Privacy Policy

This policy explains how Ishai Zaffran (Israeli sole proprietor), doing business as ScanMeridian ("ScanMeridian", "we", "us") handles personal information when you visit our website, request a free snapshot, or buy one of our products. We are the controller of this information.

We process personal information under Israel's Protection of Privacy Law, 5741-1981, including Amendment 13. You can complain to the Israeli Privacy Protection Authority, or to the data protection authority where you live.

Questions about this policy go to [email protected]. We have not appointed a data protection officer.

What we collect

When you request a free snapshot

• The website address you enter.
• Your email address.
• Your confirmation that you want the snapshot emailed to you and agree to this policy.
• The date and time of your request.
• A one-way hash of your IP address, kept for one hour to limit repeat submissions. We do not store the IP address itself.

The form includes a hidden spam-trap field. We discard any request where it is filled in.

Our snapshot form uses Cloudflare Turnstile to block automated abuse. Cloudflare processes your IP address and device and browser signals for this check, under its Turnstile Privacy Addendum. Lawful basis: our legitimate interest in keeping the service secure (Art. 6(1)(f)). If you cannot complete the check, email [email protected] and we will send your snapshot.

When you buy a product

Paddle runs our checkout and collects your payment details. Paddle shares with us the information we need to deliver your order, such as your name, email address, country, the product you bought, and the amount paid. We never see or store your full card number.

When we scan your website

Our automated tools load the public pages of the website you ask us to check, the way a browser does. If those pages show personal information, such as a staff name on a contact page, it may appear in the scan data. We use page content only to produce your report.

When you email us

We keep your message, your email address, and anything you choose to include.

Technical logs

Our hosting provider, Cloudflare Pages, records standard server logs when you load a page. These logs can include your IP address, browser type (user agent), the page requested, and the time.

Cookies and analytics

We do not use analytics tools, advertising trackers, or non-essential cookies. If we add analytics later, we will update this policy first and ask for your consent through a cookie banner where the law requires it. Paddle's checkout may set its own cookies when you open it. Paddle's privacy policy covers those. Cloudflare Turnstile may use browser storage for the bot check; see its privacy addendum.

How we use it

• To run the scan you asked for and email you the snapshot or report.
• To process orders, deliver paid products, and handle subscriptions, refunds, and support.
• To answer your questions.
• To keep the site secure and block spam and abuse.
• To keep business, tax, and accounting records the law requires.
• To send marketing emails, only if you have opted in to receive them.

Requesting a free snapshot does not add you to a marketing list. You need to give us your email address to receive a snapshot or a paid report, because that is where we send it. We do not make automated decisions about people that have legal or similarly significant effects.

Emails we send

We send the snapshot or report you requested and messages about your orders. Marketing emails go only to people who have agreed to receive them. Every marketing email includes our postal address and an unsubscribe link, and we process unsubscribe requests within 10 business days. You can also unsubscribe by emailing us.

Lawful bases for visitors in the EU and UK

If the GDPR or UK GDPR applies to you, we rely on these lawful bases:

• Contract (Art. 6(1)(b)): running the snapshot you request, delivering paid products, managing subscriptions, and answering support requests.
• Legal obligation (Art. 6(1)(c)): keeping tax and accounting records.
• Legitimate interests (Art. 6(1)(f)): keeping the site secure, blocking spam (including the Cloudflare Turnstile check on our snapshot form), keeping server logs, and processing any personal information that appears on the public pages we scan for you. Our interest is running a safe and working service. You can object to this processing at any time.
• Consent (Art. 6(1)(a)): marketing emails, and any analytics we add later. You can withdraw consent at any time.

Who we share it with

We share personal information only with service providers who help us run ScanMeridian:

• Paddle, our merchant of record. Paddle sells our products to you, processes payments, handles tax, and manages subscriptions and refunds. Paddle acts as an independent controller for checkout and payment data under its own privacy policy.
• Cloudflare (Pages hosting and the D1 database where we store snapshot requests) and Resend (email delivery) act as our processors under data processing agreements.

We may also disclose information if the law requires it, to protect our rights or someone's safety, or as part of a merger or sale of our business. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

How long we keep it

• Snapshot requests and lead details: 12 months after the request, to prevent abuse and duplicate requests, then deleted automatically.
• One-time reports: 90 days after delivery, or until your re-scan is complete, whichever is later.
• Monitoring results: while your subscription is active and for 90 days after it ends.
• Order and tax records: as long as tax and accounting law requires.
• Emails with us: as long as we need them to help you, then deleted with the related records.
• Server logs: according to Cloudflare Pages's log retention settings.

Security

We use HTTPS to protect data in transit and limit access to the people who need it to run the service. No system is perfectly secure. If a breach affects your personal information, we will notify you and the authorities as the law requires.

Your rights

Wherever you live, you can ask us to:

• Tell you what personal information we hold about you and give you a copy.
• Correct information that is wrong.
• Delete your information, unless we must keep it by law.
• Stop sending you marketing emails.

California residents

Under the California Consumer Privacy Act, as amended by the CPRA, you have the right to know what personal information we collect, use, and disclose, and to ask us to delete or correct it. In the past 12 months we have collected these categories:

• Identifiers, such as your email address, name, and IP address.
• Commercial information, such as products you bought.
• Internet activity, such as server log entries.

We collect them from you, from Paddle, and from our hosting logs, for the purposes listed in "How we use it" above. We disclose them to the service providers listed above for business purposes. We do not sell or share personal information, and we do not use or disclose sensitive personal information to infer characteristics about you. If that ever changes, we will update this policy first and honor Global Privacy Control signals as opt-out requests. We will not treat you differently for using your rights. You may use an authorized agent, and we may ask the agent for proof of your permission.

EU and UK residents

You also have the right to restrict processing, to object to processing based on legitimate interests, to receive your data in a portable format, and to withdraw consent at any time. Withdrawing consent does not affect processing that happened before. You can complain to your local data protection authority, and we would welcome the chance to help first.

How to make a request

Email [email protected] from the address you used with us, or tell us which address it was. We may ask for more information to confirm your identity before we act. We respond within 45 days for California requests and within one month for EU and UK requests. If we need longer, we will tell you why.

Children

ScanMeridian is a service for businesses. It is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us information, email us and we will delete it.

International transfers

We are based in Israel. Our providers (Cloudflare, Resend and Paddle) process data in the United States and other countries. The European Commission recognizes Israel as providing adequate protection for personal data, and confirmed this in January 2024, so transfers from the EU to us in Israel need no extra safeguards. When our US providers receive your data, we rely on the European Commission's Standard Contractual Clauses, the UK addendum, or the EU-U.S. Data Privacy Framework where the provider is certified. You can ask us for details.

Changes to this policy

When we change this policy, we will update the date at the top of this page. If a change materially affects how we use your information, we will email customers before it takes effect.

Contact

Ishai Zaffran (Israeli sole proprietor), doing business as ScanMeridian
19 Tel Chai St, Ashdod 7751019, Israel
[email protected]