Privacy Policy

Ravionix is operated by Angstroma, Inc. (“Ravionix,” “we,” “us”). We built Ravionix because the consumer-security market has a credibility problem. This page is the literal accountability for the promises on our home page.

1. The short version

• We never persist the raw URL, SMS, email body, or password you check — only a hash and the verdict.
• For a URL/SMS/email check, your input is sent to our Cloudflare edge worker, hashed there (SHA-256), and discarded — the raw text is never written to our database.
• For a password check, your password is hashed in your browser (SHA-1) and never leaves your device. We receive only that hash, send the breach database just its first five characters (k-anonymity), and keep only that 5-character prefix.
• Anthropic, our AI provider, does not train on API customer data. Inputs are subject to Anthropic's standard API terms, which provide for short-term retention for safety/abuse review and then deletion. We do not currently hold a zero-retention contract with Anthropic.
• You can use the free checker without an account. If you have an account, you can export everything we know about you, or delete it, from settings — no email required.
• We do not sell, rent, or trade your data. We use no advertising or cross-site trackers on this site or in our extension. For product analytics on this site only we use PostHog through a first-party reverse proxy; the extension uses none.

2. Who we are

Data controller: Angstroma, Inc., a Delaware C-corporation operating the Ravionix brand. Mailing address: c/o Stripe Atlas registered agent, Wilmington, Delaware, USA. Reach us at privacy@ravionix.com.

3. What we collect

Account data (paying customers)

• Your name, email address and profile picture, received from Google or Microsoft when you sign in (through Clerk, our authentication provider)
• Google or Microsoft handle your password and 2-step verification — we never see them
• Account (tenant) ID and plan

Check data

• SHA-256 hash of the URL or message you check (NOT the raw input)
• Input type (url / sms / email-text)
• Length of input (a number, not the content)
• The verdict (safe / suspicious / scam / unknown), confidence score, and the reasoning summary the AI generated
• Timestamp and whether the result came from cache

The reasoning summary may quote signal-bearing fragments of your input — for example, “the URL contains ‘paypa1’ instead of ‘paypal’.” That is the product. The full original input is never stored.

Password breach check

• Your password is hashed in your browser (SHA-1); the password itself never leaves your device. We receive that hash in memory only.
• Only the first five characters of that hash are sent to the Have I Been Pwned (HIBP) Pwned Passwords API, which returns matches for that prefix — a technique called k-anonymity. HIBP never sees your password or its full hash, and we send no account identifier with the lookup.
• We store only that 5-character prefix, the breach occurrence count, and the severity verdict — never your password, and never the full hash.

Email breach check & monitoring

• When you check whether an email address has appeared in a data breach, that address is sent to Have I Been Pwned (HIBP) to perform the lookup. Unlike the password check, this uses HIBP's direct email search, so the full address — not an anonymized prefix — reaches HIBP. HIBP is a sub-processor under a data-processing agreement and states it does not log these searches.
• On our side, for a one-off check we store only a SHA-256 hash of the email plus the breach result (which breaches, severity, AI reasoning) — never the raw address.
• If you turn on always-on monitoring (Ravionix Pro), we must keep the address to re-check it daily, so we store it encrypted at rest (AES-256-GCM) — never in plain text. You can only monitor an address after confirming a link we email to it, and you can remove it at any time.

Waitlist (if you email us to join)

• During early access, paid plans are not available. If you email us to join the waitlist, we keep your email address and message only to tell you when paid plans launch.
• We don't use it for anything else or share it. Email hello@ravionix.com at any time and we'll remove you.

Billing data (if you buy credits or subscribe)

• Email and country (for tax compliance)
• Purchase records (which credit pack or the Ravionix Pro subscription, when, amount, and the Stripe customer / subscription identifiers)
• We never see your card number — Stripe handles all card data on its PCI-DSS Level 1 infrastructure.

