Privacy Policy

Who We Are

BustedLab LLC is a Wyoming-registered consumer intelligence company operating the website bustedlab.com. We are committed to protecting your privacy and handling your data with transparency and respect.

For GDPR purposes, BustedLab LLC is the data controller. Contact us at privacy@bustedlab.com.

What We Collect

Email address - collected only when you purchase unlimited access or request a sign-in link. Used exclusively for authentication and service delivery. We never sell your email or use it for advertising.

IP address - used only to enforce the free tier scan limit (2 per day). Your address is never written to storage in readable form: it is converted to a salted, one-way hash that serves purely as a counter key, and the key expires at midnight UTC. The original address cannot be recovered from what we hold.

Uploaded images - product screenshots you scan are processed in memory. Reverse-image search requires the image to be briefly retrievable by URL, so during a scan a copy is written to temporary object storage at an unguessable address and deleted as soon as the search returns. A scheduled job removes any copy left behind by an interrupted scan. Images are never associated with your email address or used for any purpose other than completing your scan.

Payment data - handled entirely by our payment provider, which acts as Merchant of Record. BustedLab never sees or stores your card details. We receive only your email address upon successful payment. The current provider is named on the checkout page before you enter any details.

Scan records - when a scan produces a confirmed verdict, we permanently record the product, its category, the two prices compared, the resulting markup, the verdict and the time. These records describe a product, never a person: they contain no IP address, no email address, no session identifier and no copy of anything you uploaded, and they cannot be linked back to you or to any other record you created. Confirmed verdicts are published at a permanent address of the form /scan/[id], which is how a shared result opens to a real page, and appear in the public index at /the-index and in the leaderboards on the home page. We do not record or publish the retail web address you scanned.

Usage counts - we keep a daily tally of how many times a handful of things happen across the whole site: scans finishing, each type of verdict being returned, the share button being tapped, the upgrade screen appearing, an email being submitted, and a purchase link being followed. These are counters and nothing else. There is no session, no visitor identifier, no page path, no referrer, no device and no location attached to them, so a count cannot be traced back to you or matched with anything else we hold. The three counts that come from your browser are rate limited using the same one-way hash of your IP address described above, and that hash is used for nothing else.

Product update list - if you choose to submit your email for product updates, we store that address, the time you submitted it, and which part of the site it came from. This is optional, it is never a condition of using the Service, and we use it only to send occasional updates about BustedLab. We do not sell, rent or share it. Unsubscribe at any time by emailing privacy@bustedlab.com, and the address is deleted.

Legal Basis for Processing (GDPR)

We process your data under the following legal bases:

• Contract - processing your email to deliver the service you paid for.
• Legitimate interests - IP-based rate limiting to prevent abuse and ensure fair access for all users.
• Legal obligation - retaining transaction records as required by applicable law.
• Consent - the optional product update list. Given when you submit the form, withdrawable at any time.

How Long We Keep Your Data

Email addresses are retained until you request deletion. Rate limit data, which holds only a one-way hash, expires automatically every 24 hours. Payment transaction records are retained for 7 years as required by US tax law. You may request deletion of all personal data at any time.

Scan records are retained indefinitely because they contain no personal data: they are measurements of products and prices. Deleting your account does not delete them, because there is nothing in them to connect to you.

Your Rights

Under GDPR, CCPA, and equivalent laws, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (the “right to be forgotten”)
• Object to processing of your data
• Request portability of your data
• Withdraw consent at any time where consent is the legal basis

To exercise any of these rights, email privacy@bustedlab.com. We respond to all requests within 30 days.

Third-Party Services

BustedLab uses the following third-party processors, each with their own privacy policies:

• Our payment provider - payment processing and Merchant of Record. Named on the checkout page.
• Resend - transactional email delivery (resend.com/privacy)
• Upstash - encrypted storage for rate-limit counters, sessions and cached scan results (upstash.com/privacy)
• Vercel - hosting, temporary image storage during a scan, and infrastructure (vercel.com/legal/privacy-policy)
• Anthropic - the vision model that identifies the product in an uploaded image. Images sent for this purpose are not used to train models (anthropic.com/legal/privacy)
• SerpApi and Serper - reverse-image and shopping search. They receive the temporary image URL and the search query, never your email address (serpapi.com/privacy, serper.dev)

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

Cookies

BustedLab sets two cookies, both strictly necessary and neither used for advertising or analytics:

• bl_session - keeps you signed in after you use a sign-in link. Set only once you sign in.
• bl_bid - a random identifier, expiring after 30 days, that counts free scans from this browser. It exists because mobile networks change your IP address mid-session, which would otherwise reset the free tier. It contains no information about you, is never linked to your email address, and is not used to track you across other websites.

No third-party advertising or analytics cookies are used, and no third-party scripts run on this site. Our usage measurement is first-party, sets no cookie, and stores only aggregate daily counts.

Data Security

All data is encrypted in transit using TLS and at rest by our storage provider. IP addresses are stored only as salted one-way hashes. We implement industry-standard security practices and review them regularly.

Contact & Complaints

Privacy inquiries: privacy@bustedlab.com

EU/UK residents have the right to lodge a complaint with their local data protection authority. For EU residents, this is typically the supervisory authority in your country of residence.