Privacy Policy

VeriClad is a website vulnerability scanning service operated by DoubleMind LLC (United States). In Taiwan, quotations, contracts, payment collection and government uniform invoices are handled by our local partner, Yun Shu Yuan Education Technology Co., Ltd. (3F, No. 20, Changchun Rd, Taipei).

DoubleMind LLC is the controller of your personal data. Our Taiwan partner receives only the transaction and invoice details needed to issue invoices.

• Account data: your name, email address and avatar URL, received when you sign in with Google. Company name, tax ID and invoice details only if you enter them.
• Scan data: the target domains you submit, the time and status of each scan, and the resulting reports (findings, severity, remediation advice).
• Billing data: your plan, billing period and transaction status. Card numbers are handled directly by Stripe — our systems never see or store them.
• Usage records: sign-in times, report download records, and site analytics events (page path, referring hostname, campaign parameters).
• Correspondence: messages and reply addresses you submit through our feedback or sales enquiry forms.

Only for these purposes: running the scans you request and producing reports; provisioning accounts and billing; handling refunds, disputes and billing queries; replying to your messages; improving the service; and meeting tax and legal obligations.

We do not use your data for unrelated marketing, and we do not hand it to third parties for advertising.

The marketing site's analytics use no cookies. We store a random string in your browser's sessionStorage purely to link actions within a single visit for conversion counting. It disappears when you close the tab and is never used to identify you across devices.

The signed-in workbench does store an authentication token in your browser — that is required to keep you signed in, not for tracking.

We use the following processors:

• Supabase (Tokyo) — database for accounts, scan records and reports
• GitHub Actions — the compute environment that runs scans
• Stripe — payment processing and subscription management (card data stays with them)
• Resend — notification and support email delivery
• Netlify — hosting for the site and workbench

Internally, access is limited to people who need it to deliver the service or handle billing. Apart from these processors and disclosures required by law, we share your data with no one, and we do not sell it.

While your account is active, we keep your account data, scan records and reports so you can review them at any time. Deleting your account deletes them.

Transaction and invoice records are retained for the period required by applicable tax law, and are not removed immediately on account deletion.

You may ask us to: confirm what data we hold and give you access; provide a copy; correct or complete it; stop collecting, processing or using it; or delete it. Where the GDPR applies to you, you also have the right to data portability and to object to processing, and you may lodge a complaint with your supervisory authority.

To exercise any of these, contact us via the feedback form in the site footer. We will verify your identity before acting.

Database access is isolated with row-level rules so each account can read only its own data; administrative access is separated from customer accounts. All traffic is served over HTTPS.

We should be honest, though: no system is perfectly secure. If a breach affects your data, we will notify you as the law requires.

We may update this policy as the service or the law changes. For changes with real impact we will post a notice on the site and, where appropriate, email you. The "last updated" date above is the effective date of the current version.