Zeplik, Inc. ("Zeplik," "we," "us," or "our"), a Delaware C-Corporation, operates the IsThisAScam platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, API, browser extension, and related services. Please read this policy carefully. By accessing or using the Service, you agree to the practices described herein.
When you create an account, we collect your email address and, if you choose to sign in via a third-party provider, the basic profile information provided by that service (such as your name and profile picture). If you subscribe to a paid plan, your billing information (including payment card details) is collected and processed directly by Stripe; we do not store your full card number on our servers.
When you use the Service to analyze a URL, email, text message, phone number, or other content (collectively, "Submitted Content"), we process that content to provide our scam-detection analysis. Submitted Content may include URLs, email headers and bodies, sender addresses, phone numbers, and message text.
We automatically collect certain technical information when you access the Service, including your IP address, browser type and version, operating system, referring URL, pages visited, timestamps, and device identifiers. This information helps us maintain security, diagnose issues, and improve the Service.
We use strictly necessary cookies to maintain your session and authentication state. We may also use analytics cookies to understand how the Service is used. You can control cookie preferences through your browser settings. We do not use advertising or tracking cookies.
We want to be transparent about what we do not collect or store:
We use the information we collect for the following purposes:
We share information with the following third-party service providers, each of which has its own privacy policy governing its use of data:
Payment processing for subscription plans. Receives card details, billing address, and email to process transactions. We never store your full card number. PCI DSS Level 1 certified.
AI-powered scam analysis. Submitted content portions may be sent to Anthropic's API for advanced natural language analysis. Processed under our DPA, not used to train their models.
URL reputation checking. URLs may be checked against Google's Web Risk database to identify known phishing, malware, and social engineering threats.
Malware and threat intelligence. URLs and file hashes may be submitted for cross-referencing against multiple security vendor databases. Note: content may be shared with VirusTotal's security partners.
Product analytics and session replay to understand how the Service is used and improve it. Receives usage events and metadata (such as scan verdict, score, and type) — never the content you paste. Session recordings mask all input fields, so pasted text is never captured.
We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We may share aggregated, de-identified data that cannot reasonably be used to identify you.
Our Chrome extension ("IsThisAScam — Scam & Phishing Detector") accesses email content and webpage text solely for scam detection purposes. Specifically:
We retain your information only for as long as necessary to fulfill the purposes described in this policy:
When data is no longer needed, it is securely deleted or irreversibly anonymized.
Depending on your jurisdiction, you may have the following rights regarding your personal data:
Our legal bases for processing under the GDPR include: performance of a contract (providing the Service), legitimate interests (security, fraud prevention, service improvement), and consent (where applicable).
To exercise any of these rights, please contact us at [email protected]. We will respond to verified requests within 30 days (or sooner where required by law).
The Service is not directed to children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children under these ages. If we become aware that we have collected personal information from a child under the applicable age, we will take steps to promptly delete that information. If you believe a child has provided us with personal data, please contact us at [email protected].
Zeplik, Inc. is based in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. We ensure appropriate safeguards are in place for international transfers, including Standard Contractual Clauses (SCCs) approved by the European Commission where required, and we comply with applicable data transfer frameworks.
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will notify you by posting the updated policy on the Service with a revised "Last updated" date. For significant changes, we will provide additional notice, such as an email notification or a prominent banner on the Service. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: