Privacy Policy

Truscan Inc. ("we", "us") operates the Truscan web search API at truscan.co and its subdomains. Our registered address is 111B S Governors Ave # 82225, Dover, DE 19904, United States. For anything in this policy, write to support@truscan.co.

We are the data controller for account and billing information. Where you use the API to process personal data of your own users, you are the controller and we act as your processor. The Data Processing Addendum covers that relationship.

Information you give us when you create an account:

• Your email address and name.
• A password, which we store only as a bcrypt hash. We cannot read it or recover it.
• A profile picture, if you upload one.
• Billing details, handled by our payment processor. We store a customer reference and payment records, never full card numbers.

Information generated as you use the service:

• Request metadata for each API call: the method, path, response status, duration, the source that made the call, your IP address and user agent. We do not store request bodies.
• Nothing else about the call itself. The query you searched, the URLs you extracted, the question you asked and the results we returned are not written to any database. They pass through a cache so a repeated request is free, and that cache expires on its own within seven days.
• API key metadata: a name, a SHA-256 fingerprint and the last four characters. The key itself is shown once at creation and never stored in a form we can reverse.
• Webhook endpoints you configure and a record of each delivery attempt, including the response code and any error.
• Your credit balance and a ledger entry for every charge.

We do not sell personal data, and we do not use your queries or results to train models.

Where we rely on legitimate interests, we have considered whether that interest is overridden by your rights, and you can object at any time using the contact details below.

Retention is enforced automatically by a scheduled delete, not by anyone remembering to run a clean-up. The shortest retention period is the one that applies to what you actually send us, which is none: queries, URLs, questions and results are never written to a database at all.

You can delete your account from the dashboard. It requires your password, and it is not reversible.

When you delete an account, the following happens immediately:

• Your account record, profile picture, API keys and any pending password reset tokens are deleted.
• Your webhook endpoints and their delivery history are deleted.
• Your billing records are purged, except where we are required to keep invoice data for tax and accounting.
• Every API key you held stops working at once.

Request logs are not deleted at that moment. They hold no query text and no request bodies, and are removed automatically within 30 days of their creation whether or not the account still exists. If you need them removed sooner, write to us and we will do it by hand. There is no search history to delete, because none is kept.

We use a small number of sub-processors. Each one receives only what it needs to do its job.

We run our own metasearch node rather than calling a commercial search API. That is a deliberate privacy choice: the upstream engines receive a query and nothing that identifies you.

We will also disclose information where we are legally compelled to, and we will tell you unless we are prohibited from doing so.

We are a United States company and our infrastructure and sub-processors may be located outside your country. Where personal data of individuals in the European Economic Area or the United Kingdom is transferred, we rely on the European Commission's Standard Contractual Clauses and equivalent UK provisions.

Depending on where you live, you have some or all of the following rights. We do not charge for exercising them and we will respond within 30 days.

• Access: ask for a copy of the personal data we hold about you.
• Correction: have inaccurate data fixed. Your name, email and picture are editable in the dashboard.
• Deletion: delete your account, or ask us to remove data ahead of its automatic expiry.
• Portability: receive your data in a machine readable form.
• Objection and restriction: object to processing we base on legitimate interests.
• Withdraw consent: where we rely on consent, withdraw it at any time.

If you are in the European Economic Area or the United Kingdom, you may complain to your local supervisory authority. If you are in India, the Digital Personal Data Protection Act gives you comparable rights, including the right to nominate someone to exercise them on your behalf, and you may raise a grievance with us first at the address above. If you are a California resident, you have the rights to know, delete, correct and opt out of sale or sharing. We do not sell or share personal information as those terms are defined by the CCPA.

• Passwords are hashed with bcrypt at cost 12. They are never stored or logged in plain text.
• API keys and password reset tokens are stored as SHA-256 fingerprints. A stolen database does not yield a usable key.
• All traffic is served over TLS with HSTS enabled.
• Sessions expire after 24 hours. Password reset links expire after one hour or on first use.
• Internal service endpoints are unreachable from the internet and require a separate internal credential.
• Rate limits apply at the edge to slow credential stuffing and abuse.
• Request bodies are never written to logs.

No system is perfectly secure. If you find a vulnerability, report it to us using the contact page and please give us a chance to fix it before disclosing it publicly.

The dashboard sets one cookie, which holds your session so you stay signed in. It is strictly necessary for the service to function and is not used for advertising or tracking. The marketing site sets no cookies and carries no third-party analytics or advertising tags.

The service is not directed at children and is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, tell us and we will remove it.

We will update the date at the top when this policy changes. If a change materially affects how we handle your data, we will email account holders before it takes effect.

Write to support@truscan.co, or to Truscan Inc., 111B S Governors Ave # 82225, Dover, DE 19904, United States. A person reads it.