Privacy policy

What we collect

Account details: your email address, name, and password, which is stored only as a salted hash. If you sign in with Google, we also receive your Google account identifier, email address and name.

Files you submit and what we derive from them: the file, its name, size and SHA-256 hash, and the analysis results (reports, indicators and detection rules).

Billing: your Stripe customer and subscription identifiers, plan and payment status. Card details are entered on Stripe's pages; we never receive or store them.

Usage: analysis counts, storage used and your plan's limits.

Security and abuse prevention: sign-in and request-protection cookies, a device cookie holding a random identifier, and keyed hashes of your network address with browser user agent, of that device identifier and of your verified email address. We keep the hashes, not the underlying values, to enforce one free analysis per person and sign-up limits. Our edge server logs requests (IP address, time, page and browser user agent) for up to 30 days.

How we use it

To provide the service you signed up for: analysing the files you submit and keeping your results available to you (performance of our contract with you).

To send transactional email only: account verification and password reset. We do not send marketing.

To take payments and keep the records the law requires (contract and legal obligations).

To protect the service and its users: preventing abuse of the free analysis, rate limiting and investigating attacks (our legitimate interest in a secure service).

We do not sell personal data, share it with advertisers, or use your files to train models.

Who processes it for us

Amazon Web Services stores submitted files and results, runs our job queue and sends our email (region eu-west-2, London, United Kingdom). Cloudflare protects and routes traffic to the website and sees it in transit. Stripe processes payments. Google is involved only if you choose Google sign-in. The application and analysis servers are operated by us in the European Union.

Stripe, Cloudflare and Google may process data outside the European Economic Area under their standard contractual safeguards. The United Kingdom has an adequacy decision for data from the EU.

How long we keep it

Submitted files and analysis results are deleted automatically 30 days after submission. You can delete an analysis earlier from your workspace at any time.

Account details are kept for as long as you have an account. Database backups are kept for up to 30 days. Network-based abuse-prevention hashes expire after 30 days; device and email hashes are kept so that a free analysis cannot be claimed repeatedly. Edge request logs are kept for up to 30 days. Billing records are kept for as long as tax and accounting law requires.

Cookies

We use strictly necessary cookies only: malsight_session (keeps you signed in), malsight_csrf (protects your requests), malsight_device (abuse prevention, one year) and malsight_google_state (ten minutes, only during Google sign-in). There are no analytics or advertising cookies. Cloudflare may set its own strictly necessary security cookies.

Your rights

Under the GDPR and the UK GDPR you can ask to access, correct, delete or export your personal data, and to restrict or object to its processing. To close your account and delete its data, contact us using the details below. You also have the right to complain to your data protection authority; in Croatia this is the Personal Data Protection Agency (AZOP).

The service is not directed to children under 16.

Security and changes

Traffic is encrypted in transit, stored files are encrypted at rest, and access to data is limited to the systems that need it. Submitted files are analysed in isolated systems.

We will update this page when our practices change and revise the date above.

Contact

Contact details for privacy and legal requests will be published on this page.