Privacy policy
Last updated 4 November 2026
Redaxa is operated by Aurelio Avila, a private individual who is the controller of your personal data ("we", "us"). No data protection officer has been appointed. This page explains what we collect, why, and how you can control it. If anything here is unclear, email redaxa@getcertsprint.com.
The short version
The text you paste into the scanner is used only to compute the result you see. It is never written to a database, a log file, an analytics tool, or a backup. We collect account and billing details needed to run a subscription (email, optional first name and billing status), a record of the consent you give before each purchase, a record of each signed-in check processed on our servers that never includes the text, the settings a Business workspace shares (its protected terms, category policies and member list), and the anonymous website action totals described below. We do not use advertising trackers or sell this data. Older accounts may retain profile details supplied before this change.
What we collect
| Data | Why |
|---|---|
| Email and optional first name (older accounts may retain previously supplied profile information) | Create and secure your account (via Supabase Auth). The sign-in is shared with Frame Witness, another product from the same controller: one email address and password open both |
| Prompt text you scan — which may contain personally identifiable information (names, email addresses, phone numbers, physical addresses), financial and payment information (card numbers, IBANs, crypto wallet addresses), and authentication information (passwords, API keys, tokens, private keys) | Sent over an encrypted connection to compute the scan result, then discarded — never stored, logged, or used for any other purpose. Free checks in the browser extension run in your browser and are not sent to us |
| Subscription status, Stripe customer ID, and the language of the workspace when you subscribe | Billing, and writing subscription emails in your language. We never see or store your card number — Stripe collects that directly |
| Purchase consent record: your IP address, the version of the Terms you accepted, when you accepted them, your browser family (such as “Chrome on Windows”), the plan you chose and the Stripe checkout session ID | A record that, before paying, you accepted the Terms and asked for immediate access, which ends your 14-day right of withdrawal; evidence to answer payment disputes and prevent fraud (GDPR Art. 6(1)(c) and (f)). It is recorded when you tick the box before checkout and kept for 13 months, then deleted, even if you delete your account sooner |
| Free-trial record: a one-way hash (SHA-256) of your email address, normalised so that variations of the same mailbox match; the fingerprint Stripe gives the card used; the subscription ID and when the trial ends | Give each person one free trial and send the reminder before it ends. It holds no email address and no card number, and it is kept after an account is deleted: otherwise deleting and re-creating an account would start another trial |
| Local scan history (timestamps and counts by category) | Stored only in your own browser’s local storage to show “Recent checks.” Prompt text and detected values are not retained in this history. Older local text previews are removed when this version reads the history; account activity metadata is described separately below |
| Offer display choice | Stored only in your own browser’s local storage: whether you last saw a time-limited offer running, and whether you dismissed its banner. It holds no personal data, is never sent to us, and lets the page keep its layout steady and stay quiet after you dismiss it |
| Check activity for signed-in accounts: time, the app or AI site the check came from, detected categories and counts, and the policy outcome | Shown to you as your activity history and export. In a Business workspace, owners and admins can also see their members' activity, with each member's email address, when signed in to Redaxa; API keys read only their own account's activity. It never includes prompt text, detected values or your IP address, and is kept while your account exists |
| Business workspace settings: the workspace name, its protected terms (the words the team chose to flag, such as client or project names, which can include people's names), its category policies, and its member list (each member's account and role) | Apply the same protection on every member's device. Stored on our servers (Supabase) while the workspace exists. Every member can read them; only owners and admins can change them. Members see teammates' email addresses masked, owners and admins see them in full to manage the team. A term or policy is deleted when an owner or admin removes it, a membership when the member leaves or is removed, and all of them when the workspace owner's account is deleted |
| Daily allowance counters | Enforce the free daily checks. Counters for visitors are stored under a one-way hash of the network address, never the address itself; each holds only a number and the start of its window |
| Session tokens | Keep you signed in (httpOnly cookies on the web app, the Windows credential store in the desktop app, and the extension's own storage in the browser extension) |
| Linux waitlist: your email address, if you join it on the Redaxa for Linux page | Tell you when Redaxa for Linux is ready. The address goes on the mailing list Redaxa shares with PC Tweaker, the same controller's other product, and is handled as the PC Tweaker privacy policy describes. Every email on that list has a one-click unsubscribe |
| Team invite tokens | If you're on a Business plan, link-based invites so you can add teammates. We don't collect a teammate's email before they join |
Sensitive data the scanner may process
Redaxa's whole purpose is to catch sensitive content before it leaves your browser, so the text you scan can legitimately contain any of the following:
- Personally identifiable information — names, email addresses, phone numbers, physical addresses.
