Privacy Policy

How FraudNuke processes personal data when you visit the website, use the browser extension or request cloud-based email and link analysis.

Last updated: 10 November 2026

1. Controller and contact

The controller for the consumer FraudNuke service is Rendercast Technologies Ltd., a company incorporated in Malta, registered office: 207 Office 12, Xatt l-Ghassara ta’ l-Gheneb, Marsa, MRS 1912, Malta; company registration number: C 117361; VAT number: MT33328523. Contact: legal@fraudnuke.ai. Privacy requests: privacy@fraudnuke.ai. For an enterprise deployment, the organisation may be the controller and we may act as processor under a separate data processing agreement.

2. Categories of personal data

• Extension analysis: the visible sender name and address, subject, relevant email excerpt, links, link text and indicators needed to assess phishing risk.
• Technical data: IP address, timestamps, software version, pseudonymous installation identifier, request volume, response times and security logs.
• Communications: information you choose to send us in support requests, feedback or security reports.
• Website data: essential server logs and any information voluntarily supplied through contact channels.

We do not need your Gmail password. The extension should not access your entire mailbox for ordinary open-message analysis. Emails can nevertheless contain sensitive personal data; avoid cloud analysis of sensitive content unless you are comfortable with the disclosed processing.

3. Purposes and GDPR legal bases

• Providing requested analysis: performance of a contract (GDPR Art. 6(1)(b)) where necessary to deliver the service requested.
• Optional cloud processing: where applicable, consent (Art. 6(1)(a)) collected through a clear opt-in; consent may be withdrawn for future processing.
• Security, abuse prevention and limited operational logging: legitimate interests (Art. 6(1)(f)), balanced against users’ rights.
• Legal compliance: legal obligation (Art. 6(1)(c)) where required.

Article 9 special-category data may be present incidentally in emails. Before public launch, we must validate an appropriate Article 9 condition or implement technical minimisation that avoids processing such data in the cloud. Consent for cloud processing does not automatically resolve every Article 9 issue.

4. How email analysis works

The extension examines the currently open Gmail message to identify risk signals. Local checks may run on the device. If you enable cloud analysis, a limited portion of the message and relevant URLs may be sent over HTTPS to FraudNuke’s backend at api.fraudnuke.ai and then, where needed, to a contracted AI provider. We aim to minimise unnecessary content, avoid sending attachments and not use email contents for advertising. This description must be verified against the production implementation and logs before publication.

5. Recipients and processors

Data may be handled by infrastructure hosting providers, AI inference providers and security/monitoring providers only as needed to provide the service. Required before launch: publish a verified list of providers, their roles, locations and links to their privacy information, including the actual OpenAI contracting entity and any hosting or logging vendors. We do not sell email content to advertisers.

6. International transfers

Where personal data is transferred outside the EEA, we will rely on a valid GDPR transfer mechanism, such as an applicable adequacy decision or Standard Contractual Clauses with supplementary measures where necessary. Specific destinations and mechanisms must be verified against our actual provider contracts before launch.

7. Retention and deletion

We intend to process email excerpts transiently and minimise persistent storage. However, actual retention periods for API logs, AI provider data, caches, backups, security logs and support correspondence must be documented and configured before public launch. We will retain data only for as long as necessary for the stated purposes or legal requirements. Users may request deletion using the contact details below.

8. Security

We use or plan to use HTTPS, access controls, secret management, rate limiting and restricted administrative access. No service can guarantee absolute security. Before public release, the deployed controls and processor agreements must be independently validated.

9. Your GDPR rights

Subject to applicable law, you may request access, correction, erasure, restriction, portability, object to processing based on legitimate interests, and withdraw consent without affecting prior lawful processing. Contact privacy@fraudnuke.ai. We will ordinarily respond within one month, subject to permitted extensions and identity verification. You may lodge a complaint with the Malta Information and Data Protection Commissioner (IDPC) or another competent supervisory authority.

10. Cookies and analytics

The marketing website should use only strictly necessary technologies by default. Any optional analytics or advertising cookies require an appropriate consent mechanism where applicable. Before launch, publish a complete cookie inventory and implement a consent interface if non-essential cookies are enabled.

11. Children

The Service is not directed at children. We do not knowingly solicit personal data from children for direct marketing. If we learn that we processed children’s personal data without an appropriate legal basis, we will take appropriate steps to delete or restrict it.

12. Automated decisions and profiling

Risk labels are generated by automated systems. They are advisory and may be wrong. We do not intend to make solely automated decisions producing legal or similarly significant effects on individuals. Users should be able to disregard a warning after reviewing the risk, subject to browser and product security controls.

13. Updates and questions

We may update this notice to reflect changes in functionality, vendors or legal requirements. Material changes will be communicated where required. Contact privacy@fraudnuke.ai.