Privacy policy
We check domains, not people. You don't need an account to use the website, we use analytics only to see how the site is used, never for advertising, and we keep only what we need to run and protect the service.
last updated 13 October 2026Overview
spotafraud.ai is operated by Roxabo Pty Ltd (ABN 98 646 176 534) ("we", "us").
This policy explains what personal information we handle when you use the spotafraud.ai website, our API, or spotafraud inside an AI assistant, and how we handle it under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
Our service is about domains: when a website first appeared, which registered business it matches and whether it imitates a real organisation. Most of the data we work with is about domains and businesses, not individuals.
Using the website
When you check a domain on spotafraud.ai:
- The domain you check is sent to our servers to look it up.
- Our hosting provider (Google Cloud) records standard request logs: your IP address, the page or domain requested, the time, and your browser type. We keep these logs for 30 days for security and troubleshooting.
- We use your IP address in memory to limit how many checks one visitor can run. These counters are not stored and reset within a day.
- Your recent checks are saved only in your own browser (local storage) so you can re-run them. They are never sent to us; you can clear them with the "clear" link on the home page or by clearing your browser data.
You don't need an account.
Analytics and cookies
We use Google Analytics to understand how the website is used: which pages are visited (including the domains checked, which appear in page addresses), how visitors arrive, and their approximate location, language and device type. Google Analytics uses cookies for this and gives us statistics, not your name or contact details.
We don't use advertising cookies, and we don't use analytics data for advertising or to track you across other websites. You can block cookies in your browser, or install Google's opt-out add-on; the website works the same either way.
API customers
If you use our API, we keep the contact details you give us when you ask for access, and for each key the name of the organisation it was issued to and its usage limit. We store API keys only as a one-way hash, so we can't see your key after we issue it. The domains your systems check appear in our request logs, which we keep for 30 days.
AI assistants
If you use spotafraud through an AI assistant such as ChatGPT or Claude, the assistant decides when to call our check and sends us only the domain to check, plus technical details it provides: an anonymous user identifier, your approximate country and language. We use these to answer the request and to limit how often one user can call us.
We don't receive your conversation, and we don't ask for or store email text, names or phone numbers. The assistant's provider handles your conversation under its own privacy policy.
Data about domains and businesses
Our results are built from public sources: Certificate Transparency logs (public records of website certificates), the ABN register published by the Australian Business Register on data.gov.au, public DNS records, and the public homepage of domains we analyse, fetched read-only.
We link domains only to organisations such as companies and trusts, not to sole traders, and we don't store the names of individuals.
Some new domains are analysed by AI models provided by Anthropic. Only facts about the domain are sent; no information about our visitors.
How we use and share it
- To run checks and the API, and to keep the service secure and available.
- To understand which domains people are concerned about and improve our detection, using domains without IP addresses.
- We don't sell personal information, and we don't share it for advertising.
- We share it only with service providers that run our service (Google Cloud for hosting and storage, Google Analytics for usage statistics), or when the law requires it.
Our servers are in Australia (Sydney), Singapore and the United States, so some information, such as request logs, is stored overseas. We choose providers with strong security and contractual privacy protections.
Access, correction and complaints
You can ask for access to, or correction of, personal information we hold about you. Email us and we will respond within 30 days. If you're unhappy with how we handled your information, tell us first; if we don't resolve it, you can complain to the Office of the Australian Information Commissioner.
Email: support@spotafraud.ai
Security and changes
We protect information with encryption in transit, access controls and limited retention. No system is perfectly secure; if a data breach is likely to cause serious harm, we will notify you and the OAIC as the law requires.
Our service isn't directed at children under 13. We may update this policy; the date at the top shows the latest version.