- Financial and payment information — credit/debit card numbers, IBANs and bank account numbers, cryptocurrency wallet addresses.
- Authentication information — passwords, API keys, JWTs, private keys, security-question answers.
This content is processed only to detect and flag it to you. When a check runs on our servers (in the web app, the desktop app, or the browser extension with an active plan), the text is transmitted over an encrypted connection, used solely to compute the scan result shown to you, and is never written to a database, a log file, an analytics tool, or a backup. Free checks in the browser extension run entirely in your browser and the text is not sent to us.
Browser extension
The Redaxa browser extension runs only on the AI chat sites it supports (ChatGPT, Claude, Gemini and Perplexity). It reads the text in the chat box when you click "Check with Redaxa" and, unless you turn off "Check automatically before sending" in the extension, when you press Enter or the send button. Without an active plan, the check runs entirely in your browser and the text is not sent anywhere. With an active Pro or Business plan, the text is sent to Redaxa so your workspace's protected terms and policies apply, as described above, together with the name of the AI site, which appears in your activity history. The extension does not read any other page content and does not track your browsing. Your sign-in tokens are kept in the extension's own storage, which the websites it runs on cannot read. The extension also keeps two things on your device only, never sent to us: your automatic-check setting, and a count of checks on AI sites that found something, used once to show a link to its Chrome Web Store reviews.
What we don't do
- We don't use ad pixels or third-party trackers. The only measurement is the cookie-free counting described under Website measurement.
- We don't sell or rent your data to anyone.
- We don't use your prompt content to train any model or for any purpose beyond showing you the scan result.
Who we share data with
Only the infrastructure providers required to run the service, each acting as a processor on our behalf:
- Supabase — authentication and account database (EU region).
- Stripe — payment processing. Card details are collected and stored by Stripe directly; we never handle them. Purchases are sold through Link, Stripe's merchant of record, which handles the transaction under its own privacy policy.
- Vercel — application hosting.
- Resend — delivery of account and subscription emails.
When you check a public GitHub repository, Redaxa downloads it from GitHub and sends the names and versions of its dependencies to OSV.dev to look up known vulnerabilities. Nothing about you is included in either request.
We do not share your data with advertisers, data brokers, or any other third party.
How long we keep it
Account data is kept while your account is active. The free-trial record described above is kept for as long as Redaxa offers free trials. The purchase consent record is kept for 13 months after the purchase, then deleted. Redaxa has no separate licence activations to log: your plan follows your account, so no activation record or IP address is kept for it. Prompt text is never stored in the first place — there's nothing to retain or delete.
Deleting your account
You can delete your account yourself, on the web or in the Windows app, under Account & team > Delete account. After you type your email address to confirm:
- a running subscription ends immediately, including any time already paid for, and nothing more is charged;
- your settings, protected terms, API keys, activity history, team invitations and workspace memberships are deleted at once, and a Business workspace you own is deleted with its protected terms and policies, so its members lose access to it;
- your sign-in is deleted and every app and browser signed in to the account is signed out. If the same sign-in still holds a Frame Witness licence or trial, it is kept so Frame Witness keeps working, and every session is signed out all the same;
- we send one email confirming what was deleted.
The customer record Stripe held for your Redaxa subscription, with its saved payment method, is deleted too. What stays: invoices and payments, which Stripe keeps for as long as tax and accounting law requires; the pseudonymous free-trial record described above, which holds no email address or card number; the purchase consent record, until its 13 months end; and what Redaxa saved on your own devices, such as recent check summaries or a profile photo in your browser, until you clear it or uninstall the app. The server log that records a deletion names nobody. You can also ask us to delete your account by writing to redaxa@getcertsprint.com.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict its processing. You can delete your account yourself, as described above; for anything else, contact redaxa@getcertsprint.com. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, or with the supervisory authority of the EU country where you live or work.
Age
Redaxa is not directed at children. You must be at least 16 years old, or the age of digital consent in your country if higher, to create an account.
Changes to this policy
If this policy changes materially, we'll update the date at the top of this page and, where required, notify you by email.
Website measurement
We count website visits and predefined actions as daily totals. The measurement database stores only day, product, action and count: no prompt text, detected values, email addresses, account identifiers or IP addresses. Requests go to our Cloudflare service at redexa.getcertsprint.com. Page views on this site are also counted by Cloudflare Web Analytics, which sets no cookies and does not fingerprint visitors. No tracking cookies or persistent visitor identifiers are set. Do Not Track and Global Privacy Control are respected. Counts are not unique users. Hosting providers process network information to deliver requests.