01Who we are
Muswa.com (the "Service") is a subscription reconnaissance and threat-intelligence dashboard operated by MUSWA ("we", "us"). For the personal data of our customers and website visitors described in this policy, we act as the data controller.
This policy covers the website at muswa.com, the user dashboard — including IP, domain and ASN reconnaissance, AML and crypto-wallet screening, indicator-of-compromise (IoC) lookups, WAF/CDN origin resolution, origin discovery and the investigation case workspace — the REST API and the MCP server. It does not cover third-party websites we link to, such as external scanners listed in the "Open in" shortcuts of a report.
02Scope and key definitions
This policy applies to:
- visitors of our public marketing pages;
- registered users of the dashboard, the API and the MCP server;
- people who contact us by email, including security researchers and authorities.
A lookup is a request you make for an IP address, domain, autonomous system, wallet address or other indicator such as a file hash. A result is the report we produce for that target. Results are built from internet-facing technical data (routing, DNS, certificates, public registries, reputation lists and our own scanning), not from private communications.
03Data we collect
We collect data in three ways: what you give us, what is generated when you use the Service, and what our payment checkout tells us about a payment.
| Data | Examples | Source |
|---|---|---|
| DataAccount data | ExamplesEmail, username, password hash, account type (individual, enterprise, government), company name and website when given | SourceYou, at registration |
| DataOnboarding answers | ExamplesHow you heard about us, intended use | SourceYou, at registration (optional) |
| DataSession data | ExamplesHashed session identifier, IP address, user agent, sign-in and last-seen times | SourceGenerated when you sign in |
| DataLookup history | ExamplesTargets you queried, module, time, results returned | SourceGenerated when you use the Service |
| DataCase data | ExamplesInvestigation case names, notes and the lookups you group into them | SourceYou, when you use the case workspace |
| DataAPI keys | ExamplesKey name, prefix, hashed key, creation and last-use time | SourceGenerated when you create a key |
| DataBilling records | ExamplesPlan, period, amount, invoice status, payment reference | SourceYou and the payment checkout |
| DataCorrespondence | ExamplesEmails and messages you send us, attachments | SourceYou |
| DataSecurity logs | ExamplesAccount changes, failed sign-ins, rate-limit events, audit trail | SourceGenerated automatically |
We do not ask for, and ask you not to send us, special categories of data (health, religion, political opinions and the like).
04How we use it
| Data | Purpose | Storage | Retention |
|---|---|---|---|
| DataAccount data | PurposeCreate and run your account, authenticate you, send service emails | StoragePrimary database, encrypted disk | RetentionLife of the account, then deleted within 30 days |
| DataSession data | PurposeKeep you signed in, show active sessions, detect account takeover | StoragePrimary database (session id stored only as a hash) | RetentionUntil sign-out or expiry, at most 30 days |
| DataLookup history and results | PurposeShow your history, re-open reports, export PDFs, enforce daily quotas | StoragePrimary database | RetentionLife of the account, then deleted within 30 days |
| DataCase data | PurposeOrganise lookups into investigations, add notes, revisit cases | StoragePrimary database | RetentionLife of the account, then deleted within 30 days |
| DataAPI keys | PurposeAuthenticate API and MCP calls | StoragePrimary database (hashed) | RetentionUntil you revoke the key or close the account |
| DataBilling records | PurposeActivate plans, issue receipts, meet accounting duties | StoragePrimary database | RetentionAs long as tax and accounting law requires (up to 10 years) |
| DataCorrespondence | PurposeAnswer support, security and legal requests | StorageMailbox | RetentionUp to 24 months after the conversation ends |
| DataSecurity and audit logs | PurposeInvestigate abuse and incidents, prove what happened | StoragePrimary database | RetentionUp to 12 months |
| DataUpstream request logs | PurposeMonitor reliability of our data sources (contain targets, not your identity) | StoragePrimary database | RetentionPurged automatically after 90 days |
05Legal bases (GDPR)
Where the EU or UK General Data Protection Regulation applies, we rely on the following bases:
| Basis | Article | Used for |
|---|---|---|
| BasisPerformance of a contract | ArticleArt. 6(1)(b) | Used forAccount, sessions, lookups, API keys, plan delivery, service emails |
| BasisLegal obligation | ArticleArt. 6(1)(c) | Used forBilling and tax records, answering valid legal orders |
| BasisLegitimate interests | ArticleArt. 6(1)(f) | Used forSecurity logs, fraud and abuse prevention, bot protection, improving reliability |
| BasisConsent | ArticleArt. 6(1)(a) | Used forOptional onboarding answers; you can withdraw at any time |
Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for that assessment.
06Data about lookup targets
Most targets are infrastructure: IP addresses, networks, domains, wallet addresses and indicators such as file hashes. Some may still relate to an identifiable person, for example a domain registered by an individual or a contact email in a public registry record.
