Privacy Policy
Effective 2026-09-20
1. Who we are
This Privacy Policy explains how FraudNova handles personal data in connection with the FraudNova service. For personal data about your account, we are the data controller. For the IP addresses you submit to the API, you are the controller and we act as your processor (see §4). Contact our privacy team at privacy@fraudnova.com.
2. Data we collect
- Account data you provide: name, email address, and password (stored only as a secure hash).
- Signup IP address and registration email screening: the IP you register from, and the email address you register with, are both screened for fraud/abuse signals (for example, whether the address is disposable, has been reported for abuse, or is otherwise high-risk) to protect free trials. We store a resulting risk score and a small set of category flags on your account.
- Submitted data for checks: the IP addresses, email addresses, and phone numbers you send to the API to be scored, and the results, kept to provide and cache the Service.
- Payment metadata: amount, currency, status, date, and an order reference. Card details are collected and handled by Polar (our merchant of record), and cryptocurrency payment details by NOWPayments — never by us.
- Usage and technical logs needed to operate, secure, and debug the Service.
3. How and why we use data (legal bases)
- To provide the Service and your account — performance of a contract.
- To prevent fraud and free-trial abuse (incl. scoring your signup IP and the email address you register with) and to secure the Service — legitimate interests.
- To take payment and keep financial records — contract and legal obligation.
- To comply with law and enforce our Terms — legal obligation / legitimate interests.
4. Data you submit for scoring (controller vs processor)
When you submit an IP address, email address, or phone number to be scored via the API or dashboard, you decide the purpose and are the controller for that processing; we process it on your behalf as your processor, only to return a score, cache it briefly, and operate the Service. You are responsible for having a lawful basis to process the data you submit.
This is separate from the registration email and signup IP screening described in Sections 2 and 3: when you register an account, we decide the purpose (preventing free-trial abuse) and act as the controller for that screening, not your processor, the same way we already were for signup-IP scoring.
5. Sub-processors and recipients
We share data with service providers strictly to run the Service:
- IP-intelligence and fraud-scoring providers — third-party services that evaluate the IP addresses, email addresses, and phone numbers you submit.
- Polar Software Inc. — merchant of record for card payments (receives your name, email, billing country and card details).
- NOWPayments — our payment processor (cryptocurrency).
- Outbound proxy and hosting providers — to route lookups and host the Service.
We do not sell your personal data.
See our current sub-processor list at /subprocessors.
6. Advertising measurement
When you arrive on our site from an ad, we record the ad click identifier in the link (Google gclid, Meta fbclid) and any campaign (utm_*) parameters, and store them with your account when you sign up. To measure whether our ads work, we share with Meta a hashed (SHA-256) email address and account ID, the Meta click identifier, and an IP address, both when you verify your email address and when you buy credits; when you verify your email address, we also share the browser user agent from that request. Legal basis: our legitimate interest in measuring the effectiveness of our advertising. We do not use advertising pixels or tracking cookies for this — it is done server-side. To object, email privacy@fraudnova.com.
7. International transfers
Our providers may process data outside your country, including outside the EEA. Where we transfer personal data internationally, we rely on appropriate safeguards (such as standard contractual clauses) where required by law.
8. Retention
We keep account data while your account is active. When you delete your account, we delete your account data and operational records (API keys, check history, webhooks). We retain payment records in anonymized form (amount, date, status — detached from your identity) to meet accounting and tax obligations. Cached scoring results expire automatically.
9. Free checker tool
Our free, no-signup checker pages (/free-ip-checker, /free-email-checker, /free-phone-checker) let a visitor submit an IP address, email address, or phone number without an account. We use that submitted value only to produce the result shown to you on the same page — it creates no database row and is never saved to your browser session. A result may be served from a short-lived in-memory cache rather than a fresh check if the same value was looked up moments earlier, so we do briefly hold the submitted value in that cache before it expires automatically — it is not a permanent record. On the rare occasion a check fails at our upstream provider, the submitted value may appear in our internal error logs for troubleshooting — masked for email addresses and phone numbers, but not for IP addresses. These pages may run Cloudflare Turnstile to verify you are not an automated script before running a check; Cloudflare already sits in front of every request to our site, so this is not a new recipient of your data, only a new use of the connection it already handles. Turnstile also runs on the registration and password login forms for the same anti-automation purpose.
10. Your rights
Subject to applicable law, you may request access, rectification, erasure, restriction, objection, and portability of your personal data. You can exercise the main rights yourself in Settings → Privacy & data: download a copy of your data, or delete your account. For other requests, contact privacy@fraudnova.com. You also have the right to lodge a complaint with your local data-protection authority.
11. Cookies
We use only essential cookies — a login session cookie and a CSRF-protection cookie — which are required for the site to function. Until you register (or the session expires, whichever comes first), that same session cookie also holds the ad click identifier captured from the URL you arrived on (see Section 6, Advertising measurement), so we can attribute a signup to the click that led to it. We do not use analytics, advertising, or tracking cookies for any other purpose, so no cookie-consent banner is required.
12. Security
We use appropriate technical and organizational measures to protect personal data, including encryption in transit, hashed passwords, and access controls. No method of transmission or storage is perfectly secure.
13. Children
The Service is not directed to children and is intended for users who can form a binding contract. We do not knowingly collect data from children.
14. Changes
We may update this Policy; material changes will be shown by an updated effective date and, where appropriate, additional notice.
15. Contact
FraudNova — privacy@fraudnova.com.