Privacy Policy

Virus Purge ("we", "us", or "our") operates the website viruspurge.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our Service, and describes your rights under the General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA), and other applicable privacy laws worldwide.

Please read this policy carefully. By using the Service you acknowledge that you have read and understood this policy.

1. Data Controller

The data controller for personal data processed through this Service is Virus Purge. For any privacy-related enquiries please contact us at [email protected] .

2. Data We Collect

2.1 Data you provide directly

• Account information: your email address and name, which we receive from our sign-in provider, EmbedAuth, when you sign in. Sign-in itself (email and password, magic link, or Google) is handled by EmbedAuth: we never receive or store your password.
• Subscription information: your plan, your subscription identifier and, for Enterprise plans, your daily scan volume. Checkout and billing are handled by PayBroadcast, which uses Stripe to process payments; card details never reach our servers.
• Enterprise teams: if an Enterprise customer invites your email address to their team, we store that address and whether you accepted. Nothing is shared with the team until you accept; after that, the team owner can see the scans you run while on the team (file names, sizes, results and times), but never anything from before you joined. You can leave at any time.
• Contact messages: any content you send us via the contact form or email.

2.2 Data collected automatically

• Log data: our servers log each request: IP address, browser user agent, the page or API endpoint requested, and the time.
• Scan records: for every scan we keep the file name, size and type, a SHA-256 fingerprint of the file, the scan result and any threat names detected, and the time. Scans made while signed in are linked to your account.
• Scans without an account: when you scan without signing in, we also store your IP address with the scan record. This is how we apply the daily limit for guest scans. Since 29 September 2026 we no longer record the IP address with scans made while signed in; older records may still include it.
• Cookies and similar technologies: see Section 6.

2.3 Files submitted for scanning

Files you submit are uploaded from your browser directly to our isolated scanning server — they never pass through our web servers — and are processed solely to perform the antivirus scan. Files are never written to permanent storage and are deleted immediately after scanning. We do not access, read, or share file content.

3. Legal Basis for Processing (GDPR)

We process personal data on the following legal bases:

• Contract (Art. 6(1)(b)): processing necessary to provide the Service you requested, including account management and scanning.
• Legitimate interests (Art. 6(1)(f)): fraud prevention, security monitoring, and improving the Service.
• Legal obligation (Art. 6(1)(c)): compliance with applicable laws, including tax and financial regulations.
• Consent (Art. 6(1)(a)): analytics cookies (Google Analytics), which you may withdraw at any time via the Cookie Settings.

4. How We Use Your Data

• To create and manage your account.
• To manage subscriptions (via PayBroadcast, which uses Stripe for payments).
• To provide the file scanning service, maintain your scan history, and apply daily scan limits.
• To respond to support and contact enquiries.
• To detect and prevent abuse, fraud, and security threats.
• To analyse aggregate usage trends and improve the Service (analytics cookies, with your consent).
• To comply with legal obligations.

We do not sell your personal data to third parties. We do not use your data for profiling or automated decision-making that produces legal effects.

5. Data Sharing

We share personal data with the following categories of third parties:

• EmbedAuth — sign-in and account authentication (email and password, magic links, and Google sign-in). EmbedAuth receives your email address and credentials; we receive your email address and name from it.
• PayBroadcast, and Stripe, Inc. — subscription checkout and billing. PayBroadcast runs checkout and uses Stripe (PCI-DSS Level 1) to process payments. They receive your account identifier and email address and your payment details.
• Cloudflare, Inc. — content delivery and security. All traffic to the site passes through Cloudflare, which therefore processes your IP address and request data.
• Hosting providers (Hetzner Online GmbH) — the servers that run the Service and its database, located in the EU.
• Our email provider — delivers contact-form messages to us.
• Subscribeam — the newsletter sign-up form, only if you choose to subscribe.
• Google LLC — analytics (Google Analytics), only if you consent to analytics cookies. Data transferred under Standard Contractual Clauses.
• Your Enterprise team owner — only if you accept a team invite, and only for scans you run while on the team (see Section 2.1).
• Legal authorities — where required by law, court order, or to protect the rights and safety of users or the public.

6. Cookies

We use the following categories of cookies:

• Strictly necessary: the session cookie that keeps you signed in, a security cookie that protects sign-in and sign-out against cross-site request forgery, and a short-lived cookie (15 minutes) set when you start a sign-in. Your cookie-consent choice is kept in your browser's local storage. These cannot be disabled.
• Analytics (optional): Google Analytics cookies that help us understand how visitors use the site. Enabled only with your consent. You may withdraw consent at any time using the Cookie Settings link in the footer.

You can also manage cookies through your browser settings. Note that disabling necessary cookies may prevent you from logging in.

7. Data Retention

• Account data is retained for the duration of your account and for up to 6 months after deletion, to comply with legal obligations.
• Scan records are retained without a fixed time limit, so your scan history stays available for as long as you have an account. You can delete your account yourself, on the My Account page: your scan records, your organizations and your sign-in at EmbedAuth are deleted with it, at once.
• Scan records made without an account — including the IP address stored with them — are also retained without a fixed time limit.
• Payment records are held by PayBroadcast and Stripe, which retain them as required for accounting purposes (typically 7 years).
• Server log data is retained for 30 days.

8. Your Rights

Depending on your location you have the following rights regarding your personal data:

• Access (Art. 15 GDPR): request a copy of the data we hold about you.
• Rectification (Art. 16 GDPR): request correction of inaccurate data.
• Erasure (Art. 17 GDPR): request deletion of your data ("right to be forgotten"), subject to legal retention obligations.
• Restriction (Art. 18 GDPR): request that we restrict processing of your data.
• Portability (Art. 20 GDPR): receive your data in a structured, machine-readable format.
• Objection (Art. 21 GDPR): object to processing based on legitimate interests.
• Withdraw consent: at any time, for consent-based processing (e.g. analytics cookies).
• CCPA rights: California residents may request disclosure and deletion of personal information and may opt out of sale (we do not sell data).

To exercise any right, email [email protected] . We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

9. Security

We implement appropriate technical and organisational measures to protect your personal data, including TLS encryption in transit, delegating password handling to our sign-in provider (we never see your password), sessions that are revoked when you sign out, and access controls. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

10. Children’s Privacy

The Service is not directed to children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data please contact us immediately.

11. International Transfers

Personal data may be transferred to and processed in countries outside your country of residence. Where data is transferred outside the EEA or UK, we use appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission, or the UK International Data Transfer Agreement.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates the most recent revision. For significant changes we will notify registered users by email. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

13. Contact

For any questions or concerns about this Privacy Policy, or to exercise your rights, please contact us: