Privacy Policy

Submitted URL and request metadata. We receive the URL you submit and an IP address used for abuse prevention and rate limiting. Before storage, the URL normalizer removes fragments, common tracking parameters, and query parameters whose names look like credentials, sessions, email addresses, or tokens.

Public page material.The pipeline renders the submitted public page, extracts page text and technical signals, and may take desktop and mobile screenshots. It also requests the origin's robots.txt and sitemap.xml. Enabled measurements may consult public competitor pages and third-party public sources. This is not a 1,000-page site crawl.

Audit output. We store status, scores, findings, issues, evidence, provider receipts, source diagnostics, quality labels, and capability-specific measurements needed to show and troubleshoot the report.

Information you provide separately. If you email us directly, we receive the information in that message for the purpose you selected.

• Run the audit, show progress, and produce the requested report.
• Cache a completed URL result for up to 48 hours to avoid duplicate work.
• Apply per-IP hourly and daily abuse limits.
• Diagnose pipeline failures and improve measurement quality and calibration.

Running an audit requires an email sign-in; we store the email address and a minimal profile with the account. Paid Deep Scans are processed by Razorpay — ResourceAI stores the order and payment identifiers and amount, never card or UPI credentials. The application does not include advertising trackers.

Depending on feature flags, configured credentials, and the selected capability, public page snippets and category prompts may be sent to OpenAI, Anthropic, Google Gemini, DeepSeek, or Perplexity. Retrieval measurements may also call configured public-data or external API source providers. The report's receipts and quality labels are the audit-specific record of what actually ran.

A best-effort regular-expression scrubber is applied to text chunks used by the retrieval-pool measurement. It is not applied to every stored crawl field and cannot guarantee removal of every identifier. Do not submit authenticated, private, or secret-bearing URLs.

PostgreSQL storage is accessed through Supabase. Redis is used for job queues and progress delivery. The web application is designed for Vercel-compatible hosting, and the worker runs separately.

The database schema gives audit-cache rows a 48-hour expiry and audit rows a default 90-day expiry. A service-role cleanup function can hard-delete expired audits and their capability rows. That function must be scheduled in the deployed database; an expiry timestamp alone does not prove that deletion occurred at an exact time.

To request access, correction, or deletion, email privacy@resourceai.in and include the audit ID when possible. We may ask you to confirm the account that owns the audit before acting on the request.

The schema includes a service-role-only hard-delete function. There is no public self-service deletion endpoint in this repository. We will handle applicable privacy rights according to the law that applies to the request.

• Server-side URL checks block loopback, private, link-local, carrier-grade NAT, and cloud-metadata destinations.
• DNS answers, HTTP redirects, and browser subresource hostnames are checked before server-side audit requests.
• Credential-like URL parameters are removed before the normalized audit URL is stored.
• Row-level security and service-role-only functions protect capability tables and privileged operations.

No online service can promise absolute security. If you find a vulnerability, contact security@resourceai.in.

Audits require a Supabase-backed account and use essential session cookies. The repository does not include an advertising-cookie or behavioral-tracking SDK.

ResourceAI is a business diagnostic tool and is not directed to children. We will post policy changes on this page and update the date above.