Terms of use

1.Who we are and acceptance

Scanfull (scanfull.dev) is operated by Smart Data Invest LLC, a company incorporated in the state of Delaware, United States, with an office in Orlando, Florida. In this text, "Scanfull", "we", and "our" refer to Smart Data Invest LLC and the service; "you" is the person or company using the site.

You accept these terms by using any part of the service: running a free scan, buying a plan, opening a report link, entering the reports panel, or hiring Concierge. If you use Scanfull on behalf of a company, you represent that you have authority to accept these terms for it, and "you" then includes that company.

To use Scanfull you must be at least 18 years old and legally able to enter into a contract. The service is not directed at minors.

If you do not agree with any part of these terms, do not use the service.

2.What Scanfull is — and isn’t

Scanfull is an automated security audit for sites and applications, especially those built with AI tools (Lovable, Cursor, Bolt, v0, and the like). You provide your site’s public URL; a real browser opens that site as any visitor would and runs checks on the public surface, observing the responses. The result is a score from 0 to 100 and a list of findings. In the public-surface checks we don’t write, change, or delete anything on your system.

It’s important to understand what the service is NOT:

• It is not a guarantee of security. A high score means we didn’t find the flaws we look for at that moment, not that the site is free of flaws.
• It is not insurance or a policy. A scan is a snapshot: it shows the site’s state at the instant it ran. With every new deploy the surface changes, and an old result stops being valid.
• It is not a legal opinion or certification. References to OWASP and CWE are technical classifications to guide the fix. The seal or indication about LGPD, GDPR, or privacy is indicative and does not replace legal review nor attest legal compliance.
• It is not a manual penetration test. The checks are automated and cover a defined set of problems; some kinds of flaw fall outside that set.

To run these checks, the browser may request common public paths and endpoints on your site (for example, well-known API, docs, or admin URLs) and consult public sources about your domain, such as Certificate Transparency logs, to discover subdomains. All of it stays on the public surface and is read-only: we observe the responses and never change your system.

The fix prompts are suggestions generated for your context. Before applying any change, review and test it in your environment; you decide what goes into your code.

3.Authorized use

This is the service’s core rule: you may only scan sites that are yours or for which you have written authorization from the owner. It applies to the free scan, the paid plans, and Concierge.

By providing a URL or an access session, you represent that:

• You are the owner, controller, or administrator of the site, or you have written authorization from whoever is, and you can produce it if we ask.
• You understand that accessing or testing a third party’s system without authorization may violate laws such as the Computer Fraud and Abuse Act (CFAA) in the United States and equivalent laws in other countries, and that all civil and criminal liability for such conduct is yours, not ours.
• You will use the result only to fix and protect your own site, never to attack, exploit, or expose third parties.

Also prohibited: bypassing usage limits, automating calls to the service without our permission, trying to interfere with Scanfull’s infrastructure, reselling or relicensing the service as your own, using the service to build a competing product, or putting a password, token, or any secret inside a URL sent for a scan.

We may refuse, interrupt, or block scans that appear to violate these rules, without notice and without a refund when there is clear bad faith. If we receive a substantiated complaint from a domain owner or a legal order, we may cooperate with the complainant and the authorities.

4.Access by link, no account

Scanfull has no sign-up and no password. Access to paid content is via a link with a unique code, shown on screen after payment and sent to the email provided at checkout. The "my reports" panel is also opened by a magic link sent to your email.

This means whoever has the link has access to the report. Keep the links safe and share them only with people who should see your site’s flaws. You are responsible for what happens to a link you forwarded, published, or let leak, and for keeping the purchase email secure.

If you lose the link, email help@scanfull.dev from the same email used for the purchase. After we confirm the purchase is yours, we resend the access. We may invalidate and reissue links when there is evidence of misuse.

5.Plans, prices, and payment

The free scan shows the score and the list of findings. The paid plans open the rest. Prices are in US dollars (US$), per scan, one-time payment — not a subscription:

• Full report — US$ 49. Opens the proof of each flaw, the fix prompt, and includes retest for 7 days.
• + User — US$ 99. Everything in the full report, plus the audit of the site’s logged-in area, using a temporary session you provide (see the section on the access session).
• + Admin — US$ 199. Everything in + User, plus the audit with an administrator session and the privilege-escalation contrast between the two profiles.
• Concierge — US$ 990. A done-for-you service, with scope and payment terms agreed separately (see the Concierge section).

