What Vance Rank collects — and exactly how long it keeps it.

01What we collect, and why

Three kinds of data exist in this service: pages scanned (the product), account records (so a workspace can exist), and billing records (so purchases can be honored). We collect the minimum each of those needs — no ad trackers, no content harvesting beyond the storefront pages being checked, no scanning of anything behind a login.

02Store scan data

Quick Scan (free, no account): the scanned pages, findings and evidence previews are processed and held temporarily in memory for up to 30 minutes, then expire. A Quick Scan result is never written to the scanned store, and it is never imported into an account if you later sign up. Alongside each scan we keep one minimal abuse-prevention record — a keyed digest of the requesting IP (not the IP itself), the submitted hostname and a timestamp.

Full Scan and later paid activity: runs, findings, severities and captured evidence are kept in your workspace for as long as the store exists there, because a persistent record is exactly what you are paying for. Deleting the store removes its database records and purges the evidence files recorded against it; unreferenced leftovers are removed automatically within one day of becoming orphaned.

03Account data

An account holds your email address, a password hash (never the password itself), and the workspace content your actions create — stores, runs, findings, approvals, incidents. When you grant write credentials for an approved fix workflow, the credential is encrypted at rest and never returned to your browser after storage. A minimal account-level audit entry (email, hostname, timestamp) is kept for store deletions so removals can be defended against abuse claims.

04Billing data

Payment card details are handled by our payment provider — Vance Rank stores the order, product, amount and state you see in workspace billing, never the card number. Refund requests, provider confirmations and the resulting access changes are recorded on the order. Transactional emails (welcome, refunds, credential changes) are sent to your account address.

05Retention in one table

Data	How long it is kept
Quick Scan pages, findings, evidence preview	Up to 30 minutes in memory, then expired.
Quick Scan abuse record	IP digest, hostname and time; retained as abuse-prevention data.
Workspace scan records and evidence	While the store exists in your workspace; purged on store deletion.
Account and order records	While the account exists; billing records are retained as required for accounting.
Database backups	Nightly database backups are kept for a limited window and then rotated out; a backup taken before a deletion is not rewritten afterwards.

06Who else touches the data

Workload and storage run on a dedicated cloud server behind Cloudflare for DNS and network edge. Transactional email is delivered through Brevo; card payments are processed by Dodo Payments. These providers handle what their service requires and nothing more. Backups stay on our own infrastructure with the same access controls as the live database.

07Your choices and requests

You control the obvious things directly: delete a store (which purges its evidence) and stop using the product. For anything else — ending a subscription, a copy of your account data, a correction, or account closure with deletion of remaining personal data — email [email protected] from your account address and a person on our team will handle it and confirm back to you what was exported, corrected or deleted.

08Security

Transport is HTTPS throughout, account passwords are hashed, stored write credentials are encrypted at rest, and public scanning never requires any credential from you. The safeguards, their exact boundaries and the approval model for anything that could change a store are on the Security & data page.

09Contact

Privacy requests and data questions: [email protected]. General contact: [email protected].