Privacy Notice

STEM IT Lab Extension LLC is the data controller for personal data processed through CyberScope. Contact: uzrasyeda@stemitlab.com.

• Account data — email address, password hash, account creation timestamp.
• Authentication data — session tokens; for Google sign-in, your Google email and ID (no other Google profile data).
• Usage data — scan targets you submit, scan results, credit balance, and purchase history.
• Payment data — handled by Paddle. We receive a Paddle customer ID, transaction ID, amount, currency, and refund status. We never receive your full card number.
• Technical data — IP address and request metadata for security and abuse prevention.

• Providing the service (contract).
• Processing payments and preventing fraud (contract, legal obligation).
• Securing the platform (legitimate interests).
• Complying with tax and accounting law (legal obligation).

• Paddle.com Market Limited — Merchant of Record. Processes payments and handles billing, tax, refunds, and invoicing. See Paddle's Privacy Notice.
• Lovable Cloud / Supabase — authentication and database hosting.
• Cloudflare — application hosting and edge runtime.

Account and scan data is retained while your account is active and for up to 12 months after deletion, except where law requires longer (e.g. transaction records for tax: typically 6–10 years held by Paddle).

Subject to applicable law (e.g. GDPR / UK GDPR / CCPA) you have rights of access, rectification, erasure, restriction, portability, and objection. To exercise these contactuzrasyeda@stemitlab.com.

Data may be processed in the EU, UK, and US. Transfers rely on Standard Contractual Clauses or equivalent safeguards where applicable.

We use strictly-necessary cookies for authentication. Paddle may set its own cookies during checkout.

We will post material changes to this notice on this page.