isMalicious Privacy Policy

01Who We Are

isMalicious is published by Jean-Vincent QUILICHINI, an entrepreneur individuel (EI, a sole trader) under French law, who is the controller of the personal data described in this policy. For any question about your data, or to exercise your rights, write to contact@ismalicious.com. The publisher’s full details are in the legal notice.

02Information We Collect

We process the security indicators you submit to our lookup services (IP addresses, domains, URLs, file hashes, email addresses and other values). When you create an account, we collect your name, your email address and your password, which we store only as a bcrypt hash, or the profile sent by the sign-in provider you choose, together with your organisation, your role and your API keys. When you subscribe, Stripe collects your payment details on its own page, and we receive your billing name and address, any VAT number you give and the status of your payments; your card number never reaches our servers. We keep records of your use of the Services (lookups, API requests and quota counters), the messages you send us by email or through the chat widget, and diagnostic data when the site or the API fails: the error, the page, your IP address and browser and, when you are signed in, your account identifier and email address. For a sample of visits, our error-monitoring provider also records a replay of the session, meaning the pages displayed and the interactions with them, to help us reproduce problems. When you request a readiness assessment, we also collect the professional identity details, organisation details, assessment answers and campaign attribution required to generate, store and deliver your private report. When you create an account or sign in, we also record the IP address, the browser user agent and a random device identifier, together with the account they relate to. The identifier is kept in a first-party cookie named im_device that stays in your browser for up to 400 days and is renewed each time you sign in. When you connect Google Connected Apps, we receive the inputs that Google sends to the read-only tools you approve. We keep authorization records containing your user and organisation identifiers and the granted scope, with one-way hashes of authorization codes and access and refresh tokens. Tool requests use your organisation’s current plan limits and quotas.

03How We Use Information, and on What Basis

We use this information to provide the Services you request and to manage your account and your subscription, which is necessary to perform our contract with you; to invoice and keep accounting records, which the law requires; and to secure the Services, prevent abuse and fraud, diagnose errors and improve the Services, which is our legitimate interest in running a secure and reliable service. We also measure visits and ad conversions with Google Analytics and Google Ads, subject to the choice you make in the cookie banner,. If you explicitly consent, a one-way SHA-256 hash of your normalised email and available Google click identifiers may be sent to Google Ads for conversion measurement. Assessment submissions do not enrol you in a newsletter or automated sales sequence. The IP address and device identifier are used only to secure accounts and prevent abuse, including the creation of several free accounts by the same person, which our Terms do not allow. We rely on our legitimate interest in keeping the service secure and fair for this, and we do not use them for advertising or marketing analytics. We send email in four kinds. Service emails (payment, trial, account and security notices) are part of our contract with you and always sent. Security alerts, usage warnings, product updates and the weekly digest are sent unless you turn them off, on our legitimate interest in informing you about your own account and usage; usage warnings include emails your own usage triggers, such as a reminder of a checkout you did not finish, an offer when you reach the free plan’s limit, integration tips and evaluation offers. Marketing emails (onboarding and re-engagement series, announcements) are sent only if you opted in, with one exception: a single email once your account is ready, sent to you as a customer of the service (article L34-5 of the French Postal and Electronic Communications Code). You can stop any of these, except service emails, in your notification settings or with the unsubscribe link each one carries. You can change your cookie choice at any time with the « Cookie settings » button.

04Who Receives Information

Your information is processed for us by the providers that host and run the Services (hosting, payments, email delivery, error monitoring, bot protection, audience measurement, support chat, AI features, and email and phone checks), listed with their country on our subprocessors page. If you sign in with Google, GitHub or Facebook, or confirm your identity with LinkedIn, that provider sends us your profile under its own privacy policy. To answer a lookup, the Services query public intelligence and network services (certificate transparency logs, WHOIS and RDAP registries, DNS resolvers, IP geolocation and reputation services) with the indicator being checked, never with your account details. An email address or a phone number you check is sent only to the email and phone reputation, breach and carrier providers listed on the subprocessors page. We do not sell or rent your personal information. We disclose it to public authorities only when the law requires it. If you connect IsMalicious through Google Connected Apps, Google sends tool inputs to IsMalicious and receives the requested results and delegated access and refresh tokens. Your organisation’s API keys and API secrets are not given to Google. Google processes the information it receives under its own privacy policy.

05Transfers Outside the European Union

The Services are hosted in the European Union. Some providers on our subprocessors page are established in the United States, and one in Australia. Where personal data is transferred outside the European Economic Area, the transfer relies on a safeguard provided by Chapter V of the GDPR, such as the European Commission’s adequacy decision for providers certified under the EU-U.S. Data Privacy Framework, or the standard contractual clauses adopted by the European Commission.

