Privacy policy.

Three categories. Optional admin override keys are encrypted at rest with AES-256-GCM and never returned to the browser. Plaintext lives in memory only for the duration of a single scan request. Scan content — the ad copy, image, or video you submit, plus the destination URL on landing-page scans — persists in our database alongside the model verdict, citations, and any drop-in rewrite. Activity logs record events like login, scan, key rotation, export, and account deletion. We hash IP addresses with a server-side salt before storing them, and we truncate user-agent strings at 256 characters.

Each operator picks a retention window for their scan history in Settings. Options: 7 / 30 / 90 (default) / 365 / 3650 days. A nightly purge job deletes scan rows older than the window. The window applies to the entire scan history under your session, not per-scan.

When you self-delete, the account is soft-deleted immediately and you're signed out. A seven-day grace window covers operational recovery in case of mistaken deletion. After seven days the same nightly job hard-deletes the session row, which cascades and removes every scan, feedback row, and stored asset tied to the account. Any encrypted override keys you uploaded are deleted in the same cascade.

Scan content is sent to the LLM provider you select per scan — currently OpenAI (vision + transcription) and Deepseek (text routing). Provider-side retention follows the provider's standard policy at the time of the call. The roadmap item "Zero-retention routing" will add ZDR-enforced endpoints for operators who need provider-side non-retention.

We do not share data with any other third party. We do not run advertising or marketing email. We do not deploy third-party analytics beyond Vercel's built-in request-level telemetry and our own product-internal logging.

You can export every scan and feedback row tied to your account from Settings → Account. The export is a single JSON file and includes the full scan payload plus rule-pack citations and verdict bodies. You can self-delete the account from the same surface; see the retention section above for what happens next.

Questions, requests, or a deletion confirmation: info@wussworldwide.io.