If you bought a plan and want to move up to a higher one on the same scan, the upgrade charges only the difference between the two.

Recurring monitoring is a separate optional add-on — a US$ 19/month subscription on a paid report, and the only recurring charge here. Its own rules are in the "Recurring monitoring" section.

Payment is processed by Stripe. Scanfull does not receive or store your card details. Taxes, exchange fees, and your bank or card issuer’s fees, if any, are your responsibility. Prices may change; the price that applies is the one shown at the time of purchase.

6.Access session in the + User and + Admin plans

To audit the logged-in area, Scanfull needs to enter the site as a user (or as an administrator). For that, you provide a temporary session from your own browser: the cookie or token the site already created after you logged in. We never ask for, and you must never send, your password.

The session you provide:

• Travels only within the scan job, to the browser that runs the audit.
• Is ephemeral: used while the scan runs and discarded afterward. It is not stored in a database, a log, or a backup.
• Must be for an account you control, on a site you have the right to audit. By providing it, you represent that you have that right.

We recommend using a test account or, if you use a real one, ending the session (logging out) after the scan, which invalidates the provided cookie. In the logged-in checks, the browser exercises the functions available to that profile to observe the responses; it does not delete data on purpose, but you are responsible for having a backup of your system before any audit.

7.Concierge

In Concierge, the Scanfull team enters your system and fixes the flaws for you. Because this involves access and changes to your code and infrastructure, additional rules apply:

• We only start with written authorization, defining scope (which flaws, which systems, which access) and an estimated timeline.
• You are responsible for having a complete, recent backup before giving us access, and for revoking that access when the work is done.
• We deliver the fixes agreed in scope. We do not promise "100% secure": fixing the flaws found reduces risk, but does not remove the possibility of other flaws, today or after new deploys.
• Scope, final price, payment terms, and Concierge refunds are agreed separately, by email or a specific contract, which prevails over these terms where it differs.

8.Retest and validity of results

The paid plans include retest for 7 days from purchase: you fix, run again, and see whether the flaw is gone. After that window, a new scan is a new purchase.

Every result, free or paid, reflects the site’s state at the moment the scan ran. We don’t update old results automatically and are not responsible for decisions made based on an outdated scan.

9.Recurring monitoring

From a paid report you can turn on recurring monitoring: on a schedule you choose — daily or weekly — Scanfull re-runs the same automated public-surface audit on that report’s site and emails you when a new significant finding appears compared with the previous run. It is optional and stays off until you turn it on.

How it works, and what it does not promise:

• You control it. You turn monitoring on or off at any time, per report, from the "my reports" panel. Turning it off stops future runs right away.
• Alerts go to the email used for the purchase and may link to the updated report. They flag new findings; an alert is not a statement that your site is secure, and the absence of an alert is not proof that nothing changed.
• Each run is a fresh snapshot, subject to everything in "What Scanfull is — and isn’t" and "Retest and validity of results". Monitoring is not continuous protection, does not block attacks, and does not guarantee that every change will be caught, or caught immediately. A run needs your site to be reachable at that moment.
• The authorized-use rule applies to every run: monitoring may only stay on for a site that is yours or that you are authorized to audit. If that stops being true, turn it off.

Recurring monitoring is a paid add-on: a monthly subscription of US$ 19, billed through Stripe, separate from the one-time report. You can cancel it at any time from the reports panel; the cancellation takes effect at the end of the paid month, and monitoring keeps running until then. We may pause or limit monitoring runs to protect the service’s infrastructure or where we suspect misuse.

10.Refunds

Since payment is one-time and the content is released immediately, there is no subscription to cancel. On refunds, the rule is simple:

• If the paid scan fails through our fault (a service error, a report that won’t open, a duplicate charge) or if we don’t deliver the report, we refund the full amount.
• If the scan didn’t complete because your site was down, blocked access, or required something outside the scope, we try to run it again; if it still isn’t possible, we refund the amount.
• In other cases, requests made within 7 days of purchase are reviewed with common sense, case by case. We don’t refund just because the result "found no flaws" or because the score differed from what you expected: the service delivered is the audit, not a specific result.
• Concierge: per the specific agreement for that work.

Refund requests are made by email, to help@scanfull.dev, from the purchase email. The refund is made through Stripe, to the same payment method; how long it takes to appear on your statement depends on your bank. Refund rights that your country’s law grants consumers and that cannot be waived are preserved.

