Privacy Policy

Effective Date: July 4, 2026
Entity: Venom Industries LLC

1. Information We Collect

Account & License Data

• Email address: collected when you request a free trial or purchase a subscription. Used to deliver your license key, for account/support communications, and — as described below — for marketing follow-up.
• License key and plan status: stored in your browser's synced Chrome storage and periodically revalidated against our licensing server.

Marketing Communications

When you enter your email to request a trial key, it is also added to our marketing list (source-tagged "onboarding-trial") so we can follow up if you don't complete setup or convert to a paid plan. Every marketing email includes an unsubscribe link, and you can also request removal at any time (Section 6).

Usage & Diagnostic Data (sent to our servers)

We use PostHog and a Cloudflare Worker to collect analytics on how the extension is used. This includes:

• Client ID: a random token generated on your device when you first install the extension, used as an analytics identifier.
• Product events: for example when you open the popup, run a scan, click an upgrade link, or export results. Some of these events include the domain name of the site you scanned (e.g. "example.com") so we can measure detection quality and usage patterns.
• Account linkage: if you activate a trial or license, your email address is associated with your Client ID in our analytics system (via a PostHog "identify" call), and is also included directly on trial/license activation events. From that point on, your usage data is tied to your email address and is not anonymous.

If you never activate a trial or license, your Client ID and associated scan/usage events are not linked to an email address or other directly identifying information, though they are best described as pseudonymous (tied to a persistent device-level identifier) rather than fully anonymous.

Local Scan History (stored on your device only)

Separately from the domain-level analytics above, the extension keeps a local history of your recent scans in your browser's on-device storage. Each entry includes the full URL and page title of the scanned page, the detected tools, and a timestamp. This history powers the "scan history" and CSV/JSON export features and is not transmitted to our servers — it stays on your device unless and until you choose to export it yourself.

License Data & Chrome Sync

Your license key, plan, and trial status are stored using Chrome's built-in sync storage, so they carry over to any other Chrome browser signed into the same Google account. This is standard Chrome sync behavior governed by Google's own privacy policy, not something we separately transmit.

Page Content During a Scan

When you click the extension to scan a page, it reads that page's markup and available JavaScript globals locally in your browser to match against a bundled list of known tool signatures. This page content is processed on-device and is not transmitted to our servers — only the resulting domain name and match summary may be sent as part of the analytics described above.

2. Extension Permissions

SaaS Detective requests the following permissions:

• host_permissions (http/https, all sites) and a content script that loads on every page you visit: this is required so the extension can read page markup on demand the moment you click "Scan," without a page reload. The content script itself is idle until it receives a scan request from the popup — it does not read or transmit page content automatically.
• activeTab: grants temporary access to the currently active tab only when you click the extension icon, so the scan can be triggered without persistent access to tab content.
• scripting: used in two ways when you click "Scan" — (1) as a fallback to inject the content script if it hasn't loaded yet (e.g. right after install), and (2) to check for known JavaScript global variables (e.g. window.Shopify) that reveal tools which load asynchronously and wouldn't be caught by markup scanning alone.
• storage: saves your license/plan status and category preferences (via Chrome sync storage), plus a local, on-device-only scan history and analytics identifier (via Chrome local storage).
• alarms: creates one recurring alarm, firing every 24 hours, used solely to re-check your license/trial status in the background.
• notifications: fires a single local notification when a 7-day Pro trial expires. Not used for scan results, marketing, or any other purpose.

3. Third-Party Service Providers

• PostHog (posthog.com, routed via our own domain api.venom-industries.com) — receives Client ID, product usage events, scanned domain names, and, after activation, your email address. PostHog Privacy Policy.
• Cloudflare Workers (our licensing/analytics backend) — processes license validation requests, trial signups, and duplicate usage/event data. Cloudflare Privacy Policy.
• Stripe — processes subscription payments. Your email may be pre-filled into the Stripe checkout link. We do not receive or store your full card number. Stripe Privacy Policy.
• Email delivery provider — used to send license keys, trial keys, and marketing/follow-up emails.

We do not sell your personal data to third parties.

4. Data Retention

• Account email & license data: retained for the life of your account, plus up to 12 months after cancellation for support and legal purposes.
• Marketing list emails (no conversion): retained for up to 90 days, or until you unsubscribe or request deletion.
• Client ID and analytics events: retained for up to 24 months.

5. European Union Users (GDPR) & California Users (CCPA/CPRA)

Because we collect an email address and, upon activation, link it to device usage data, we act as a data controller/business under these frameworks for that data. You may have rights to access, correct, delete, or export your data, and to opt out of marketing, as described in Section 6.

6. Your Rights & Choices

You can:

• Unsubscribe from marketing emails via the link in any such email.
• Request access to, correction of, or deletion of your data by emailing privacy@venom-industries.com.
• Uninstall the extension at any time, which stops all local scanning and future analytics collection from your device (previously transmitted analytics events are retained per Section 4 unless you separately request deletion).

We will respond to verified requests within 30 days.

7. Data Security

Data sent to our third-party processors is encrypted in transit via TLS. Access to license, account, and analytics data is restricted to authorized personnel.

8. Children's Privacy

SaaS Detective is intended for business and professional use and is not directed at children under 13. We do not knowingly collect data from children.

9. Affiliate Disclosure

SaaS Detective's "Visit" buttons link to third-party tools and services. Some of these are affiliate links — if you click through and make a purchase, Venom Industries LLC may earn a commission at no extra cost to you.

• Affiliate links are marked with an aff badge inside the extension so you always know which links they are.
• Our detection results are never influenced by affiliate relationships. A tool appears because it was found on the page — not because we have a commercial relationship with it.
• Affiliate commissions help fund continued development of SaaS Detective and keep the free tier free.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be reflected by an updated "Effective Date" above. Continued use of the extension after changes constitutes acceptance of the revised policy.