Privacy Policy

Effective date: October 8, 2026

BetaScan (betascan.com, the "Service") is operated by CodeRockers LTD, a company registered in Cyprus (European Union) ("we", "us", "our"). This policy explains two different things: what we collect about you as a user of the Service, and what we collect from public websites to build the Service. For both, CodeRockers LTD is the data controller within the meaning of the General Data Protection Regulation (GDPR).

Part A. Data about users of the Service

What we collect

• Account data: your email address; if you sign in with Google, the Google account identifier and the email Google confirms for it. We do not store passwords (sign-in is by one-time code).
• Billing data: your plan, the technologies in your slots, credit usage, Stripe customer and subscription identifiers. Card details are entered on Stripe's pages and never reach our servers.
• Usage and security logs: sign-in events, API requests, downloads and lookups, each with date, IP address and request details; emails we sent you (which one, when).
• Technical data: IP address, browser and device information, pages visited, the page that referred you, and the marketing parameters of the link you arrived with (utm_source, utm_campaign).
• Communication: messages you send us.

Cookies

We use a session cookie to keep you signed in and to protect forms, and a cookie that remembers the marketing source of your first visit. Both are first-party and necessary for the Service. We may use a privacy-respecting analytics tool and conversion measurement for our own advertising; where that requires consent, we ask for it.

Why and on what legal basis

• To provide the Service, your account, downloads and the API: performance of a contract (Art. 6(1)(b) GDPR).
• To bill you and keep accounting records: contract and legal obligation (Art. 6(1)(b) and (c)).
• To secure the Service, prevent abuse and enforce our Terms: legitimate interest (Art. 6(1)(f)).
• To send transactional emails (sign-in codes, receipts, service notices): contract. To send product news: legitimate interest, with an unsubscribe link in every such email.
• To measure and improve the Service and our marketing: legitimate interest, or consent where required.

Retention

Account data is kept while the account exists and for up to 12 months after it is closed, longer where accounting law requires (invoices: 7 years). Security and API logs are kept for 12 months. Generated download files are deleted 30 days after creation. Backups are rotated within 90 days.

Part B. Data we collect from public websites

What the crawler collects

Our crawler visits the publicly accessible homepage of registered domain names, the same way a visitor's browser would, and keeps the page source and the technical response headers. The crawler identifies itself with a User-Agent that links to a description page, and it respects the robots.txt rules of each website. From the collected pages we derive:

• which technologies a website uses (content management systems, e-commerce platforms, analytics, chat and marketing tools, frameworks, servers, CDN and similar), when they were first and last seen;
• contact details published on the page: email addresses and telephone numbers, exactly as the website operator made them public;
• domain and hosting data from public registries and DNS: country of the server, IP address, host name, name servers, registrar, registration and expiration dates, and popularity ranks. This data is supplied by NetAPI (netapi.com), a service of the same company.

We do not collect content behind logins, user accounts, personal profiles, or pages other than the homepage, and we do not try to identify individuals. Where a published contact belongs to an identifiable person (for example a sole trader or a named contact), it is personal data and this policy applies to it.

Legal basis and purpose

We process this information on the basis of legitimate interest (Art. 6(1)(f) GDPR): the interest of our customers in reaching businesses with relevant commercial offers and in understanding technology markets, and our interest in operating the Service. The data is limited to what the website operator chose to publish for the purpose of being contacted, is used for business-to-business communication, and can be removed on request at any time. We have weighed these interests against the rights of the people concerned and apply the safeguards described here.

Who receives it

Customers of the Service with a paid plan receive lists and datasets under our Terms of Service, which oblige them to use the contact data lawfully (including the rules on unsolicited communications), to honour opt-outs and not to redistribute it. Small samples are visible to all users. The public technology pages show statistics and domain names, not contact details.

Removal and objection

If you operate a website or your details appear in our data, you can object to the processing and ask for removal by writing to the address below. We remove contact details promptly and keep a record of the removal so they are not collected again; we may stop crawling your website entirely if you prefer. A Disallow rule in your robots.txt also stops our crawler.

Retention

Crawled pages are refreshed continuously and replaced by the newer version; a website that disappears or stops answering drops out of the lists. Detection history (first seen, last seen) is kept to compute trends. Contact details are kept only while they are published on the website and are removed when the next visit no longer finds them or on request.

Part C. Common provisions

Service providers

We use a small number of processors under data-processing agreements: a hosting provider in the European Union (Germany) for our servers and databases; Stripe for payments; Postmark for transactional email; Google for the optional Google sign-in; Cloudflare for content delivery and protection against abuse. Each receives only the data needed for its task. The map of our office on the About page is embedded from Google Maps, so opening that page sends your IP address to Google; no other page loads third-party content.

International transfers

Our servers are located in the European Union. Some providers (Stripe, Postmark, Google, Cloudflare) may process data in the United States or elsewhere; such transfers rely on adequacy decisions or the EU Standard Contractual Clauses.

Disclosure

We disclose data when required by law, a court order or a public authority, to protect our rights and the safety of users, or as part of a merger, acquisition or sale of assets (in which case the acquirer is bound by this policy). We do not sell user data.

Security

Data is transmitted over encrypted connections and stored on access-controlled servers. API tokens can be regenerated at any time in the dashboard. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your rights

Under the GDPR you may ask us for access to your personal data, rectification, erasure, restriction of processing, data portability, and you may object to processing based on legitimate interest and withdraw consent where processing is based on consent. Write to the address below; we answer within one month. You also have the right to lodge a complaint with a supervisory authority, in particular the Commissioner for Personal Data Protection of the Republic of Cyprus (dataprotection.gov.cy) or the authority of your own country.

Children

The Service is for business use and not directed at anyone under 18. We do not knowingly collect data from children.

Changes

We may update this policy; the current version is always at betascan.com/privacy/ with its effective date. Material changes are announced by email or a notice in the dashboard.

Contact

CodeRockers LTD, Efesou 9, 5280 Paralimni, Famagusta, Cyprus. Email: [email protected]. See also the contact details.