Muricads Privacy Policy

1. Data controller

The controller is Sharklab Srl, VAT IT06290010484, registered at Via Pio Fedi 41, 50142 Firenze (FI), Italy. Contact us at info@muricads.com. Muricads is operated at https://muricads.com.

2. Data we process

• Claim and listing data: territory, price, tier, product URL, imported store metadata, layout, colour, timestamps and claim status.
• Accountless access data: cryptographic session identifiers, hashed claim codes, hashed verified email/domain identity, recovery attempts and security events. The claim code is shown in clear text only when it is issued.
• Payment and contract data: name, email, billing country and details, order and Stripe identifiers, amount, currency, buyer type, consent records, terms version, refunds and disputes. Muricads does not receive complete card numbers.
• Technical and security data: IP-derived rate-limit hashes, request timestamps, device/browser information, server logs and Cloudflare Turnstile results.
• Analytics data: page navigation, referrer, approximate location, device, performance, exceptions, masked session replay and allowlisted aggregate product-event categories, only after analytics consent. Application-supplied custom properties exclude state, product, URL, email, order and credential identifiers; automatic URL context is stripped of query strings and fragments.
• Optional state notifications: email address, watched states and event choices, consent version and time, confirmation/management credentials, send status and technical delivery, bounce or complaint events. Management credentials are stored hashed or encrypted and are never public.
• Product health evidence: canonical product reference, source/final hostname, HTTP result, safety reason, check time and whether newly observed public ownership evidence matched. Newly crawled contact emails are hashed before reaching storage and are not retained in clear text.
• Support and withdrawal data: messages, order references, identity/contact information, confirmations and the actions taken on a request.

3. Purposes and legal bases

4. Public information

Active listing content is public by design and can be viewed by anyone. Do not submit personal information in a product title, website, app-store listing or other material that you do not want publicly associated with the territory.

5. Service providers and transfers

We use Supabase for database and realtime services, Stripe for payment processing, Cloudflare for security and optional web analytics, PostHog for optional product analytics/session replay, InMotion Hosting for application hosting, and Resend for transactional and separately requested watchlist delivery. Some providers process data outside the European Economic Area. Where required, transfers rely on an adequacy decision, the EU–US Data Privacy Framework or contractual safeguards made available by the provider.

We do not sell personal data. Analytics remains disabled until you opt in through Privacy choices.

6. Retention

• active listings remain public until expiry, replacement or removal;
• editing sessions expire after 30 days unless renewed by an authorised action;
• free-claim denial signals are retained for 30 days; temporary verification challenges are deleted after 30 days, while the non-reversible identity fingerprint remains with the permanent product authorisation and active-limit history;
• unconfirmed watchlist requests expire after 24 hours and abandoned pending records are deleted seven days later; successful delivery removes the encrypted confirmation payload immediately;
• unsubscribed, bounced or complained watchlist records are stripped of the address and active management credentials after 30 days, retaining only a non-reversible suppression fingerprint; optional delivery events and outbox records are deleted after 180 days;
• product-health check history is deleted after 180 days; the current status remains only while its listing exists, while moderation and transaction evidence may be retained where needed for legal defence;
• other security attempts and short-lived operational logs are retained only as long as needed to prevent abuse and diagnose incidents;
• payment, refund, invoice and contract evidence may be retained for up to 10 years where required for accounting, tax or legal defence;
• analytics retention follows the configured provider retention and ends earlier where deletion is requested and legally available.

These schedules are enforced by database maintenance jobs. Retention for accounting evidence and provider-side records remains subject to the professional legal and tax review described in the project launch checklist.

7. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection, and you may withdraw consent without affecting earlier lawful processing. Contact info@muricads.com. We may need to verify that a request relates to you. EEA users may also complain to their local supervisory authority; in Italy this is the Garante per la protezione dei dati personali.

Optional state notifications can be changed or stopped without an account through the preferences link included in every such email.

California residents may use the same contact for access, correction, deletion and information requests. Muricads does not sell personal information.

8. Children

Paid claims are not offered to people under 18. We do not knowingly collect personal data from children.

9. Security and changes

We use access controls, encryption in transit, hashed recovery credentials, server-side validation and rate limits. No system is completely secure. Material policy changes will be dated here; the version accepted for a paid order remains stored with that order.