do not transfer it to third parties except as necessary to provide the service (see Sub-processors below), and do not allow humans to read it except in the narrow circumstances Google's policy permits (e.g. with your consent, for security purposes, or to comply with law). When you ask us to create a cybercrime evidence pack, the message is re-fetched from Gmail and kept only inside that pack, for you to download and use in your complaint; it is not used for any other purpose, and it is deleted when the pack's retention period ends. Since 3 October 2026, data obtained through Gmail is not used to retrain our shared fraud classifier.

How we use data

• To provide real-time fraud detection and threat alerts
• To generate GST-compliant invoices for paid accounts
• To send transactional emails and WhatsApp alerts (threat alerts, invoices, account notifications)
• We never sell, share, or license your data to third parties for their own purposes

Sub-processors and data sharing

We use the following third parties to operate the service. None of them are permitted to use your data for any purpose other than providing their service to us.

Our website and customer portal serve their own fonts, so no font requests go to Google from scamshieldai.in or app.scamshieldai.in.

AI model providers, as of 7 October 2026: most of our fraud detection runs on our own models, on our own infrastructure. Where our own models need a second opinion, the text of the message being scanned may be sent to Anthropic (Claude API) for an automated review, with direct identifiers automatically masked first (see “Third-party AI processing” below). Anthropic processes this text outside India. Between 17 and 29 September 2026 we also tested Google’s Gemini AI (Vertex AI) as an additional second opinion on masked email text. That processing took place in Google’s Mumbai (India) region. Gemini is now switched off and is not in use. We do not send customer scan content to any other AI model provider. We will not turn on any new AI processing of customer content without first telling our customers and completing a data protection impact assessment and a review of the provider’s terms. By “telling our customers” we mean all three of the following, at least 14 days before the new processing starts: (a) an email to every company administrator naming the provider, what is sent to it, where it is processed and how to object; (b) an updated version of this policy with a new consent version, so that every user accepts it again; and (c) a notice in the customer portal until each administrator has seen it.

Third-party AI processing

As of 7 October 2026. When our primary detection engine cannot confidently classify a message, and when it confirms a message is fraudulent but cannot determine its type, the message content is sent to Anthropic PBC's Claude API for an additional automated review. Before anything is sent, direct identifiers in the text are automatically masked: email addresses, phone numbers, UPI IDs, GSTIN and PAN values, bank-account-length digit runs, exact monetary amounts, personal names where detected, and the path portion of web links are all replaced with placeholders. What remains is the message text needed to judge the scam pattern — for email, the subject line and message body; for WhatsApp, the forwarded message; for the scanner, the text you paste or the text extracted from an image or PDF you upload. Sender email addresses, your account identity, and your company details are not included. This content is processed in memory for the duration of the review and is not stored by us as part of it.

We use Anthropic's standard commercial API. Under Anthropic's published commercial terms, content sent for this review is not used to train their models, and inputs and outputs are automatically deleted from their systems within 30 days, except where longer retention is required by law or by Anthropic's own trust-and-safety processes. We have not entered into a zero-data-retention arrangement with Anthropic; if we do, we will update this policy to say so.

Component D — Anthropic (Claude)

For fraud detection, we may use AI/ML tools, including Anthropic's Claude, to analyze scan content (message text and metadata). Anthropic may process this data in the United States, Europe, Asia or Australia, and stores it in the United States. If content is flagged for safety review, Anthropic may retain it for up to two years, and in rare cases longer where required for legal, safety, or enforcement purposes. Anthropic's commercial terms do not allow it to train its models on this content. We rely on contractual and technical safeguards with Anthropic to protect this data. For details, see Anthropic's Commercial Terms of Service and Data Processing Addendum.

While message content sent to Anthropic for analysis is not stored by us, we retain the resulting fraud assessment for up to 90 days. A short explanation derived from it may be kept with the related threat alert or scan result for as long as that record is retained. (Demo/test accounts may retain masked message text for up to 90 days for internal testing and demonstration purposes.)

