Plain-English summary
You're busy. Here's the short version, in five bullet points. Everything else on this page expands on these.
The short version
- We collect the domains you scan, the email you sign up with, and standard product analytics.
- We use that data to run scans, send you receipts, and improve the methodology.
- We do not sell your data. Ever.
- We do not train AI models on your data.
- You can delete your account and your data at any time.
What we collect
Account data. Email address, name (optional), passkey credentials, TOTP secret, organization name, billing details (handled by Stripe — we never see your card number).
Scan data. The domains you scan, the queries we generate, the responses we receive from third-party AI models, and the scores we derive. This is the core of the product.
Usage data. Pages viewed, features used, errors encountered, approximate location derived from IP, browser and device characteristics. We use PostHog with anonymization enabled.
How we use it
We use the data we collect to operate, maintain, and improve misquoted. Specifically:
- To run scans, generate reports, and deliver them to you.
- To bill you, send receipts, and handle refunds.
- To detect abuse, fraud, and security incidents.
- To improve methodology in aggregate — never on identifiable individual data.
- To send transactional emails (receipts, scan completion, alerts) and, if you opt in, marketing emails.
Retention
Scan reports are retained for the life of your account, plus 90 days after cancellation (read-only). After 90 days, identifiable scan data is archived to cold storage and anonymized for methodology purposes. Account data is deleted within 30 days of a deletion request, subject to any legal retention obligations (e.g. tax records).
Your rights
Depending on where you live, you may have the right to access, correct, delete, or port your personal data, and to object to or restrict our processing of it. You can exercise these rights from your account settings or by emailing privacy@misquoted.ai. We respond to verified requests within 30 days.
EU/EEA, UK, and California residents have additional statutory rights under GDPR, UK-GDPR, and CCPA respectively. We honor all of them.
Security
We encrypt data in transit (TLS 1.3) and at rest (AES-256). Authentication is passkey- and TOTP-based — there are no passwords to phish or leak. We log access to sensitive data, restrict it on a least-privilege basis, and review the audit log monthly. See our security page for full details.
International transfers
misquoted operates from the United States, and most of our infrastructure is U.S.-region. If you access the service from outside the U.S., your data will be transferred to and processed in the U.S. We rely on Standard Contractual Clauses for transfers from the EU/EEA and UK. See the DPA for the formal agreement.
Children's privacy
misquoted is a B2B service not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe we have, contact us immediately and we'll delete it.
Changes
We may update this policy. Material changes will be announced by email and on the homepage at least 14 days in advance. You can always see the current version date at the top of this page.
Contact
For privacy questions, data-rights requests, or anything else covered here: privacy@misquoted.ai. Our data protection officer is reachable at the same address.