Legal
Data Processing
The roles, sub-processors, safeguards and security measures that apply to personal data processed through the Services.
Last updated · Vicaratva, operated by Merlinvicki Creative Services Pvt. Ltd.
1. Scope and roles
This page describes how Merlinvicki Creative Services Pvt. Ltd. (“we”, “us”) processes personal data through Vicaratva. It supplements the Privacy Policy and the Terms of Service; the Terms’ limitation of liability applies to it.
- For account data (your name, email, authentication data, billing status and scan history), we are the controller and data fiduciary.
- Where you use the Services to scan a website you operate and that scan captures personal data belonging to your own users, you are the controller of that data and we are your processor, acting on your instructions. Sections 2 to 9 govern that processor relationship.
2. Our obligations as processor
When we act as your processor, we will:
- process personal data only on your documented instructions, which include your configuration and use of the Services, unless we are required to do otherwise by law, in which case we will tell you unless the law prohibits it;
- ensure that personnel authorised to process the data are bound by confidentiality;
- implement and maintain the technical and organisational security measures in section 7;
- engage sub-processors only as set out in section 3;
- assist you, so far as the Services allow, in responding to requests from individuals exercising their rights, and in meeting your security, breach-notification and impact-assessment obligations;
- on the end of the Services, delete or return the personal data as described in section 8;
- make available information reasonably necessary to demonstrate compliance with this section and allow for and contribute to audits, subject to reasonable notice, confidentiality and frequency limits.
The subject matter of the processing is the operation of automated audits; the duration is the term of your use of the Services; the nature and purpose is scanning a URL and generating a report; the types of personal data and categories of individuals are determined by the content of the pages you choose to scan.
3. Sub-processors
You authorise us to engage the sub-processors below. We impose data-protection obligations on each of them that are substantially the same as those in this page, and we remain responsible to you for their performance. We will update this list before adding or replacing a sub-processor that handles personal data; if you have an account, you may ask us to notify you of changes.
| Sub-processor | Purpose | Data received | Region |
|---|---|---|---|
| Anthropic | Generates UX, CRO and privacy audit narratives from page content | Stripped page HTML, collected scan signals | United States |
| Razorpay | Subscription billing and payment processing | Name, email, billing details | India / United States |
| Resend | Transactional and authentication email delivery (sign-in links, password resets, emailed reports, admin alerts) | Email address, message content | United States |
| Cloudflare | Turnstile bot-protection challenge on scan and sign-in forms | IP address, challenge token, user-agent | United States (global edge network) |
| GitHub | OAuth sign-in | Account identifier, email, name | United States |
| OAuth sign-in; PageSpeed Insights performance metrics for scanned URLs; and, only with the visitor’s consent, Google Analytics site-usage measurement | Account identifier, email, name (sign-in); the public URL being scanned (PageSpeed); IP address, a cookie identifier and page-view events (Analytics, only with consent) | United States | |
| Neon | Managed PostgreSQL database hosting | All stored account and report data | United Kingdom (London) |
4. Page content sent to Anthropic
For user-experience, conversion and privacy audits we remove scripts and styles from the scanned page, truncate the remaining markup, and send it to Anthropic’s API to generate the written findings. If the page contains personal data in its markup, that data is included. The content is not used to train any model. Do not scan authenticated pages, or pages containing sensitive personal data, that you would not want processed this way.
5. International transfers
Several sub-processors operate outside India and outside the European Economic Area, including in the United States, so audit and account data may be transferred and processed internationally. Where required, these transfers are made under standard contractual clauses or equivalent contractual safeguards in our agreements with those sub-processors, and only to countries not restricted by the Central Government under the Digital Personal Data Protection Act, 2023.
6. Security measures
- All traffic is served over HTTPS.
- Passwords are stored as salted hashes; two-factor secrets are stored encrypted; optional TOTP two-factor authentication is available.
- IP addresses are stored only as SHA-256 hashes, never in raw form.
- Access to production data is limited to personnel who require it, on a least-privilege basis.
- Scanner requests are validated against a guard that resolves DNS and blocks private, loopback and carrier-grade NAT ranges before any connection is made.
- Rate limiting is applied to scan endpoints to prevent abuse of the service and of scanned hosts.
- Anonymous report data expires automatically after 30 days.
7. Personal data breaches
We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting data we process on your behalf. The notice will describe, so far as known, the nature of the breach, the categories and approximate number of individuals and records concerned, the likely consequences, and the measures taken or proposed. We will cooperate with you and take reasonable steps to mitigate the breach.
8. Return and deletion
On the end of your use of the Services, or on your written request, we will delete or return the personal data we process on your behalf and delete existing copies within a reasonable period, unless retention is required by law. Data held in routine backups is deleted in line with our backup cycle. Anonymous report data is deleted automatically 30 days after creation regardless.
9. Individuals’ requests
If we receive a request from an individual relating to personal data we process on your behalf, we will not respond directly except to acknowledge the request, and will promptly forward it to you. We will provide reasonable assistance to help you respond within the time the law allows.
10. Related documents
See the Privacy Policy for what we collect and why, and the Terms of Service for the scope and limits of the Services and the reports.
Questions about this document? Email hello@vicaratva.com.