Effective date: [DD Month YYYY]
Last updated: [DD Month YYYY]
1. About This Privacy Policy
This Privacy Policy applies to BugHunter, a website scanning and AI-assisted analysis service operated by [Full legal name or business name], located in [Country and business address, as applicable]. In this policy, "BugHunter", "we", "us", and "our" refer to the service operator.
This policy explains the categories of information that may be processed, the purposes of processing, potential recipients, retention, security, and the choices and rights available to users. It should be read together with our Terms & Conditions and any notices presented when you use particular features.
2. Information We Process
The information processed depends on the features you use and the technical configuration of the service. It may include:
- Submitted website information: URLs, domains, page addresses, and scan settings you submit.
- Technical scan findings: browser errors, failed network requests, HTTP status codes, page metadata, broken links or images, and form-related findings.
- Scan reports: detected issues, severity classifications, explanations, recommendations, and other generated results.
- Technical and usage data: IP addresses, timestamps, browser or device information, request logs, and diagnostic data where collected by the application, hosting provider, or security systems.
- Authentication data: credentials or session information only if protected-page scanning is offered and you choose to use it. Such information must be handled with appropriate safeguards.
- Information sent voluntarily: any information you enter into available fields or provide while using the service.
Website scan results can inadvertently contain personal information or confidential technical details present on the scanned website. Only submit websites and information you are authorized to test. Do not submit real passwords, API keys, access tokens, or other secrets unless a feature specifically requires them and its security arrangements have been reviewed.
3. Purposes and Legal Basis for Processing
Where applicable law requires a legal basis for processing personal information, the basis will depend on the relevant processing activity and jurisdiction. Depending on the circumstances, information may be processed to:
- Perform website scans and provide requested results.
- Analyze technical findings and generate AI-assisted recommendations.
- Maintain the operation, availability, and reliability of the service.
- Detect abuse, investigate errors, and protect the service.
- Comply with applicable legal obligations and respond to lawful requests.
Where consent is required, it will be requested before the relevant processing begins. Where another legal basis is relied upon, it should be identified and documented as required by applicable law.
4. How AI Analysis Works
BugHunter may use an AI model to interpret technical findings and produce explanations, potential impacts, root-cause suggestions, or recommended fixes.
The information processed by an AI model may include technical descriptions of detected issues and relevant scan details. The actual information sent depends on the implementation and model configuration.
If a locally hosted model such as Ollama is used, processing may occur on the configured local machine or server. This does not establish that all information remains local: hosting, logging, external APIs, and other integrations must also be checked.
AI output may be incomplete, inaccurate, or misleading. Review recommendations before applying them, particularly before changing a production website or security configuration.
5. Cookies, Sessions and Similar Technologies
BugHunter may use cookies, session identifiers, local storage, or similar technologies if implemented. These technologies may be used to maintain essential functionality, protect sessions, or remember settings.
The live service should identify the technologies it actually uses, their purposes, and their duration. If analytics, advertising, or other non-essential tracking technologies are enabled, provide any required notice and obtain consent where applicable.
You can manage cookies through your browser settings. Blocking certain cookies may affect features that rely on them.
6. How Long Information Is Retained
Information should be retained only for as long as reasonably necessary for the disclosed purposes, subject to applicable legal requirements and legitimate security or recordkeeping needs.
Retention periods depend on the type of information and the implementation. Before launch, document the actual retention periods for scan reports, temporary files, application logs, backups, session data, and any AI prompts or outputs that are stored.
When information is no longer needed, it should be deleted or de-identified in accordance with the applicable retention procedure, subject to any lawful retention obligations.
7. Sharing and Disclosure
BugHunter does not need to share information for unrelated purposes. However, information may be disclosed where necessary and lawful to the following categories of recipients, if used:
- Infrastructure and hosting providers: to host the website, run scans, and maintain service availability.
- AI service providers: if an external AI service is configured to process scan findings.
- Security and operational providers: if tools are used to detect abuse, monitor errors, or protect systems.
- Authorities or legal recipients: when disclosure is required by applicable law or valid legal process.
The operator should maintain an accurate list of relevant providers, determine what information each receives, and put appropriate contractual and security measures in place where required. Do not publish a claim that information is never shared unless the complete data flow has been verified.
8. International Data Transfers
Depending on the hosting location and service providers, information may be processed in a country other than your own. Where cross-border transfers are subject to legal restrictions or safeguards, the operator will address those requirements before transferring data.
9. Data Security
Reasonable technical and organizational measures should be used to protect information against unauthorized access, disclosure, alteration, loss, or destruction. Depending on the system, these measures may include access controls, secure transport, protected secrets, limited retention, software updates, and monitoring.
No method of transmission, storage, or online service can be guaranteed completely secure. Users should avoid submitting unnecessary confidential information and should use authorized test accounts for protected-page scans wherever possible.
10. Your Privacy Rights and Choices
Depending on your location and the laws applicable to the processing, you may have rights relating to your personal information, including rights to:
- Request information about personal data processed about you.
- Request correction or updating of inaccurate information.
- Request deletion where the applicable law provides that right.
- Withdraw consent where processing is based on consent.
- Raise a grievance or submit a complaint to the competent authority.
These rights are subject to applicable legal conditions, exceptions, verification requirements, and any lawful retention obligations. The operator must provide a working method for submitting privacy requests and must publish the procedure and response timelines required by applicable law.
11. Indian Data Protection and Other Applicable Laws
Where applicable, BugHunter's handling of personal data is intended to comply with relevant Indian laws, including the Information Technology Act, 2000, applicable rules, and the Digital Personal Data Protection Act, 2023, together with its rules and commencement notifications, to the extent those provisions apply and are in force.
The Digital Personal Data Protection Rules, 2025 have phased commencement dates. The operator should review the provisions in force at the time of launch and update its notices, consent flows, security procedures, grievance process, and other compliance measures as required.
Where users are located in other jurisdictions, additional privacy laws may apply depending on the service, the users, and the processing activities. This policy does not claim that a single notice satisfies every legal obligation in every jurisdiction.
12. Children's Privacy
BugHunter is a technical website scanning service and is not intentionally designed to collect children's personal data. The operator must follow applicable age-related requirements, including any consent or verification obligations that apply to the service and its users.
13. Third-Party Websites
BugHunter may scan or reference third-party websites. Those websites are operated independently and may have their own privacy policies, security practices, and terms. This policy does not govern how third-party website operators process information.
Submitting a URL to BugHunter does not give you permission to access or test that website. You are responsible for obtaining authorization before scanning websites you do not own.
14. Changes to This Policy
This Privacy Policy may be revised when the service, its providers, data practices, or applicable legal requirements change. The latest version should display its effective date. Where required, users will be notified of material changes and fresh consent will be obtained if necessary.
15. Privacy Questions and Grievances
Privacy requests and grievances must be directed to the service operator using the following official channel:
- Operator: [Full legal name or business name]
- Privacy or grievance email: [Official monitored email address]
- Postal address, where required: [Official business address]
Replace these placeholders with a working, monitored channel before publishing. You do not need to create a Contact page, but users must have an appropriate way to exercise any rights or raise grievances required by applicable law.
16. Policy Interpretation
This Privacy Policy should be interpreted consistently with applicable law. Nothing in this policy is intended to exclude rights or remedies that cannot lawfully be excluded or limited.
If any provision is found unenforceable, the remaining provisions will continue to apply to the extent permitted by law.