Privacy policy

How Dokima collects, uses, and protects your information. UK GDPR and Data Protection Act 2018 aligned.

The data controller for the Dokima service is Daniel Iwugo, trading as The Malware Files, registered in the United Kingdom. Privacy contact: [email protected].

The Malware Files is currently an unincorporated trading name. As such, the legal contracting party for these processing activities is Daniel Iwugo personally. We will update this notice promptly upon incorporation as a UK private limited company and notify all account holders by email.

Account information. Your email address; your display name (optional); a hashed copy of your password using a modern memory-hard hashing function configured per current OWASP Password Storage Cheat Sheet recommendations; your subscription tier.

Authentication tokens. Session tokens transmitted over TLS 1.3 only; HttpOnly + Secure + SameSite=Lax cookies; rotated on privilege change.

API keys. Argon2id-hashed copies of your API keys (the raw key is shown to you exactly once at creation and is never logged, stored in plaintext, or recoverable by us); the key prefix and last four characters for display; created and last-used timestamps; per-key usage counters.

Usage data. The Hugging Face model identifiers you scan; the resulting score Verdicts; the timestamps of your scans; your monthly scan count.

Technical and abuse-prevention data. Your IP address (rate-limiting and abuse detection); browser User-Agent; lightweight anti-abuse signals including a browser fingerprint hash; for paid-tier customers, a one-way SHA-256 hash of normalised email retained on account deletion to prevent quota-circumvention via re-signup.

Payment data. Handled by Lemon Squeezy as Merchant of Record. We receive your transaction status, plan name, billing-cycle dates, and the last four digits of your card; we do not see, store, or process your full card number, CVV, or bank details.

Under UK GDPR Article 13(1)(c), every processing purpose has a specific lawful basis. The full table:

We use a small number of subprocessors, each contracted under a Data Processing Agreement and bound to process your data only on our instructions. We aim to give reasonable prior notice of subprocessor changes (typically before they go live, by email or banner) and you may terminate your subscription with a pro-rata refund if you object to a new subprocessor.

We do not sell, rent, trade, or otherwise commercially exploit your personal data. We do not share data with advertising networks, data brokers, or AI training datasets.

Dokima's primary data source is the public Hugging Face API. Across all tiers we fetch public model metadata only (model card text, file listing, license tag, namespace info, safety flags). No model weights are downloaded. No inference is performed.

• Active account data: for the lifetime of your account.
• Deleted accounts: 30-day soft-delete grace period (recoverable on request); permanent removal thereafter, except a one-way SHA-256 hash of your normalised email which we retain solely to prevent quota-circumvention via re-signup with the same address.
• Scan history: retained until you delete it from your account or delete your account. The aggregated, anonymous scan corpus that informs methodology calibration is kept indefinitely as it contains no personal data.
• Operational logs: 30 days for structured logs; 24 hours for raw access logs.
• Payment records: 6 years per HMRC tax record-keeping requirements (Companies Act 2006).
• Security incident records: 5 years from the date of the incident or its resolution, whichever is later.

You have the following rights, all of which we will action within one calendar month of a verified request (UK GDPR Article 12(3)):

• Access (Art 15) — request a copy of the personal data we hold on you.
• Rectification (Art 16) — correct inaccurate or incomplete data.
• Erasure (Art 17) — request deletion of your data subject to our legal obligations.
• Restriction (Art 18) — restrict processing in defined circumstances.
• Portability (Art 20) — receive your data in a structured machine-readable JSON bundle.
• Object (Art 21) — object to processing based on legitimate interests.
• Withdraw consent (Art 7(3)) — for marketing email and optional analytics, at any time, from your Settings.
• Complain — lodge a complaint with the Information Commissioner's Office at ico.org.uk or by phone on 0303 123 1113.

Dokima is an AI-adjacent service: it scores publicly available AI models. To be explicit:

• We do not use customer data, scan history, or account data to train AI models — ours or anyone else's.
• We do not sell or licence customer data to AI training datasets, brokers, or third parties.
• We do not use AI to make decisions about individual users that produce legal or significant effects on them, within the meaning of UK GDPR Article 22.
• The Dokima scoring engine is rule-based and reproducible. The same Hugging Face metadata, scored under the same methodology version, will produce a byte-identical Verdict every time. The full rubric is published on the methodology page.