Gemini (Google) — tested, now switched off

Between 17 and 29 September 2026 we tested Google’s Gemini AI (Vertex AI) as an additional second opinion. For emails scanned from connected Gmail accounts, the subject line and message text were sent to Gemini after automatic masking of identifiers. That masking was less complete than the masking described above for Anthropic: for example, one-time codes and some personal names were not masked, and, before 27 September 2026, amounts were not masked. Gemini’s answers were only logged so we could evaluate them; they did not change any scan result. This processing took place in Google’s Mumbai (India) region. Google may keep what was sent during the test for up to 90 days under Google’s current terms (checked on 5 October 2026), to detect abuse. We switched Gemini off on 29 September 2026, and it is not in use. For details, see the Google Cloud Privacy Notice and Vertex AI data residency documentation.

Storage & data residency

All production data is stored on Azure Central India (Mumbai). Some of our service providers process personal data outside India: for example, the second-opinion AI fraud review described under Sub-processors, where the message content being scanned — with direct identifiers automatically masked — is sent to Anthropic (Claude API) for processing in the United States, Europe, Asia or Australia, and transactional email delivered via Resend, which maintains a published Data Processing Addendum (resend.com/legal/dpa) and is certified under the EU-US Data Privacy Framework. The sub-processor table lists every provider, what it receives, where it processes data and when. Website analytics (PostHog EU Cloud and Google Analytics) runs only if you switch on Performance cookies. During the Gemini test described above (17 to 29 September 2026, now switched off), processing took place in India.

Your rights under DPDP Act 2023

You have the right to:

• Access: Request a copy of all personal data we hold about you
• Correction: Correct inaccurate personal data
• Erasure: Request deletion of your account and all associated data
• Nomination: Nominate a person to exercise your rights in case of death or incapacity
• Grievance: File a complaint with our Data Protection Officer / Grievance Officer

To exercise these rights, use the account deletion option in Settings, or email privacy@scamshieldai.in for any other request. We will acknowledge grievances within 48 hours and resolve them within 30 days as required under the DPDP Act 2023.

Retention periods

• Account data: kept until you delete your account. We do not currently delete an account automatically when its subscription ends
• Threat detection records (category, risk score and detection signals): kept while your account is active and deleted when you delete your account. Ninety days after detection, the message-specific content on them is removed: links are reduced to the website’s host name, the sender’s display name is removed, and notes from our AI review are removed
• Audit logs (account and security actions, with the IP address and browser used): 12 months. Two kinds of record are kept longer: the record that an account deletion was carried out (see below), and decisions on Section 63 certificate requests, which are kept until you delete your account
• Email threat identifiers (the subject line and masked sender on a threat record): 90 days, then deleted. We keep the message's technical ID (a reference assigned by your email provider, which does not reveal its content) with the threat and alert records until you delete your account, so the same message is not flagged twice
• Email alert detection results (the full result on an email alert: category, risk score and the signals that triggered it): kept while your account is active
• Email alert sender and subject line: 90 days, then the sender is reduced to its domain and the subject line is deleted; an unacknowledged alert about a change to a supplier's payment details is kept in full until it is acknowledged, for no longer than 12 months; in the record of who acknowledged such an alert, the supplier's email address is reduced to its domain after 90 days
• Sign-in records (IP address and browser): 12 months, and deleted when you delete your account. We do not look up the location of a sign-in; records made before 28 September 2026 may include an approximate city and country until they are deleted
• Internal activity records (events such as sign-ups, invitations and connected mailboxes, which can include an email address): 12 months, and deleted when you delete your account; records of changes we make to your plan are kept while your account exists
• Dark web monitoring: details you add are kept until you remove them or delete your account; if an alert is ever raised, its description and the masked address it names are removed 90 days later
• Cybercrime evidence packs (including the re-fetched message, its .eml file, and any transaction details you enter): 12 months from creation, or 24 months if you extend it for an ongoing case; then automatically and permanently deleted
• Text read from payment screenshots (OCR text and transaction IDs): 7 days after the scan, then automatically cleared
• Screenshot images and UPI/VPA records: retained for the duration of your active account; deleted (or anonymised, for VPAs, to preserve shared fraud-detection value) upon a verified data deletion request
• Voice/audio clips: temporary only, deleted immediately after processing; never persisted as part of your account data
• WhatsApp message content: not retained. WhatsApp enrollment metadata (name, email): currently retained indefinitely; a defined retention schedule for this is planned

Vendor payment fingerprints (hashed, non-reversible) are deleted 12 months after we last see the account in a vendor’s correspondence, and earlier on request.

