Legal
Privacy Policy
Last updated: 3 November 2026
ScamFendr helps UK fraud victims build reimbursement claims, and helps anyone check a business against the regulatory registers before sending money. You can use it through this website or through our Telegram bot. Because our users have often just been through something distressing, we hold ourselves to a simple standard: collect the minimum, explain everything, sell nothing.
Who we are
ScamFendr ("we", "us") operates scamfendr.uk. We are the data controller for the personal data described in this policy. Contact: hello@scamfendr.uk.
What we collect, and why
Your email address — stored only as a keyed one-way hash. When you sign in we send a 6-digit code to your email. We store a keyed hash of your address (HMAC-SHA256), not the address itself, and the key is held outside the database. Someone who obtained a copy of our database could not work out which email addresses are in it. We never use your address for marketing.
To be precise, because the distinction matters: this is not the same as us having no record of you. If someone held both the database and the key, the hash would identify you — a plain hash of an email is guessable, which is why the key exists. We treat these hashes as personal data and they are covered by your right to erasure below.
Your case details. When you build a case we store what you tell us: the timeline of the scam, amounts lost, payment methods, and contact details of the scammer (phone numbers, emails, websites, names they used). This is the entire point of the product — we use it to generate your Report Fraud report, bank complaint letter, and Financial Ombudsman referral.
Evidence you upload. Screenshots and documents you attach to your case are stored encrypted at rest and linked only to your case.
Firm checks. When you search on our Check a business page, we check the name against the FCA register and warning list, Companies House, and HMRC's supervised business register. The Companies House check sends your search term to Companies House in real time. The FCA check does the same when we have no recent result for that name. HMRC's register is checked against a copy we hold. We cache the result (the business name and its register status) so the next person's check is faster. Searches are not attached to your account or used to build a profile of you. Two things do happen that we want to be precise about. Our hosting provider, Railway, logs every request to this site: the time, your IP address, your browser type and the page address, but not the business name you typed. And we hold caller IP addresses briefly in memory to stop the page being abused. Before 3 November 2026, our server logs also recorded the business name for every check. Those entries are deleted automatically by 1 February 2027, and we cannot remove them sooner.
Telegram bot. If you use our Telegram bot, the messages and images you send are
processed to classify the scam risk. To do that we send each message to Anthropic as you wrote it,
and a short message that looks like a business name is also checked against the FCA register.
With a screenshot of a chat or message, Anthropic reads the words in it and we then treat those
words like a message you typed. We do not keep any image you send.
Personal identifiers are stripped from the text before we store it, and we store the stripped text
together with the classifier's output against your session. Use /private in the bot to
have nothing stored at all; your messages are still sent to Anthropic to be classified. So that the
setting survives our servers restarting without us keeping any record of who you are, Telegram
remembers it for us, as part of the command menu in your chat with the bot. Note that
Telegram is a separate company and receives your messages under
its own privacy policy —
if you would rather not use Telegram, the website's business check and claim documents work
without it.
Saved on your device, not ours. While you are building a case, the web app keeps a copy of what you have typed in your browser's local storage, so a refresh, a closed tab or an expired sign-in does not wipe out work you may have found difficult to write. That draft never leaves your device — we cannot read it. It is deleted as soon as your case is created, when you sign out, or whenever you press Discard and start over. If you are using a shared or public computer, signing out is what clears it.
Investigator accounts. If you use our investigator tool for work, we also store your organisation's name, the name you choose to show your team, and an optional line that the person who set up your organisation writes so the team knows who to ask about continuing. Your email address is still stored only as a keyed hash.
What we do not collect: we use no advertising trackers, no analytics cookies, and no third-party ad networks. We do not sell or share your data for marketing — ever. The web app does store a sign-in token in your browser; that is essential to keep you logged in and is not used for tracking.
Visitor numbers: we count visits to our public pages using Plausible, a privacy-focused analytics service hosted in the EU. It sets no cookies, stores nothing on your device, and does not identify you or follow you to other websites. We receive counts — how many people opened a page, and which site sent them — never individuals.
Two limits we have put on it deliberately. It records the page address only, never anything you type, so when you check a business the name you searched for is not sent. And it does not run at all once you are signed in — not on your dashboard, your case, or your documents.
