Privacy

RLS Radar is operated by Patrick Godin in Greater Moncton, New Brunswick, Canada. This page says what we collect, why, who touches it, and how long it stays. The federal Personal Information Protection and Electronic Documents Act (PIPEDA) is the privacy law we design around: identify the purpose, limit collection, be accurate, keep safeguards, be open, give you access, and accept challenges.

What we collect

• Your email address, so we can sign you in and send the report and the receipt.
• The project name and the public URL you ask us to check, plus the ownership token you publish.
• Payment status from Stripe: amount, currency, and a payment reference. We do not receive your full card number.
• The scan report: check names, severity, redacted evidence, fix text, and the list of GET requests we made (URL, status, size). Secret values are shortened before they are stored.
• A short server log of the request that hit our site (time, path, IP) so we can rate-limit abuse and debug outages.

We do not ask for your customers’ names, emails, or records. If a public API returns a row, the worker notes that a row existed and discards the row. We do not sell personal information. We do not use scan contents to train a model.

Why

We use this information to run the scan you ordered, to prove the charge, to email the report, to keep one customer’s data away from another, and to investigate misuse. That is the purpose. We do not use it for advertising.

Where it lives

The application runs on Render. The database and sign-in are Supabase (Postgres). Email is SendGrid. Payments are Stripe. DNS for rlsradar.com is planned on Cloudflare. These providers process data for us under their own terms. Some of them store data in the United States. By using the service you accept that cross-border processing, which PIPEDA allows when we use contractual and technical safeguards. Choose a Supabase region when the project is created and record it here once it is fixed.

Findings and email bodies are encrypted at rest when an encryption key is configured. Database tables have row-level security so a signed-in user can read their own rows and cannot mark their own site as verified or write their own orders.

How long

Scan findings, request logs, and the body of report emails are deleted after 30 days by default. You can ask us to delete a report sooner. We keep the fact of the order and the amount for as long as Canadian tax rules require. If you ask us to delete your account, we delete the profile, projects, and remaining reports, and we ask Stripe to drop the customer record where their tools allow it.

Your access

Email support@rlsradar.com to see the personal information we hold, to correct your email, or to delete the account. We will answer within 30 days. If you are not satisfied, you can contact the Office of the Privacy Commissioner of Canada.

Cookies

We set a sign-in cookie so you stay logged in. We do not set advertising cookies and we do not run a third-party analytics pixel in this version.

Contact: Patrick Godin, Greater Moncton, New Brunswick, Canada, support@rlsradar.com.