You may delete your account and associated data at any time from Settings, or by emailing the contact below. Deletion requests are processed across all systems, including the Universal Scanner, within 15 minutes for self-serve requests (you can cancel during that time) or within 30 days for email requests.

What we keep even after you request deletion, and why

The DPDP Act 2023 does not require us to delete data where retention is necessary to comply with another law, or to establish, exercise, or defend a legal claim. Consistent with this, the following records survive a deletion request:

• Invoices and GST-related financial records, retained as required under the Companies Act 2013 and applicable GST law
• Records of your consent (which version of our terms and this policy you accepted, when, and from which IP address). They are kept after deletion as proof of consent, so that either party can establish what was agreed if a dispute arises. We are setting a fixed retention period for these records and will state it here
• Correspondence directly tied to an active or resolved legal or billing dispute, retained until the applicable limitation period for that claim has passed
• A record that a deletion request was made and processed (who, when, what was purged); this record is kept permanently, so we can demonstrate compliance with this policy and the DPDP Act if required

The following records are also not removed by an account deletion today. We have not yet set a deletion schedule for them; when we do, we will state it here:

• WhatsApp sign-up leads: the company name and email address you gave when asking about ScamShield on WhatsApp, and your phone number in hashed form
• WhatsApp verdict explanations: the short explanation sent with a WhatsApp verdict
• Login and blocked-attempt records kept for security: the email address used and the IP address of sign-in attempts and blocked attempts
• Error logs, which can contain an email address
• Expired security tokens (for example, used or expired password-reset and email-verification links), stored as a hash and linked to the user

Everything else, including screenshots, OCR text, voice recordings, WhatsApp content, Gmail-derived metadata, your sign-in history, dark web monitoring details, and cybercrime evidence packs, is deleted in full, not merely marked inactive. UPI/VPA records are anonymised rather than deleted outright, as described above.

Cookies and similar technologies

We use a small number of cookies and browser-storage entries on our website (scamshieldai.in) and in the customer portal (app.scamshieldai.in). Optional ones stay off until you switch them on, and you can change your choice at any time using the shield button at the bottom-left of every page. Each site remembers its own choice, so the portal asks separately.

Strictly necessary (always on)

• ss_cookie_consent_v1 (your browser’s local storage): remembers your cookie choice and the date you made it. It is not sent to us.
• cf_clearance (cookie set by Cloudflare on scamshieldai.in and its subdomains): shows that your browser passed Cloudflare’s security check, so you are not asked again. Not readable by our pages’ scripts.
• Portal sign-in entries in your browser’s local storage: keep you signed in (portal_access), carry you through account setup until it is finished (portal_partial), and, if you tick “trust this device”, remember your email address and a device token for 14 days (portal_device_trust). Signing out removes portal_access and portal_device_trust.

Performance (off unless you switch it on)

• PostHog product analytics (EU host, eu.i.posthog.com): only page views and a few site actions, such as opening the trial form. No autocapture, no surveys and no performance measurements; we do not attach your name or email to these events on the public site. Session recording and heatmaps are switched off. In the customer portal, events are linked to a pseudonymous account ID. Stores ph_* cookie and local-storage entries for the site you are on only; they are not shared between scamshieldai.in and app.scamshieldai.in.
• Google Analytics (G-XYLLX8P10M): aggregate traffic measurement. Sets _ga and _ga_* cookies for scamshieldai.in only; they are not shared with app.scamshieldai.in. When you switch Performance cookies off, Google Analytics stops and these cookies are deleted.

Functional and marketing

• We do not currently use any functional or marketing cookies. These switches exist so you can set your choice in advance; if we ever add such tools, they will stay off unless you have opted in.

Data breach notification

In the event of a personal data breach that is likely to result in harm, we will notify affected customers and, where required, the Data Protection Board of India, without undue delay and in accordance with the DPDP Act 2023 and applicable rules.

Contact our Data Protection Officer / Grievance Officer

Darshil Thummar, Co-Founder & CTO
ScamShield AI Private Limited, 32, Bhaktinandan Shopping, Bapasitaram Chowk, Krishnanagar, Ahmedabad 382345, Gujarat
Email: privacy@scamshieldai.in  ·  Phone: +91 87587 32504