11.Responsible disclosure

Sometimes, while running an authorized scan, we find something that affects a third party, or we receive an alert from someone about a site that isn’t theirs. Our policy in those cases: we say the flaw exists, never where it is or how to exploit it. The technical detail only goes to whoever proves they own the domain.

By using Scanfull, you commit to acting the same way with what you discover about systems that aren’t yours.

12.Intellectual property

Scanfull’s software, audit method, texts, brand, and report format belong to Smart Data Invest LLC or are licensed to it. You receive a limited, non-exclusive, non-transferable license to use your scan’s report internally and with those working on fixing your site. You may not resell the report, republish it as your own product, or use the service or its content to create a competing service.

Your site, your code, and your data remain yours. The fix prompts delivered in the report may be used freely in your project.

We may use aggregated, anonymized scan data (for example, "x% of sites built with a given tool expose such a flaw") to improve the service and publish statistics, without identifying you or your site.

If you send us suggestions or feedback about the service, we may use them freely, with no obligation to pay or credit.

13.No warranties ("as is")

To the maximum extent permitted by law, Scanfull is provided "as is" and "as available", with no warranties of any kind, express or implied, including implied warranties of merchantability, fitness for a particular purpose, non-infringement, and those arising from trade practice.

We work with the care expected of a professional service, but we do not warrant that the service will find every flaw, that it will be available without interruptions or errors, that the results will be accurate or complete, or that your site will be secure after the fixes.

14.Limitation of liability

To the maximum extent permitted by law, Smart Data Invest LLC, its partners, officers, staff, and suppliers are not liable for indirect, incidental, special, consequential, or punitive damages, nor for lost profits, lost revenue, data, reputation, or opportunity, arising from the use or inability to use the service, even if we were advised of the possibility of such damages. This includes, for example:

• Security incidents, intrusions, leaks, or damage to your site, before or after the scan, including from flaws the scan did not detect.
• Effects of fixes you applied, or failed to apply, based on the report.
• Misuse of the service by you, such as scans of third-party sites without authorization.
• Temporary unavailability of the service or of infrastructure and payment providers.

To the maximum extent permitted by law, our total aggregate liability for any claim related to the service is limited to the amount you paid Scanfull in the 12 months before the event giving rise to the claim. If you paid nothing in that period, the limit is US$ 50.

Some jurisdictions do not allow excluding certain warranties or limiting certain damages. In those cases, the exclusions and limitations above apply only to the extent the law permits, and the mandatory rights your country’s law grants consumers are preserved.

15.Indemnification

You agree to defend, indemnify, and hold harmless Smart Data Invest LLC, its partners, officers, staff, and suppliers from any claim, loss, damage, cost, or expense (including reasonable attorneys’ fees) arising from: (a) a scan or an access session you provided without the right to do so; (b) your breach of these terms or of any law; (c) content, sites, or systems you submitted to the service; or (d) a dispute between you and a third party over the audited site.

16.Changes to these terms

We may update these terms to reflect changes in the service, the law, or how we work. The date at the top indicates the version in force. Material changes will be announced on the site and, when we have your email from a purchase, by email. Continuing to use the service after a change means accepting the new version; for purchases already made, the terms in force on the purchase date apply.

We may also change, suspend, or discontinue the service, in whole or in part, at any time. If that affects a paid scan not yet delivered, we refund the amount.

17.Governing law and venue

These terms are governed by the laws of the state of Delaware, United States (Smart Data Invest LLC’s state of incorporation), and by applicable US federal law, without regard to conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

Any dispute we can’t resolve by email will be submitted to the state or federal courts located in Orlando, Florida, United States (where our office is), and you consent to the personal jurisdiction of those courts.

Important reservation: if you use Scanfull as a consumer and the law of the country where you live grants rights that cannot be waived by contract, such as the right to sue in your home courts or to invoke consumer-protection rules, those rights are preserved and nothing in these terms removes them. If any clause is held invalid, the rest remain in force.

Before any formal action, we ask that you talk to us: most problems are resolved by email.

18.Contact

Questions, refund requests, link resends, misuse reports, or any other matter about these terms: help@scanfull.dev. Smart Data Invest LLC · 7345 W Sand Lake Rd, STE 210, Orlando, FL 32819, USA.