CSM Privacy Policy

Last updated: August 21, 2026

This Privacy Policy describes how CapableScannerMan, available at https://capablescannerman.com, collects, uses, stores, and discloses information when You use the Service.

For purposes of this Privacy Policy, "CapableScannerMan," "CSM," "the Service," "We," "Us," and "Our" refer to the CapableScannerMan website, application, scanner services, and related browser sign-in tooling. "You" refers to the person or organization using the Service.

Information We collect

Depending on how You use the Service, We may collect the following categories of information:

• Account and contact information. This may include Your email address, account profile information, organization or workspace information, and records needed to authenticate and secure Your CSM account.
• Service and scan data. This may include target URLs, login URLs, scan configuration, uploaded API descriptions or collections, scan scheduling data, scanner results, evidence, findings, logs, troubleshooting data, and related metadata.
• Target-authentication data. If You provide credentials, tokens, cookies, API keys, or authorize a browser sign-in flow for a target You want scanned, We may process those materials and related session state in order to authenticate the scanner on the target You asked Us to test.
• Browser sign-in extension data. If You use the CSM browser sign-in extension or browser-session flow, the extension and related backend may temporarily process current and final URLs, tab or window identifiers, page title, browser user agent, cookies, localStorage, sessionStorage, and related authentication state needed to return the approved browser session to CSM for the scan You started.
• Technical and usage data. This may include IP address, browser type and version, device identifiers, timestamps, request metadata, and diagnostic information generated when You use the Service.
• Support and communications data. If You contact Us, We may keep records of Your messages and Our replies.

How We use information

We may use information We collect to:

• provide, operate, maintain, and improve the Service;
• create and manage accounts, sessions, and organization access;
• run scans, produce findings, and deliver results You requested;
• support browser-based sign-in flows and other target-authentication flows You initiate;
• send transactional emails such as magic-link emails, account-security messages, and service notices;
• respond to support requests and troubleshoot technical or security issues;
• detect abuse, enforce Our terms, and protect the Service, Users, and third parties;
• comply with legal obligations and defend legal claims.

At this stage, CSM emails are operational in nature. They are used for flows such as magic-link authentication and related account or security notices. We do not currently use the Service to send promotional or marketing emails.

Browser sign-in extension and add-on flows

CSM may offer a browser sign-in extension or similar add-on to help You complete real-browser authentication flows for targets You want CSM to scan. That tooling is intended for a narrow purpose: to let You start a sign-in flow in Your own browser and return the approved session to CSM for the same scan flow You initiated.

When You use that flow, the extension and related backend may temporarily process current and final URLs, page title, browser user agent, tab or window identifiers, cookies, localStorage, sessionStorage, and related session-state data that is needed to complete the requested sign-in bootstrap. We do not use that extension flow for advertising, analytics unrelated to the requested flow, or unrelated browsing surveillance.

Cookies and similar storage

We may use cookies and similar browser storage to keep You signed in, remember preferences, protect accounts, support scanner-authentication flows, and operate the Service. If You disable necessary cookies or browser storage, parts of the Service may not function properly.

How We share information

We may share information in the following situations:

• With service providers. We may use third parties for hosting, infrastructure, databases, email delivery, security operations, and similar support functions. They may process information on Our behalf only as needed to provide those services.
• With Your direction. We may process or disclose information when You instruct the Service to interact with a target, upload materials, or use a browser sign-in flow.
• For legal or safety reasons. We may disclose information if required by law or if We believe disclosure is necessary to protect rights, safety, property, or the integrity of the Service.
• For business transfers. Information may be transferred as part of a merger, acquisition, financing, reorganization, sale of assets, or similar transaction.

Payments

The current development version of the Service does not process live customer payments through the application. We may enable paid plans, subscriptions, or billing in the future. If that happens, checkout and subscription management may be provided through Lemon Squeezy or a similar third-party billing provider. If billing is activated, those providers may process payment, billing, tax, fraud-prevention, and transaction data as needed to complete purchases and comply with legal obligations, and We will update this Privacy Policy before enabling that flow in the live Service.

Retention

We retain information for as long as reasonably necessary to operate the Service, provide requested scans, maintain security, resolve disputes, and comply with legal obligations.

• Account and contact data may be retained while Your account is active and for a limited period afterward for support, audit, and security purposes.
• Scan configuration, results, logs, and support records may be retained for operational, troubleshooting, reporting, and security purposes.
• Authentication materials and browser-session artifacts are intended to be temporary and may be retained only as long as needed to complete the requested flow, support the associated scan, troubleshoot issues, enforce security, or comply with legal obligations.
• Technical logs may be retained for security monitoring, abuse prevention, and diagnostics.

We may delete, aggregate, anonymize, or expire information earlier when it is no longer needed.

International processing

Your information may be processed on systems located in jurisdictions other than Your own. By using the Service, You understand that information may be transferred to and processed in locations where data-protection laws may differ from those of Your jurisdiction.

Security

We use reasonable technical and organizational measures intended to protect information from unauthorized access, loss, misuse, or disclosure. No method of transmission or storage is perfectly secure, and We cannot guarantee absolute security.

Your choices

You may contact Us to request access to, correction of, or deletion of information You have provided, subject to legal and operational limitations. You may also be able to update certain account information through the Service itself.

If You no longer want to receive CSM emails, the practical impact depends on the email type. Security, login, and service-operational emails such as magic-link emails are part of using the Service, while future optional communications would be handled separately if and when they are introduced.

Children's privacy

The Service is not directed to children under 16, and We do not knowingly collect Personal Data from children under 16.

Third-party links

The Service may contain links to third-party websites or services that We do not control. We are not responsible for the privacy practices of those third parties.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When We do, We will post the updated version on this page and update the "Last updated" date above.

Contact Us

If You have questions about this Privacy Policy, You can contact Us at [email protected].