Privacy Policy

This Privacy Policy explains how Reality Inc., a Delaware corporation doing business as Scam.ai ("ScamAI," "we," "us," or "our") processes personal data in connection with our websites, applications, APIs, and related services (the "Services"). It applies to individuals who visit our sites, request a demo, subscribe, or otherwise interact with us.

Where we process personal data as a processor on behalf of a customer (for example, media submitted to our detection Services), that customer is the controller and its instructions and our Data Processing Addendum govern; this Policy then describes our own processing as a business/controller.

Information you provide: name, business email, company, role, and the content of messages when you request a demo, contact us, subscribe, apply, or create an account; authentication credentials for account holders.

Detection inputs: media, documents, and related metadata submitted to the Services for analysis. As described in our Trust Center, submitted media is analyzed to produce a result and then discarded — we retain results, scores, and metadata, not your content, except where you configure retention or where retention is necessary to provide the Services, prevent abuse, establish or defend legal claims, or comply with law. Halo performs analysis on-device and does not transmit your media to us.

Technical and usage data collected automatically: IP address, device and browser identifiers, user agent, operating system, referring URLs, approximate location derived from IP, pages viewed, and interactions, collected through cookies and similar technologies (see our Cookie Policy).

Data from third parties: information from your organization, our partners, service providers, and publicly available sources, where permitted by law.

We process personal data to: provide, operate, secure, and improve the Services; create and manage accounts; respond to inquiries and provide support; send service communications and, where permitted, marketing (which you may opt out of); detect, investigate, and prevent fraud, abuse, and security incidents; develop and improve our detection models; comply with legal obligations; and establish, exercise, or defend legal claims.

We may create and use aggregated or de-identified data — including to train, evaluate, and improve detection models — and such data is not treated as personal data. We do not sell personal data, and we do not use it for automated decisions producing legal or similarly significant effects on individuals without a lawful basis and appropriate safeguards.

Where the GDPR or UK GDPR applies, we rely on: performance of a contract; our legitimate interests in operating, securing, and improving the Services and in B2B communications (balanced against your rights); your consent (for marketing and non-essential cookies, which you may withdraw at any time without affecting prior processing); and compliance with legal obligations. Where we rely on legitimate interests, you may request further information about our balancing assessment.

We disclose personal data to: service providers and subprocessors that host and operate the Services under written contracts (see the Subprocessors page); professional advisers; authorities and other parties where required by law or to protect our rights, users, or the public; and a successor entity in connection with a merger, financing, reorganization, or sale of assets. We require recipients to protect personal data consistent with this Policy and applicable law.

We may transfer personal data to, and process it in, countries other than your own, including the United States. Where required, we implement appropriate safeguards for such transfers, including the European Commission's Standard Contractual Clauses and the UK Addendum, together with supplementary measures. You may request a copy of the relevant transfer mechanism through the contact details below.

We retain personal data only as long as necessary for the purposes described in this Policy, to comply with our legal obligations, resolve disputes, and enforce our agreements, after which we delete or de-identify it. We maintain administrative, technical, and organizational measures designed to protect personal data appropriate to the risk; ScamAI is SOC 2 Type II and GDPR compliant. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Subject to applicable law, you may request to access, correct, delete, port, restrict, or object to the processing of your personal data, and may withdraw consent. To exercise these rights, contact us as set out below; we will verify your identity and respond within the period required by law, and we may decline requests where permitted. You may also lodge a complaint with your supervisory or data-protection authority.

California residents (CCPA/CPRA): you have rights to know, access, correct, and delete personal information, to opt out of any sale or sharing of personal information (we do not sell or share personal information as those terms are defined), and to non-discrimination for exercising your rights. You may submit requests through the contact details below or an authorized agent.

The Services are intended for businesses and are not directed to children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

We may update this Policy from time to time. Material changes will be posted here with a new effective date and, where required, communicated to you. Your continued use of the Services after an update constitutes acceptance where permitted by law.

For privacy questions or to exercise your rights, contact us through the form on our site or the address published in our Trust Center. If you are in the EEA/UK and we are required to appoint a representative or data-protection officer, their details are available on request.