Privacy Notice

EX-RAY Behavioral Forensics is operated by Cristina Ursu, a sole trader based in England, United Kingdom. Cristina Ursu is the data controller for personal data processed through this service.

Contact: support@exray-scan.com

• Content you submit — text and images you paste or upload for analysis (which may contain personal data about you or third parties).
• Scan identifiers — a random scan ID stored in your browser to associate a purchase with the correct scan.
• Purchase records — transaction ID, the scan ID it unlocks, environment, and timestamp.
• Technical data — IP address, device and browser information, and basic request logs collected by our hosting and security infrastructure.

Payment card details are collected and processed by Stripe, our payment processor, not by us.

• To provide the service — generating the debrief you requested.
• To process your purchase and unlock the corresponding scan.
• To keep the service secure and prevent fraud or abuse.
• To respond to support requests from you.
• To comply with legal obligations (e.g. tax records).

• Contract — to deliver the service and process your purchase.
• Legitimate interests — service security, fraud prevention, and basic analytics.
• Legal obligation — record-keeping required by law.
• Consent — where you have given it (e.g. optional cookies, if any).

• Stripe — our payment processor. Stripe handles card processing, billing, and refunds on our behalf. See stripe.com/privacy.
• AI processing providers — submitted content is sent to large-language-model providers (including Google) via the Lovable AI Gateway solely to generate your debrief.
• Hosting and infrastructure — Lovable / Supabase / Cloudflare for hosting, database, and content delivery.
• Professional advisers and authorities — where required by law.

Some of the providers listed above are based outside the UK / EEA. Where personal data is transferred internationally, we rely on adequacy decisions or appropriate safeguards such as Standard Contractual Clauses.

Submitted content is processed transiently to generate your debrief and is not retained on our servers as part of a long-term profile. Scan and unlock records are retained for as long as needed to operate the service and to meet tax / accounting obligations (typically up to 6 years), after which they are deleted or anonymised.

Under UK GDPR you have the right to access, rectify, erase, restrict, port, or object to processing of your personal data, and to withdraw any consent you have given. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk). To exercise your rights, email support@exray-scan.com. We aim to respond within one month.

We use appropriate technical and organisational measures including TLS encryption in transit, access controls, and row-level security on our database. No service can guarantee absolute security.

We use a small amount of browser local storage to remember your scan ID and unlock status so a paid scan stays unlocked on the device you bought it on. We do not currently use third-party advertising or marketing cookies.

We may update this notice from time to time. The "Last updated" date above reflects the most recent change.