06Data Retention

We retain information only for as long as needed to provide the service, retrieve requested reports, prevent duplicate deliveries, preserve attribution and meet legal or operational requirements. Account data is deleted when the account is closed, except where the law requires us to keep it or where it is needed to establish or defend a legal claim. One additional exception is the expiring Connected Apps authorization records described below. Device and IP records are kept for as long as the account exists and are deleted with it. Invoices and accounting records are kept for ten years, as French law requires (article L123-22 of the French Commercial Code). After your account is deleted, indicator values you looked up may remain in our threat-intelligence data, with no link to you. You may request access or deletion by contacting us. For Google Connected Apps, authorization codes expire after five minutes and access tokens after 15 minutes. The connection grant and refresh token expire 180 days after issuance or the most recent valid refresh; refreshing extends that period. Disconnecting IsMalicious in Google’s connected apps settings revokes the grant immediately. Token hashes may remain until their expiry, even after disconnection. Closing your IsMalicious account prevents further access, but expiring authorization records containing user and organisation identifiers may remain for up to 180 days after issuance or the last valid refresh.

07Data Security

We host the Services in the European Union, encrypt connections to the website, the API and the feeds with TLS, store passwords only as bcrypt hashes and limit administrative access to production systems. We implement appropriate technical and organizational measures to protect your data from unauthorized access, disclosure, or misuse. However, no system can be completely secure, and we cannot guarantee absolute security.

08Cookies and Similar Technologies

We use the following cookies and browser storage:

• Running the site and your account. Your sign-in session and its protections (authjs.session-token, authjs.csrf-token, authjs.callback-url and the short-lived authjs.state, authjs.nonce and authjs.pkce.code_verifier, prefixed __Secure- or __Host- on HTTPS), the single sign-on state (sso_oidc_state), your language (NEXT_LOCALE), your cookie choice (im_measurement_consent_v1), your acceptance of the terms by the notice above the Google and GitHub sign-in buttons, kept until the sign-in completes (im_oauth_terms, 15 minutes), the welcome message shown once after your first sign-in (pending_notification, 5 minutes, and ismalicious_welcome_notification_seen, 1 year), the account-security device identifier described in section 2 (im_device, up to 400 days), and the check that a visit comes from a browser and not from a robot (im_hv, im_lr).
• Measuring how visitors find the site (first-party). im_acquisition_v1 (90 days), im_check_tool (30 days) and im_signup_cta (24 hours) keep the page, referrer, campaign or tool that brought you, and are copied to your account if you sign up. They are not written once you refuse measurement, and refusing deletes them. im_signup_ctx (30 days) keeps the checks made before you signed up, copied to your account when you create it.
• A/B tests (first-party). im_exp_report_conversion (90 days) keeps the version of the report page you were randomly assigned, so that a test’s results can be measured. It identifies no one. The test it served ended on 24 September 2026, and both versions now show the same page.
• Google Analytics and Google Ads. Google’s cookies (_ga, _ga_*, _gcl_*) measure visits and ad conversions. Refusing measurement in the cookie banner stops this measurement and deletes these cookies.
• Third-party features. The support chat (Crisp) sets its own cookies to keep your conversation. Bot protection on the sign-up and contact forms (Cloudflare Turnstile) and the payment page (Stripe) run from those providers’ own domains, under their own policies.
• Browser storage. The site also keeps a few values in your browser’s local and session storage for the same purposes, for example the number of checks made during the current visit, and our error-monitoring provider uses session storage to group a session replay.

You can accept or refuse measurement in the cookie banner, and change your choice at any time with the « Cookie settings » button at the bottom of the page. You can also delete cookies in your browser settings; deleting the essential ones signs you out.

09Your Rights

Under the GDPR and the French Data Protection Act, you have the right to access your personal data, to have it rectified or erased, to restrict or object to its processing, to receive it in a portable format, to withdraw your consent at any time, and to give instructions on what happens to your data after your death. To exercise these rights, write to contact@ismalicious.com; we answer within one month. You may also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr). You can disconnect IsMalicious in Google’s connected apps settings. To request deletion of the associated authorization records, write to contact@ismalicious.com.

10Changes to This Policy

We may update this Privacy Policy from time to time. We post the revised policy on this page with its new date. If a change materially affects how we use your personal data, we tell account holders by email or in the product before it takes effect.

11Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at contact@ismalicious.com.