Privacy policy

Summary

Who we are

Brandetx is a product of STATSRA ("we", "us"), the data controller for the processing described here. Contact details are at the end of this policy.

Brandetx is a competitive-intelligence tool for marketing teams. It is not a gambling service and does not process any wagering data.

What the extension sends

Brand detection runs entirely inside the extension. It only contacts our API at api.brandetx.com in these cases:

1. Downloading brand data and configuration

The extension fetches a hashed brand index and a scoring configuration. These requests carry no data about you or the page beyond standard HTTP headers.

2. Resolving ambiguous matches (POST /v1/resolve)

When a scan finds a name that could belong to more than one brand, the extension asks the API to disambiguate. The request contains, per detected block:

Every request is validated against a fixed schema. A request carrying any other field is rejected with an error and nothing is stored.

3. Anonymous install token

On first contact the API issues a random identifier (a UUID) stored in the extension. It lets us apply the free-plan daily quota and attribute scans to an install. It contains no personal data. When you sign in from the extension, the install is linked to your account so you can see and revoke it under Devices in your account settings.

4. Reporting a missing brand (optional, signed-in only)

Signed-in users with a reviewer role can manually submit the name of a brand the extension failed to recognise. This is the only path by which a string from a page reaches our servers, it happens only when you press the button, and the submitted name is reviewed by a person before it enters the brand database.

5. Page snapshot image

No page image is captured unless you deliberately turn one on: that needs an account and the page-image setting switched on, both off by default. Until you do, the extension never asks Chrome for a capture — the gate sits at capture, not at upload — and our API rejects any image sent while the setting is off.

With the setting on, each scan captures a full-page screenshot and uploads it. The image is stored as a blob linked to the scan record — it carries no embedded identity, account, or install information of its own. It's used to power the History section of your dashboard so you can see what the page looked like at scan time. You can switch it back off at any time in your account settings.

What we never collect

• The text, HTML or DOM of any page you visit or scan
• Your browsing history, open tabs, or pages you do not explicitly scan
• Form input, passwords or session cookies from other sites
• Precise location or advertising identifiers
• A device fingerprint of our own. The check on the sign-in form is run by Cloudflare, which evaluates your IP address, TLS fingerprint and browser user agent to tell people apart from automated abuse. We receive only whether the check passed and when it ran, never those signals.

The extension requests only the Chrome permissions activeTab, scripting, sidePanel and storage, plus network access to our own API host. It cannot read a page until you open the side panel on that tab and start a scan.

Account data

You can use the free plan without an account. If you sign in (required for Pro), we store:

• Email address — used to sign you in with one-time codes and to send transactional messages (sign-in codes, a one-time welcome message, a notice when a Pro payment fails, service notices). Receipts for Pro charges come from PayPal, not from us. We do not send marketing email.
• Display name — optional, set by you, shown only to you inside the product.
• Role and plan — free or Pro, and any internal reviewer role.
• Session and account tokens — stored as one-way hashes only. One-time sign-in codes expire after 10 minutes.
• Billing status — subscription state received from PayPal. We do not receive or store card numbers.

We do not use passwords, so we do not store any.

Scan history and snapshots

Each scan that contacts the API produces a snapshot: the install or account identifier, the page URL, a timestamp, and the ranked results (brand identifiers, scores and numeric signals). If you have turned page images on, the record also links a full-page screenshot. Neither the record nor the image includes page text, HTML, or DOM.

• Query strings are stripped from the URL before storage, so tracking parameters, session identifiers and search terms embedded in a URL are not retained.
• Anonymous snapshots (free plan, not signed in) are deleted 30 days after the scan.
• Account snapshots form your scan history and are kept while your account is active, so you can review past scans. They are deleted when you delete your account.

Data stored in your browser

The extension uses Chrome's local extension storage for: the hashed brand index and scoring configuration, a cache of your recent scan results (15 minutes, so re-scanning a page makes no API call), the anonymous install token, your account token if you sign in, and — only if a sign-out could not reach our server — that signed-out token, kept until the extension has revoked it on the server. For accounts on our own team it also remembers one display preference, whether a scan is saved to the account's history. A one-time code that ties a website sign-in to the extension that started it lives in Chrome's session storage and is discarded when the browser closes. None of this is synced to Chrome's cloud storage, and uninstalling the extension removes it all.

Service providers

We use a small number of providers. Resend and Cloudflare process data on our behalf under contract. PayPal is different: for the payment data you give it, PayPal is its own data controller under its own privacy statement, not a processor acting for us.

We do not sell personal data and we do not share it with advertisers or data brokers.

Cookies and tracking

This marketing website sets no cookies and loads no analytics or advertising scripts. The signed-in area uses a single strictly necessary session cookie (igd_session, HttpOnly) that keeps you signed in for up to 30 days; it is not used for tracking. The extension does not use cookies.

The sign-in form embeds Cloudflare's bot check. It sets no cookies. It stores one item in your browser's local storage under Cloudflare's own domain (challenges.cloudflare.com), which persists between visits. Cloudflare states it is used only to detect automated abuse; we cannot read it.

Retention

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to restrict or object to its processing, and to lodge a complaint with a supervisory authority. To exercise any of these, email us from the address on your account. We respond within 30 days.

Deleting your account removes your email, tokens and scan history. Billing records required by law are retained in anonymised or restricted form.

Where we rely on legal bases under the GDPR or UK GDPR: providing the service (contract) for accounts, scans and billing; legitimate interest for security, abuse prevention and the anonymous install quota; legal obligation for tax records.

Security

All traffic between the extension, this site and our API is encrypted with TLS. Tokens and sign-in codes are stored only as SHA-256 hashes. The API enforces its schema on every request and rejects unknown fields, which structurally prevents page text or HTML from being accepted even by mistake. Access to production systems is restricted to the people who operate the service.

Children

Brandetx is a business tool intended for adults working in marketing. It is not directed at anyone under 18 and we do not knowingly collect data from them.

Changes to this policy

We will post any changes on this page and update the date at the top. If a change materially reduces your rights or expands what we collect, we will notify account holders by email before it takes effect.

Contact

STATSRA
Privacy enquiries: [email protected]