Counting how the service is used: separately from Plausible, we keep a small tally on our own servers of how many checks were run each day, how those checks came back, and how many documents were generated. This is how we know whether the service is being used at all.
It is a tally and nothing more. Each entry is a date, a label from a short fixed list, and a number —
for example 2026-08-05 · check · unknown · 14. There is no entry for you, no record
of which checks were yours, no IP address, and no record of the business you searched for.
Those numbers cannot be traced back to a person because nothing linking them to a person is ever
written down.
Who processes your data
We use a small number of service providers to run ScamFendr:
| Provider | What they do | Where |
|---|---|---|
| Railway | Hosts our application and database, and keeps request and error logs. | EU (Amsterdam, Netherlands). Railway is a US company; we are putting its data processing addendum in place. We have not yet confirmed where these logs are stored. |
| Cloudflare | Stores evidence files you upload and the documents we generate for you (R2 object storage). | Cloudflare’s global storage, which can be outside the UK and EU. We are moving it to EU-only storage. |
| Anthropic | Classifies the scam risk of messages and photos sent to our Telegram bot, and of text sent to our classification API. It receives each message as you wrote it, with earlier messages from the same conversation in their stripped form. Not used to train AI models. Nothing you type on this website goes to Anthropic: your documents are built from templates. | United States, under the UK Addendum to the EU standard contractual clauses in Anthropic's data processing addendum. |
| SendGrid | Sends your 6-digit sign-in codes. Receives your email address and the code. | United States. Twilio, which runs SendGrid, is certified under the UK-US data bridge. |
| Plausible | Counts visits to our public pages. Receives the page address, the site that referred you, and your country, browser and device type. It sets no cookies and does not identify you. Not used on any page you see once signed in. | EU. |
| Companies House | Receives a business name you search on our website, so we can return its registration details. A public register operated by the UK government. | UK. |
| Financial Conduct Authority | Receives a business name when we check the FCA register and have no recent result for it: a name you search on our website, or a short message to our bot that looks like a business name. The UK's financial regulator. | UK. |
| Telegram | Delivers messages to and from our bot, if you choose to use it, and remembers whether you turned on /private. Telegram is an independent controller of the messages you send it. | Telegram's own servers, under its own policy. |
Each provider we instruct may use your data only to provide its service to us. Companies House, the FCA and Telegram are not our processors — they handle data under their own terms, which is why we name them separately above.
Where your data goes
Our application and database run in the EU, in Railway's Amsterdam region. The table above shows where each provider handles your data. Where that is the United States, it names the safeguard we rely on under UK GDPR: either the UK Addendum to the EU standard contractual clauses, or the UK-US data bridge (the UK extension to the EU-US Data Privacy Framework). If you would like the current position for a specific provider, or a copy of a safeguard, email us and we will tell you plainly.
Legal bases
- Contract — storing your case data to generate the documents you asked for.
- Legitimate interests — securing the service, preventing abuse, caching firm-check results.
- Consent — where you explicitly give it (e.g. optional features that ask first).
How long we keep things
- Cases and evidence: kept while your account is active, so you can return to a claim in progress. Delete a case and it's gone from our systems.
- Sign-in codes: expire after 10 minutes and are then deleted automatically.
- Firm-check cache: business names and their register status — public register information, not personal data.
- Telegram bot messages: the stripped text and risk classification are kept against your bot session so the bot can follow a conversation and build a report. Use
/deletein the bot to clear them, or/privateto stop anything being stored in the first place. - Unfinished case drafts: held in your own browser until the case is created, you sign out, or you discard them. They are never sent to us.
- Server logs: request and error logs are kept by our hosting provider, Railway, for 90 days and then deleted automatically. We cannot shorten this or delete individual entries.
Your rights (UK GDPR)
You have the right to access, correct, delete, or export your data, and to object to or restrict our processing of it. Email hello@scamfendr.uk and we'll respond within one month. You can also complain to the Information Commissioner's Office, though we'd appreciate the chance to fix things first.
Security
All traffic is encrypted in transit (TLS). Evidence files are stored in Cloudflare R2, which encrypts them at rest. Email addresses are stored as keyed hashes, with the key held outside the database. Access to production systems is restricted and authenticated.
Changes
If we change this policy in a way that matters, we'll update the date at the top and, where the change is significant, tell you when you next sign in.