This Privacy Policy describes how we collect, use, and handle your information when you use SUS IT ("we," "us," or "our"), operated as a web application at susit.ai and related URLs. Your privacy is important to us, and we are committed to protecting it.

This policy applies to visitors, registered users, and anyone who uses our AI detection tools, purchases credits or subscriptions, or reads our editorial content (such as the blog).

When you use our service, we may collect the following information:

• Account Information: If you sign in via Google, we receive your name, email address, and profile picture to create and manage your session. If you register with an email address and password instead, we collect your email address and a securely hashed version of your password — we never store or have access to your actual password.
• Usage Data: We collect metadata about the files or links you submit, such as the file name, link URL, and the type of analysis performed.
• Analysis History: For authenticated users, scan history and related metadata may be stored in your account on our backend (for example via Supabase) so you can access history across devices, in addition to any local browser storage. Exact fields depend on product features in use.
• Payment Information: Payments are processed by Stripe. We do not store full card numbers on our servers; Stripe handles payment card data subject to its own privacy policy and PCI compliance.
• Communications: If you email us (e.g. support or privacy requests), we retain those messages as needed to respond and resolve issues.

The information we collect is used solely to provide and improve the Service. Specifically:

• Your uploaded files and associated metadata are sent to a third-party API (Google Gemini) to generate the analysis.
• We do not use your media to train any AI models. Files are deleted immediately after analysis.
• Account-linked history may be stored securely on our infrastructure to provide features such as history sync and referrals; we use it to operate the service, enforce limits, and prevent abuse.

If you are located in the European Economic Area (EEA), we process your personal data based on the following legal grounds:

• Consent: We process analytics and advertising data based on your consent, which you can withdraw at any time through our cookie preferences.
• Contractual Necessity: We process account and usage data to provide you with the services you request.
• Legitimate Interests: We process data for security, fraud prevention, and service improvement purposes where we have a legitimate interest that does not override your rights.

We use cookies, local storage, and similar technologies to operate and improve our service. You can manage non-essential categories at any time through our Cookie Preferences (banner and footer).

• Essential Cookies: These are necessary for the website to function—session management, authentication, security, load balancing, and fraud prevention. They cannot be disabled without breaking core features.
• Analytics (Google Analytics / Tag Manager): With your consent, we may use Google Analytics and Google Tag Manager to understand traffic, navigation, and feature usage. Data may include device type, approximate region, pages viewed, and events. See Google's documentation on how they process data for publishers.
• Advertising (Google AdSense): With your consent, Google and its partners may use cookies or mobile identifiers to serve and measure ads, including personalized ads where allowed. Advertisers may infer interests from visits to our site and others. You can control ad personalization via Google's Ads Settings and industry opt-out tools linked below.
• Do Not Sell or Share (U.S.): Where applicable law treats certain sharing of personal information for cross-context behavioral advertising as a "sale" or "sharing," you may opt out via our cookie preferences and the links in this section.
• Managing Cookies: Use "Cookie Preferences" in our banner or footer. For Google ads: Google Ads Settings. Industry opt-out: aboutads.info. Learn how Google uses data from partner sites: Google partner sites policy.

If you are located in the EEA, you have the following rights regarding your personal data:

• Right to Access: You have the right to request access to the personal data we hold about you.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete data.
• Right to Erasure: You have the right to request deletion of your personal data, subject to certain limitations.
• Right to Restrict Processing: You have the right to request that we limit how we use your personal data.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used format.
• Right to Object: You have the right to object to processing of your personal data for certain purposes.
• Right to Withdraw Consent: Where we process your data based on consent, you have the right to withdraw that consent at any time.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority.

To exercise any of these rights, please contact us.

Our service is hosted on cloud infrastructure (for example Vercel). Media you upload may be processed using temporary storage (such as Google Cloud Storage) for analysis and is deleted after processing in line with our operational practices. We do not use your content to train public AI models.

Account data and application data may be stored in managed databases (for example Supabase). We implement appropriate technical and organizational measures—including encryption in transit (HTTPS), access controls, and least-privilege service accounts—to protect personal data. No method of transmission or storage is 100% secure.

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Account information is retained while your account is active and for a reasonable period thereafter.
• Analysis history stored locally in your browser is retained until you clear your browser data.
• Media files are deleted immediately after analysis is complete.
• Analytics data is retained in accordance with Google Analytics' data retention policies (typically 26 months).

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your country. When we transfer data internationally, we ensure appropriate safeguards are in place, including:

• Standard contractual clauses approved by the European Commission
• Other legal mechanisms as required by applicable data protection laws

We rely on subprocessors to run the service. They process data only as needed to provide the features you use:

• Google (Gemini API): Media and prompts sent for AI analysis. Governed by Google's terms and privacy policy for API users.
• Google (Sign-In, Analytics, Tag Manager, AdSense): Authentication, measurement, and ads as described in Sections 5 and 6.
• Stripe: Payment processing for credits and subscriptions.
• Supabase (or equivalent): Database, authentication session storage, and related backend services for accounts and application data.
• Vercel / cloud hosting: Hosting serverless functions and static assets; may receive IP addresses and request metadata in logs.
• Google Cloud Storage: Temporary object storage for uploads during analysis, when used.

Each provider has its own privacy policy; we encourage you to review them for details on their global infrastructure and subprocessors.

Depending on your state of residence, you may have rights to know what personal information we collect, to request deletion or correction, to opt out of certain sales or sharing for cross-context behavioral advertising, and to appeal denials. To exercise these rights, email us at the address below with your state and a description of your request. We will verify your request as required by law.

Our service is not directed at children under 13 (or 16 where a higher age applies in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will take appropriate steps to delete it.

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

• Contact us via our support page

We may update our Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.