Operational telemetry

• IP address, hashed with a 7-day rotating salt, kept only for abuse mitigation
• Browser user-agent family (e.g., “Chrome desktop”) — not the full string
• Error stack traces (Sentry, server-side only — the extension contains no Sentry SDK)
• Aggregate usage events (PostHog, first-party reverse-proxied — no cross-site tracking)

4. What we never collect or store

• The raw URL, SMS body, or email body that you submit for a check
• Your password (it never leaves your browser), or the full hash of your password (processed in memory only; we keep just the 5-character prefix)
• Your IP address tied to your account identity (we hash it, with salt rotation)
• Browser fingerprinting data, behavioral profiles, or cross-site activity
• Anything from our browser extension beyond what you explicitly choose to check

4b. The free checker (no account)

You can run a few checks on our website without creating an account. Here is exactly what happens to what you submit:

• Links and text are hashed (SHA-256) at our edge. The raw text is processed in memory by us and by our AI provider, Anthropic, to produce the verdict, then discarded.
• Passwords are hashed in your browser and never leave your device. We receive the hash in memory, send Have I Been Pwned only its first 5 characters (k-anonymity), and keep only that prefix.
• Cloudflare Turnstile checks that you are a person. It processes your IP address and browser challenge signals for bot protection.
• The 3-checks-per-day limit uses a salted hash of your IP address; the salt rotates weekly. Your raw IP address passes through our servers in memory only and is never stored. No cookies, no fingerprinting.
• What we keep: the hash of what you checked and the verdict. Each free check also writes a security-log entry containing the weekly-salted IP hash and the hash of what you checked, kept for up to 2 years for abuse prevention (because the salt rotates weekly, entries from different weeks cannot be linked to each other). Usage analytics for these checks use a random one-time ID, never your IP address.

5. Why we process what we do (lawful basis under GDPR)

• Article 6(1)(b) contract / steps at your request — to run the checks you ask for (free or paid), including AI analysis of what you submit; to provide your account, credits and subscriptions
• Article 6(1)(f) legitimate interest — bot protection (Cloudflare Turnstile), free-tier rate limiting, fraud prevention, security audit logging, and aggregate product analytics
• Article 6(1)(c) legal obligation — tax and accounting records for purchases

5b. If your employer uses Ravionix Team (phishing-awareness training)

You may be reading this because you clicked a link in an email that turned out to be a simulated phishing test run by your own employer. Here is exactly where you stand.

Your employer is the data controller, and Ravionix is only their processor. They chose to run the simulation, they decided who to include, and they hold your data. We act on their instructions and nothing else. If you want to know why you were included, or you want your data erased, ask your employer — they direct us, and we will help them act on it.

What we hold about you, on their behalf:

• Your work email address, encrypted at rest, plus a one-way hash of it that we use as the internal handle.
• What happened with the simulation — whether it was sent, opened, clicked, or reported.

What we do not hold:

• Nothing you typed. The disclosure page you landed on has no login form, no password field, and no data capture of any kind. Clicking the link did not give away a single credential, because there was nothing there to give them to.
• No name, job title, department, or manager. We hold an address and an outcome — that is the whole record.
• Not the email itself. The simulated message is generated, sent, and discarded; we never keep a copy.
• Nothing from your mailbox. The connection your employer authorized lets Ravionix send mail; it cannot read your email. When your administrator connected it, we made a one-time check that they are a Workspace administrator and stored nothing from that check.

The email was written by an AI model, and the model never saw your address — it is given a scenario, not a person. Under our terms, your employer may not use simulation results for hiring, firing, discipline, promotion, or performance evaluation. A click is a teachable moment, not a mark on your record. If you believe results are being used against you, tell us at legal@ravionix.com.

6. How long we keep what we keep

• Verdict history (hash + verdict + reasoning summary): user-controlled in Settings — 30 days, 90 days, 1 year, or kept indefinitely. New accounts default to 90 days in line with GDPR Article 5(1)(e) storage-limitation. The retention cron sweeps daily.
• Hashed verdicts in the global cache: 7 days for “scam”, 24 hours for “safe”, 6 hours for “suspicious”, 1 hour for “unknown”
• Audit log of security-relevant events: up to 2 years across all accounts
• Monitored email addresses (Ravionix Pro): stored encrypted until you remove them or delete your account; deleted immediately on either action
• Phishing-simulation targets and results (Ravionix Team): stored encrypted until your employer removes the target, deletes the campaign, or disconnects the mailbox — deleted immediately on any of those. The simulated email body is never stored at all.
• Account record: until you delete it, or 2 years of inactivity (whichever comes first)
• Free-tier rate-limit counters: 24 hours
• Salted IP hash in security-log entries: up to 2 years with the audit log (the salt rotates weekly, so entries from different weeks cannot be linked)
• Stripe billing records: retained by Stripe per their policy and applicable tax law (typically 7 years)

7. Who else processes your data (sub-processors)

We use the following service providers. Most include a Data Processing Agreement in their standard terms; where a provider requires a separate signature, we complete it. Have I Been Pwned is covered by its own terms of use.

