Privacy policy

1. The short version

• We record every visit. Our website and app record your session, including page changes, clicks, scrolls, mouse movement and typed text. Passwords, one-time codes, card fields and secrets are masked in your browser.
• We log where you come from. With each session we store your IP address, browser and device, country, referrer and campaign parameters such as UTM tags.
• Guest activity joins your account. When you sign up or sign in, your earlier anonymous visits, scans and events are linked to your account.
• Your images stay until you delete them. We keep your uploaded images and scan history until you delete a scan or your account.
• Stripe handles payments. We never see your full card number.
• We do not sell your personal information, and we do not use your images for advertising.
• You stay in control. You can ask to access, correct, export or delete your data, and you can delete your account yourself in the app.

2. Who we are

Perspicax is a company of the avancer.ai research lab. It is operated by Avancer, Inc., 131 Continental Dr, Suite 305, Newark, Delaware 19713, United States, which is responsible for the personal information described in this policy. You can contact us at [email protected].

This policy covers the Perspicax website, web app and API, and the emails, forms and support that go with them. Stripe's checkout and customer portal pages are run by Stripe under its own privacy policy, Stripe's privacy policy.

3. Information you give us

• Account details. Your email address, which we use to send you one-time sign-in codes, and your account settings and plan. We do not use passwords.
• Images. The images you upload for scanning, up to 20 MB each. We store the original file exactly as you uploaded it, so we also keep anything it contains, which can include metadata such as camera details, date or location, and any people shown in it.
• Scan history. Your scans, their results and any report you send us saying a result is wrong.
• Contact and API access requests. Your name, email address, company (optional), topic or use case, message and expected volume (optional).
• Messages. Emails and other messages you send us.

How sign-in works. You sign in with just your email address. We email you a one-time code, and once you enter it we set a sign-in session cookie that is valid for up to one year, or until you sign out.

4. Session recording of every visit

We record every visit to the Perspicax website and app. We use rrweb, an open-source session recording library that runs in your browser. It captures how the page changes and how you interact with it: clicks, scrolls, mouse movement and the text you type.

Passwords, one-time codes, card fields and other secrets are masked in your browser before anything is sent to us. Other text you type, such as a message in our contact form, is recorded.

With each recording session we store:

• your IP address
• your user agent, which tells us your browser, operating system and type of device
• your country, which we work out from your IP address
• the referrer, meaning the page that sent you to us
• campaign parameters in the link you followed: utm_*, gclid, fbclid, msclkid and ref

Guests are recorded under an anonymous ID kept in the pcx_aid cookie. When you sign up or sign in, your earlier anonymous visits, scans and events are linked to your account. A single recording session lasts at most 60 minutes.

Where the law requires consent, we may ask for it with a banner before recording. Our Cookies and session recording notice explains the cookies and storage involved and how to control them.

5. Usage events and IP addresses

We log page views and product events, together with your anonymous ID and the page URL. The product events are: scan started, scan completed, signup prompt shown, signup started, signup completed, upgrade clicked, checkout started, API access requested and contact form sent.

We also use your IP address to apply the guest limit of one free scan per IP address, and to detect and prevent abuse.

6. Information from other sources

• Stripe. When you pay, Stripe tells us about your subscription and payments, such as your plan, payment status and billing period. Stripe collects your card details directly, and we never see your full card number.

7. How we use information

• Provide the Service: run scans, show results and history, and manage your account and plan.
• Apply quotas, rate limits and the guest limit.
• Take payments and manage subscriptions through Stripe.
• Send transactional email, such as sign-in codes and messages about your account.
• Answer contact and API access requests, and give support.
• Understand and improve the website and app, using session recordings, events, referrers and campaign parameters.
• Measure detection accuracy. We may use scan results and dispute reports to measure how well the detector works. We do not use your images to train our models unless you opt in.
• Keep the Service secure, prevent fraud and abuse, and enforce our Terms of service.
• Comply with the law and respond to lawful requests.

Our detector is our own model. We do not send your images to third-party AI services for analysis. Images are analyzed on GPU infrastructure provided by Modal, which processes them on our behalf.

Where the law requires a legal basis, we rely on: performing our contract with you, to provide the Service and take payments; our legitimate interests, to secure, understand and improve the Service and to measure detection accuracy; your consent where it is required, for example for session recording where a consent banner is shown; and compliance with our legal obligations.

8. Sharing and subprocessors

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not use your uploaded images for advertising.

We use the service providers below to run Perspicax. They process personal information on our behalf, for the purposes listed.

Your account data, scan history and session recordings are stored in a MongoDB database, and uploaded images in S3-compatible object storage, both run by our infrastructure provider.

The current list is available on request at [email protected].

We may also disclose information when the law requires it, to respond to valid legal requests, to protect the rights, safety and security of our users, the public or us, as part of a merger, acquisition, financing or sale of assets, or when you ask us to.

9. How long we keep information

• Images and scan history. Kept until you delete them. Scan history is kept for every account for as long as the account exists, and you can delete any scan at any time.
• Guest scans. Kept, and moved into your account if you sign up.
• Session recordings and events. Kept while we need them for the purposes in this policy. Recordings linked to your account are deleted when you delete your account.
• Account details. Kept until you delete your account.
• Billing records. Kept for as long as tax, accounting and other laws require, even after you delete your account. Stripe keeps its own records under its own policy.
• Contact and API access requests. Kept for as long as we need them to handle your request and our relationship with you.

When you delete your account, we delete its images, API keys and recordings, and cancel your Stripe subscription. We may keep limited information where the law requires it, such as billing records.

10. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and get a copy of it.
• Correct information that is wrong or incomplete.
• Delete your personal information.
• Port your data, meaning receive it in a structured, machine-readable format.
• Object to, or ask us to limit, how we use your information, including for session recording.
• Withdraw consent at any time where we rely on your consent. This does not affect processing that took place before.

You can delete a scan, or your whole account, yourself in the app. Deleting your account deletes its images, API keys and recordings, and cancels your Stripe subscription.

For any other request, email [email protected] from the address linked to your account, with "Privacy request" in the subject line. We may need to confirm your identity first. We aim to respond within 30 days. We will not treat you differently for exercising your rights. You may also complain to your local data protection authority.

You can also control cookies and recording, as explained in our Cookies and session recording notice.

11. International transfers

We are based in the United States. Your information is processed in the United States and in other countries where our service providers operate. Data protection laws in these countries may differ from those where you live. Where the law requires safeguards for these transfers, we rely on appropriate mechanisms, such as contractual commitments from our providers.

12. Security

• Access to personal information is limited, through access controls, to staff who need it.
• Uploaded images are kept in private storage that is not publicly accessible.
• Images are shown to you through signed links that expire after a short time.
• Staff access to original images is recorded in an audit log.
• We do not use passwords. You sign in with a one-time code sent to your email, so there is no password for us to store or lose. A sign-in session lasts up to one year, or until you sign out.
• Session recordings mask passwords, one-time codes, card fields and secrets in your browser.
• Connections to Perspicax use HTTPS.

No system is completely secure, and we cannot guarantee the security of your information. If a breach affects your personal information, we will notify you as the law requires.

13. Children

Perspicax is not intended for children under 16, and we do not knowingly collect personal information from them. If you believe a child under 16 has given us personal information, contact us at [email protected] and we will delete it.

14. Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new "Last updated" date. If a change is material, we will tell you by email or in the app before it takes effect.

15. Contact us

For privacy questions or requests, contact us:

Avancer, Inc., 131 Continental Dr, Suite 305, Newark, Delaware 19713, United States

Email: [email protected], or use our contact page.