Privacy Policy

• Our customers are people and companies that open a ThreatLens account. For their sign-in details, team and billing, we decide how the data is used.
• Owners of scanned websites are the people behind the domains our customers add. A customer decides which websites to scan and why; we run the checks on the customer's instructions and keep the results for them. If you own a website and want to know or change what we hold about it, see Websites we scan.

From people who use ThreatLens

• Name, email address and a password (stored only as a one-way hash), role, and the time of your last sign-in.
• Your organisation's name, the people you invite, and, for white-label reports, the brand name, colour, logo and footer text you set.
• Payment details for a UPI payment: the plan, amount, the reference we gave you, the transaction number (UTR) you typed in, and the email of the person who submitted it. We never see your UPI PIN, bank login or card details.
• Technical records: IP address, security and audit logs of sensitive actions (such as sign-ins, team changes and payments), and error logs.

About the websites you scan

• The domain names you add, your notes and any client name you attach to them, and whether you have proved you own them.
• The results of each scan: the findings, with the evidence behind them, such as certificate dates and issuer, security header values, cookie names and their flags, DNS records, the technologies a site reveals, and the addresses of pages a deep scan found. Scan results are kept as your history and are used to compare one scan with the next.
• We do not store the content of the pages we load, and we do not store cookie values.

• To run the service: sign you in, run scans, show reports and PDFs, schedule scans and raise alerts when a result gets worse.
• To bill you and confirm UPI payments, and to issue invoices.
• To keep the service safe: limit sign-in attempts, stop abuse, make sure deep scans only run on domains you have verified, and fix faults.
• To email you about your account: confirming your email, resetting a password, payments, plan end dates and notices about the service. We do not send marketing email unless you ask for it.
• To meet legal duties such as tax record keeping.

We do not sell personal data. We do not build advertising profiles, and we do not use your scan results to train AI models.

ThreatLens only scans a website because one of our customers asked it to. A normal scan does what a web browser or a mail server does: it loads the home page and a few well-known files, opens a secure connection, and reads public DNS records. Our requests identify themselves as ThreatLensBot.

A deeper scan, which sends more test requests, only runs on a domain whose ownership the customer has proved to us, by a DNS record, a file or a meta tag on the site.

If you own a website that has been added without your knowledge, or you want us to stop scanning it or delete its results, email hi@idmvalley.com from an address at that domain (or tell us how to confirm you control it) and we will act on it within 30 days.

Only the companies that are needed to run the service:

• Public DNS resolvers. To look up a domain's DNS records, we send the domain name to public resolvers run by Cloudflare and Google.
• Our email delivery provider, to deliver the emails described above.
• Our hosting. ThreatLens runs on our own virtual private server located in India. The scanners, including Nuclei, run on that server and do not send your results to anyone else.
• Authorities, when the law requires it, for example a lawful order from a court or government body.

If your organisation invites team members, they can see its websites, scan results and reports according to their role.

Our database and files are stored on our server in India. Passwords are hashed, sign-in sessions are stored only as hashes, and connections to ThreatLens use HTTPS. We take regular backups of the database.

• While your account is open, we keep its data so the service works, including your scan history.
• If you close your account or ask us to delete it, we remove its websites, scan results and reports within 30 days. Backups of it expire on their normal schedule afterwards.
• An account whose trial or plan has ended is kept for at least 30 days so you can come back; after that we may delete it.
• Payment records are kept for 8 years because tax and accounting law requires it.
• Records of failed sign-ins and rate limits are kept for a day or less. Security and audit logs are kept only as long as needed to protect the service and look into problems.

You can ask us to give you a copy of your personal data, correct it, delete it, or stop using it for a purpose you did not agree to, and you can withdraw consent you gave us. To make a request, email hi@idmvalley.com from the address on your account. We will reply within 30 days. We may need to confirm who you are first, and we may keep what the law obliges us to keep. You can change your password and sign out other devices on the Account page at any time.

We use only what is needed: a cookie that keeps you signed in, and a small cookie that remembers whether the sidebar is collapsed. We do not use advertising or tracking cookies, and we do not run third-party analytics on the signed-in pages.

ThreatLens is for businesses and for people aged 18 or over. We do not knowingly collect data from children.

If we change this policy in a way that matters, we will update the date at the top and tell account owners by email or in the app.

IDM VALLEY Pvt. Ltd., A7/15 Ground Floor, Sec - 85 BPTP, Faridabad, Haryana, India, 121002.
Email: hi@idmvalley.com. Write "Privacy" in the subject line so it reaches the right person.