• Vercel — web app hosting (US, multi-region)
• Cloudflare — edge worker, WAF, Turnstile CAPTCHA, DNS
• Neon — Postgres database (US-East)
• Upstash — Redis for rate-limit counters and verdict-cache mirror
• Clerk — authentication (handles your password, MFA factors, sessions)
• Stripe — payments (handles all card data; we never see it)
• Anthropic — Claude API for the AI verdict (does not train on API customer data; transient retention per Anthropic's standard API terms)
• Have I Been Pwned (HIBP) — the breach database. For password checks it receives only an anonymous 5-character hash prefix (k-anonymity) — no password, no full hash. For email breach checks and monitoring it receives the email address you ask us to look up, so it can return which breaches it appears in.
• Resend — transactional email
• Sentry — server-side error tracking
• PostHog — product analytics, first-party reverse-proxied
• INCLUXA — accessibility tools on our website. No cookies and no visitor data on page load; preferences stay in your browser. Only if you choose an AI tool (e.g. simplify, translate) or its feedback form is the text you choose sent to INCLUXA. Reading fonts, if you turn one on, load from Google Fonts or jsDelivr.

Google is deliberately not on this list. When a Ravionix Team customer connects their Google Workspace mailbox to send phishing-awareness training, that mailbox is their system, not our sub-processor — the mail leaves their tenant, under their own mail policy, using a grant they can revoke at any time. See Terms §4d. Google and Microsoft are also the sign-in services you choose when you create an account; for that sign-in they act under their own privacy policies.

8. Your rights

If you are in the EU, UK, EEA, Switzerland, California, or any jurisdiction with similar law:

• Access (GDPR Article 15 / CCPA right to know) — export everything we have about you in machine-readable JSON, from your account settings, in under 30 seconds.
• Erasure (Article 17 / CCPA right to delete) — delete your account from settings; we cascade-delete tenant rows and anonymize legitimate-interest audit entries within 30 days.
• Rectification (Article 16) — change your email or name from settings.
• Portability (Article 20) — same JSON export as access.
• Objection (Article 21) — stop using the product; no legitimate-interest processing continues post-erasure.
• Automated decision-making (Article 22) — our verdict is automated, but it is advisory. We do not take any action on you based on it.
• Do Not Sell or Share (CCPA / CPRA) — we do not sell or share your personal information for cross-context advertising. The toggle in settings is provided for transparency.
• Complaint — you may complain to your supervisory authority (e.g., your state attorney general, or the ICO in the UK, or your national DPA in the EU).

9. Children

Ravionix is not directed to children under 13 (under 16 in the EU/EEA and UK). We do not knowingly collect data from children under those ages. If you believe we have, email privacy@ravionix.com and we will delete it.

10. International transfers

Our infrastructure runs primarily in US-East. If you are outside the US, your data is transferred to and processed in the US under Standard Contractual Clauses (SCCs) with each sub-processor named above.

11. Security

All traffic is TLS-encrypted. Secrets at rest are stored in Vercel's encrypted environment variables. The audit log is immutable at the database layer (a Postgres trigger blocks updates and deletes outside of the retention rotation cron). We describe our threat model and mitigations in our internal Data Protection Impact Assessment, available on request to enterprise customers under NDA.

12. Breach notification

If we suffer a breach affecting your data, we will notify the relevant supervisory authority within 72 hours of becoming aware of it where the law requires (GDPR Article 33), and notify affected users without undue delay where the breach is likely to put their rights at high risk (GDPR Article 34).

13. Changes to this policy

If we make material changes, we will email you at the address on your account and post a notice at the top of this page for at least 30 days. The “Last updated” date at the top reflects the most recent revision.

14. Contact

Privacy questions, GDPR / CCPA requests, or anything you want clarified: privacy@ravionix.com.