Protection should not cost you your privacy.
ScamLock is developed by Green Cyber Labs. This notice explains what the website, browser extension, WhatsApp and telephone assistants, and membership service process, what they do not collect, and the controls available to you.
1. Website message checks
Messages typed, pasted or spoken into the ScamLock checker are analysed in your browser. They are not automatically uploaded or saved. If you actively choose to report a suspicious message, it is sent to the service to identify its scam category and warning signs; a redacted copy is stored privately with a duplicate-prevention fingerprint and timestamps for moderation. Reports remain pending until reviewed. Only the edited public title, indicator, summary, source and review date are published after approval. Remove your personal information before reporting.
2. Browser-extension protection
ScamLock Checkout Guard examines website addresses, visible page wording and the presence of relevant checkout or security fields on your device. It does not intentionally collect typed card numbers, passwords, verification codes, complete browsing history or the contents of unrelated forms.
Local preferences, trusted domains, protection counts and websites you mark as suspicious are saved only in your browser’s extension storage. The extension does not send the addresses of websites you visit or their page contents to ScamLock. If you choose to connect a paid membership, your subscription email and membership access code are sent securely to ScamLock to verify access, then saved in extension storage so shared threat intelligence can be refreshed. Firefox asks for this data permission before the membership connection is made, and you can disconnect the membership at any time.
3. Accounts, membership and subscriptions
Customer account registration and sign-in are provided through Clerk. Clerk processes your email address, password credentials, verification status, first and last name, saved telephone number, session information and security signals needed to provide authentication, verification, password recovery, the account profile and Device Trust. ScamLock can access your verified account identity and profile information but does not receive or store your readable password.
ScamLock records a one-way fingerprint of your membership email address, Stripe customer and subscription identifiers, subscription status, renewal information, the one-way fingerprint of your membership access code and relevant account timestamps. When paid membership is activated, the saved telephone number can be connected to the call assistant. ScamLock stores only a one-way fingerprint of the connected number and its membership relationship in its membership database, while Clerk retains the readable number in the customer profile so the customer can review or update it. The complete access code is shown only during activation and is not stored in readable form on the server.
Payments are processed on Stripe’s hosted checkout. ScamLock does not receive or store your complete card number. Payment details, invoices and required billing information are processed by Stripe under its own privacy notice.
4. WhatsApp and telephone scam assistants
Messages you deliberately send to the ScamLock WhatsApp number are received through Twilio and processed on the ScamLock service to produce an automated reply. When you call the automated telephone assistant, Twilio converts your speech to text so ScamLock can assess the described message and provide spoken guidance. ScamLock does not record calls or save call audio or speech transcripts in its database. Messages are not saved unless you choose to report them. Twilio and WhatsApp may process or retain communications under their own service and privacy terms.
If optional external AI analysis is enabled, the suspicious message is sent to the configured AI provider after common email addresses, card-style numbers and disclosed security-code values have been removed where possible; AI response storage is disabled in the API request. A WhatsApp message is added to the community threat database only when you explicitly send a REPORT command. A redacted copy is held privately for review, alongside timestamps and a duplicate-prevention fingerprint. Only an edited entry approved by a reviewer can appear publicly. Automatic redaction may miss personal information, so remove it before reporting. Never say or send passwords, full payment-card details, PINs, one-time security codes or other confidential financial information.
5. Community reports and reviews
Community report totals represent actual submissions. A reported website is an unverified user signal, not a formal determination that the website is fraudulent. Website reports are limited to one vote per active member for each hostname. Optional feedback may publish your chosen first name or initials, star rating, written review and submission date.
Weekly emails, product help and report review
The corner help assistant answers product questions. If AI topic matching is enabled, an unrecognised question may be sent to the configured AI provider with common sensitive values removed where possible. API response storage is disabled. This helper receives no account or payment records and does not save conversations in ScamLock’s database.
If you choose to join the weekly scam-of-the-week email, we store your email address, consent wording, sign-up date and a private unsubscribe token. You can unsubscribe using the link in an email or by contacting greencyberlabs@gmail.com. Unsubscribing removes your address from the active list. Authorised ScamLock administrators can export the list for delivery through an email service. Newsletter consent is separate from creating an account or buying a subscription.
Community reports may contain suspicious URLs, telephone numbers, sender names and submitted wording. Basic automatic redaction is not a guarantee: please remove personal details before submission. Reviewers can edit or reject reports. Source alerts link to external publishers, whose privacy policies apply when you visit them.
6. Why information is processed
Membership information is processed to provide and administer the service you requested. Security signals and fraud-prevention controls are processed for legitimate interests in protecting members and preventing misuse. Optional public reporting and customer feedback depend on the specific choice you make before submitting them.
7. Storage, service providers and retention
ScamLock uses managed website and database infrastructure to operate the service, Clerk for customer authentication and account security, Stripe for payment processing, Twilio for WhatsApp message delivery, telephone call handling and speech recognition, and an optional external AI provider when that capability is enabled. Information is retained only while it is needed to provide the service, prevent abuse, handle disputes or meet applicable legal requirements. For privacy requests, including deletion of a report or newsletter subscription, contact greencyberlabs@gmail.com.
8. Your choices and rights
You can update your profile and password through account settings, choose not to report a message or website, remove the browser extension, stop calling or messaging the automated assistants, clear local extension data, or cancel your membership under the terms supplied at checkout. Subject to applicable UK data-protection law, you can request access to, correction of or deletion of relevant personal data, and object to certain processing. You can also raise a concern with the UK Information Commissioner’s Office.
9. Important safety limitations
Automated warnings are guidance, not guarantees. ScamLock is not a bank, insurance provider, police service or emergency-response line. If money, account access or security codes may be compromised, contact your bank immediately using independently verified contact details.