Privacy Policy – ActScan

Last updated: 7 August 2026

This Privacy Policy explains how E Industries LLC (“we”, “us”, “our”) collects, uses and protects personal data when you use ActScan (actscan.app). We are committed to the principles of the EU General Data Protection Regulation (GDPR) and other applicable privacy laws.

1. Who We Are

Data controller:

E Industries LLC

30 N Gould St, Ste N

Sheridan, WY 82801, USA

Email: support@e-industries.ai

If you have questions about your data or wish to exercise your rights, use that email address.

2. What Data We Collect

We collect only the minimum data needed to provide the service.

Information you give us directly

• Email address when you request a scan report by email, ask to be notified when we can complete an analysis, or purchase the Remediation Kit. The email is used solely for delivering the report or kit and transactional messages.
• URL you submit for scanning. The URL is processed in real time to produce the report.

Information collected automatically

When you visit actscan.app, our web server may log standard technical data (IP address, browser type, referring page, timestamp). These logs are kept for security and diagnostic purposes only and are not merged with your scan data.

We do not use cookies or third‑party trackers on actscan.app. The site is static and does not set any tracking cookies. If we ever add analytics in the future, we will update this policy and offer a cookie preference tool.

3. How We Use Your Data

• Email address: To send you the digital kit you purchased and to contact you about your purchase if needed (e.g., delivery issues, important policy changes). We do not send marketing emails unless you separately opt in.
• Submitted URL: To perform the automated scan and generate the report. The URL is not stored after the report is generated unless we need to keep it for a short debugging period (see Retention).
• Server logs: For monitoring system health, preventing abuse, and improving service security.

We process your information under the following legal bases:

• Performance of a contract (email for kit delivery, scanning a URL you voluntarily submit).
• Legitimate interests (server logs for security, minimal debugging data to keep the service running).
• Consent where required by law – for example, if we ever send marketing emails, we will rely on your explicit consent.

4. Data Storage and Security

Your email address is stored as a cryptographic hash (SHA-256) alongside the delivery record, so the raw address is not readable in our ledgers.

All personal data we hold is kept on servers located in the United States. Where we transfer personal data from the EU to the US, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by additional technical measures (e.g., encryption at rest and in transit). You may request a copy of the relevant safeguards by emailing us.

We implement reasonable technical and organisational measures to protect your data against accidental loss, unauthorised access, alteration or disclosure. No security system is perfect, but we regularly review our protections.

5. Who We Share Data With

We do not sell, rent, or trade your personal data. We share information only in these limited situations:

• Payment processor: Our payment partner receives your email and payment details to complete the transaction. The processor is contractually bound to handle your data in compliance with GDPR (as our processor) and may not use it for any other purpose.
• Email delivery service: We use a transactional email provider to deliver the kit. They receive your email address and the kit content; they act as a data processor.
• Legal requirements: We may disclose data if required by law, court order, or to protect the rights, property or safety of E Industries LLC, our users, or the public.

We do not allow any processor to use your personal data for their own purposes.

6. Data Retention

• Email hash and order record: Retained for the duration of our business relationship plus six years to comply with tax and accounting obligations.
• Scanned URL and report: The URL and the resulting report are automatically deleted from our active systems within 30 minutes after the scan is performed. During that time, the report is accessible only to you via a temporary session identifier. We do not keep a long‑term copy of your scan results.
• Server logs: Retained for a maximum of 90 days.

If we ever retain data longer (e.g., for legal disputes), we will protect it with the same safeguards and delete it as soon as the reason for extended retention ends.

7. Your Rights Under GDPR

If you are in the European Economic Area, you have the following rights regarding your personal data:

• Access: You can request a copy of the data we hold about you.
• Rectification: You can ask us to correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”): You can request deletion of your data, subject to legal retention obligations.
• Restriction of processing: You can ask us to limit how we use your data in certain circumstances.
• Data portability: You can receive your email hash and order data in a structured, machine‑readable format.
• Objection: You can object to processing based on legitimate interests.

We will respond to verified requests within one month. There is no fee unless your request is manifestly unfounded or excessive.

8. Children’s Privacy

ActScan is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. If the changes are material, we will post a notice on our website and, for kit purchasers, send an email to the address we have on file. The updated version will indicate the effective date.

10. Contact and Complaints

For privacy inquiries or data requests:

Email: support@e-industries.ai

If you believe we have violated your data protection rights, you may also complain to your local supervisory authority in the EU/EEA.

Data Protection Officer:

We are not required to appoint a DPO under Article 37 GDPR, but you can reach our privacy team at the email above.