We process such data on the basis of legitimate interests in network security, abuse handling and fraud prevention, which recital 49 of the GDPR recognises. We show only what is already published by registries, DNS, certificates and similar public sources or observable from the internet. If you believe a report shows data about you that it should not, write to [email protected] and we will review it.
As a customer, you must use results lawfully and only for the purposes allowed by our Terms of Service.
07Payments
When you buy a plan we create an invoice and send you to a hosted payment page operated by a payment processor. You choose the coin and the network there. The processor tells us the invoice status, amount and a payment reference so we can activate your plan.
- We never receive private keys, seed phrases or card data.
- Public blockchain transactions are, by nature, visible to anyone. We do not control that ledger.
- Unpaid invoices expire after 24 hours.
08Who we share data with
We share personal data only with processors that help us run the Service, under written agreements that limit their use of it:
| Category | What they receive | Why |
|---|---|---|
| CategoryHosting and infrastructure | What they receiveAll data stored by the Service, encrypted at rest | WhyRun servers and databases |
| CategoryCaptcha and bot protection | What they receiveIP address, browser signals during the challenge | WhyStop automated sign-ups and credential stuffing |
| CategoryEmail delivery | What they receiveEmail address, message content | WhySend confirmations, password resets and receipts |
| CategoryPayment checkout | What they receiveInvoice amount, invoice reference, your payment details entered on their page | WhyProcess crypto payments |
When you run a lookup, we query data sources about the target. We do not send them your name, email or account details. The list of processors is available on request at [email protected].
09Requests from authorities
We may disclose data when required by a valid legal order or to prevent imminent harm to life. Every request is verified and reviewed for legal basis and scope before we respond. Where the law allows, we notify the affected user first. Our full process is published on the legal requests page.
10International transfers
Some processors may handle data outside the European Economic Area or the United Kingdom. In that case we rely on an adequacy decision of the European Commission or the UK government, or on Standard Contractual Clauses with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
11How long we keep data
Retention periods for each category are listed in section 4. In summary:
- Sessions expire after 30 days and are purged automatically.
- Email confirmation and reset links expire after 30 minutes to 24 hours and are purged the next day.
- Upstream request logs are purged after 90 days.
- When you delete your account, account data, history and API keys are removed within 30 days, except billing records we must keep.
- Backups roll over within 30 days, after which deleted data no longer exists in them.
12Security
- Passwords are hashed with Argon2id. We cannot read them.
- Session identifiers, API keys and email tokens are stored only as hashes.
- All traffic uses TLS. Cookies are HttpOnly, Secure and bound to our host.
- Sensitive account changes require a fresh captcha and an email confirmation.
- Administrative access requires a separate role and two-factor authentication, and is logged.
- We run a bug bounty programme so researchers can report issues safely.
No system is perfectly secure. If we learn of a breach that affects your data, we will notify you and the competent authority as the law requires, normally within 72 hours.
13Your rights
| Right | What it means | How |
|---|---|---|
| RightAccess | What it meansGet a copy of the personal data we hold about you | HowEmail us |
| RightRectification | What it meansCorrect inaccurate data | HowDashboard settings, or email us |
| RightErasure | What it meansDelete your account and data | HowDashboard settings, or email us |
| RightPortability | What it meansDownload your data in a machine-readable format (account, lookups, cases and more, as JSON in a ZIP) | HowDashboard settings, or email us |
| RightObjection | What it meansObject to processing based on legitimate interests | HowEmail us |
| RightRestriction | What it meansAsk us to pause processing while a dispute is resolved | HowEmail us |
| RightWithdraw consent | What it meansStop optional processing at any time | HowEmail us |
You can download a complete, machine-readable copy of your account data at any time from your dashboard settings — a ZIP of JSON files covering your profile, sessions, invoices, API keys, lookup history and results, origin-discovery tracks and investigation cases (secrets such as password and token hashes are always redacted). For the other rights, or if you cannot sign in, email us.
Send requests to [email protected] from the email address on your account. We may ask you to confirm your identity. We reply within one month, extendable by two months for complex requests. You may also complain to your local data protection authority.
14Automated decisions
Reports contain automated scores and verdicts about infrastructure, for example a reputation score for an IP address. These are aids for your own judgement. We do not make decisions about our users based solely on automated processing that produce legal or similarly significant effects. Account suspensions for abuse are always reviewed by a person.
15Cookies
We use only strictly necessary cookies. The details, including names and lifetimes, are in our cookie policy.
16Children
The Service is not directed to children and you must be at least 18 to register. If we learn that we hold data about a minor, we delete it.
17Changes to this policy
We may update this policy when the Service or the law changes. The date at the top shows the latest version. For material changes we notify registered users by email at least 14 days before they take effect.
18Contact
MUSWA
Privacy, data protection and legal requests: [email protected]
General questions and support: [email protected]