Privacy Policy

Last updated: 8/10/2025

Effective Date: 8/10/2025

GDPR, CCPA/CPRA, SOC 2 & Global Privacy Laws Compliant

Our Privacy Commitment

At SpamShield ("we," "our," or "us"), we are committed to protecting your privacy and ensuring the security of your personal information. This privacy policy explains how we handle data when you use our SMS scam detection service ("Service"). This policy applies to all users of our Service regardless of location and complies with GDPR, CCPA/CPRA, and other applicable privacy laws.

Legal Basis for Processing (GDPR)

Under GDPR, we process your data based on the following legal grounds:

  • Legitimate Interest: To provide scam detection services and improve security
  • Performance of Contract: To deliver the Service you requested
  • Legal Obligation: To comply with applicable laws and regulations
  • Consent: For optional features and marketing communications (where applicable)

Privacy-First Design

Your messages are analyzed locally in your browser when possible, and never stored on our servers for longer than necessary to provide the analysis.

Information We Process

Messages You Submit

  • Text content of SMS messages you choose to analyze
  • Images of SMS messages you upload (processed for text extraction only)
  • Basic metadata about the analysis (timestamp, processing time)
  • Extracted elements: URLs, phone numbers, brand names (for threat detection only)

Data Retention: Message content is automatically deleted within 24 hours. Anonymized threat indicators may be retained for up to 30 days to improve detection accuracy.

Technical Information

  • Browser type, version, and user agent (for compatibility and security)
  • Device type (mobile, tablet, desktop) and operating system
  • IP address (for rate limiting and security - automatically deleted after 7 days)
  • General location (country/region level only) for compliance and localization
  • Session data: page views, feature usage, interaction events
  • Performance metrics: load times, errors, API response times
  • Referral source and marketing campaign parameters (if applicable)

Analytics Data Retention: Session and analytics data retained for 90 days. Aggregated statistics may be retained indefinitely for service improvement.

Information We DON'T Collect

  • Your name, email address, or phone number
  • Personal account information
  • Precise location data
  • Contact lists or address books
  • Any information from other apps or devices

How We Use Information

Analysis & Protection

  • • Detect spam and scam patterns
  • • Provide safety recommendations
  • • Improve detection accuracy

Service Improvement

  • • Enhance user experience
  • • Fix bugs and errors
  • • Develop new features

Data Retention & Security

Important: No Permanent Storage

Message content you submit is processed temporarily and automatically deleted within 24 hours. We do not build permanent databases of user messages.

Security Measures

  • All data transmission is encrypted using HTTPS/TLS
  • Server access is restricted and monitored
  • Regular security audits and updates
  • No third-party access to your message content

Your Privacy Rights

Your Rights Under Privacy Laws

GDPR Rights (EU/EEA/UK):

  • • Right to access your data
  • • Right to rectification (correction)
  • • Right to erasure ("right to be forgotten")
  • • Right to restrict processing
  • • Right to data portability
  • • Right to object to processing
  • • Right to withdraw consent
  • • Right to lodge a complaint with supervisory authority

CCPA/CPRA Rights (California):

  • • Right to know what data is collected
  • • Right to delete personal information
  • • Right to correct inaccurate information
  • • Right to opt-out of sale/sharing
  • • Right to limit use of sensitive data
  • • Right to non-discrimination
  • • Right to know how long data is retained

How to Exercise Your Rights

To exercise any of your privacy rights, please contact us:

  • Email: privacy@spamshield.tech
  • Web Form: Submit requests at spamshield.tech/privacy-request (coming soon)

Response Time: We will respond to your request within 30 days (or 45 days for complex requests). For CCPA requests, we respond within 45 days with a possible 45-day extension.

Verification Process

To protect your privacy, we may need to verify your identity before processing certain requests. This may include matching information you provide with data we have on file.

Control Your Data

You can use our service without creating an account. Each analysis is independent, and you control what information you choose to submit.

Browser Settings

You can disable cookies and local storage in your browser settings, though this may affect some functionality like remembering your preferences.

Third-Party Services & Data Sharing

We DO NOT Sell or Share Your Personal Information

SpamShield does not sell, rent, or share your personal information with third parties for their marketing purposes. We do not engage in targeted advertising based on your message content.

We use carefully selected third-party services solely to provide and improve our Service:

Infrastructure Providers

  • Vercel: Hosting and edge computing (SOC 2 compliant)
  • Supabase: Database services (GDPR compliant, data encrypted)
  • Cloudflare: DDoS protection and CDN (Privacy Shield certified)

Analysis Services

  • OpenAI: LLM analysis for scam detection
  • Tesseract.js: OCR processing (runs locally in your browser)

⚠️ Important Notice about AI Processing:

  • • Your message content is sent to OpenAI's servers for analysis
  • • OpenAI processes data under their enterprise agreement (not used for model training)
  • • Data is deleted after processing per OpenAI's retention policy
  • • OpenAI is a separate company with its own privacy policy
  • • Never include sensitive information (SSN, passwords, bank details) in messages

Analytics (Optional)

  • Vercel Analytics: Privacy-focused usage statistics (no cookies, GDPR compliant)
  • You can opt-out by enabling "Do Not Track" in your browser

Legal Disclosures

We may disclose information only when required by law, such as:

  • To comply with legal process or government requests
  • To protect our rights, privacy, safety, or property
  • To prevent fraud or cybersecurity threats
  • With your explicit consent

Children's Privacy

Our Service is not directed to children under 16 (or 13 in some jurisdictions). We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately at privacy@spamshield.tech.

International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place:

  • Standard Contractual Clauses (for EU/EEA data transfers)
  • Privacy Shield principles (where applicable)
  • Adequate security measures and encryption

California Privacy Rights

Notice for California Residents

This section applies to California residents under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

Categories of Personal Information We Collect:

  • • Identifiers (IP address, device ID, session ID)
  • • Internet activity (browsing history on our site, interaction with our Service)
  • • Geolocation data (general location only)
  • • Inferences drawn from above to create a profile

Your CCPA Rights:

  • • Right to know about personal information collected, used, and disclosed
  • • Right to delete personal information
  • • Right to correct inaccurate personal information
  • • Right to opt-out of sale or sharing (we do not sell or share)
  • • Right to limit use of sensitive personal information
  • • Right to non-discrimination for exercising rights

To exercise your rights: Email privacy@spamshield.tech

Updates to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. When we make material changes:

  • We'll update the "last updated" and "effective date" at the top
  • We'll provide notice through the Service or via email (if we have it)
  • For material changes, we may request your consent to continue using the Service

We encourage you to review this policy periodically. Your continued use of the Service after changes indicates acceptance of the updated policy.

Contact Us & Data Protection Officer

For privacy-related questions, requests, or complaints:

Contact Information

General Privacy Inquiries:

Email: privacy@spamshield.tech

Data Protection Officer:

Email: dpo@spamshield.tech

Response Time: We typically respond within 2-3 business days. For complex requests, we may need up to 30 days (or 45 days for CCPA requests).

EU/EEA Residents - Supervisory Authority

You have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not complied with applicable data protection laws. Find your authority at:edpb.europa.eu/about-edpb/board/members