Privacy Policy
GT Scam & Phishing Protection
Effective date: 22 August 2026
Grenfell Technology provides the GT Scam & Phishing Protection browser extension and its associated licensing service (the Service). This policy explains what information the Service accesses, processes, stores and transmits, why it is needed, and the choices available to users.
1. Service purpose
The extension is designed to help identify scam and phishing websites, display safety warnings, maintain trusted-site choices, verify licences, receive signed data-only protection updates, and allow users to submit website reports for Grenfell Technology review.
The extension is an additional safety layer. It cannot identify every malicious website and does not replace browser and operating-system updates, antivirus software, backups, or careful review of unexpected requests.
2. Information processed locally
For supported websites, the extension may process the following information on the user's device:
- the current website address, hostname, page title and redirect chain;
- visible text, login branding, warning phrases and the presence of form controls, but not values typed into forms;
- page behaviours associated with scams, such as rapid redirects, pop-up activity, fullscreen changes, cursor locking, alarm-style audio indicators and detected support phone numbers;
- locally calculated safety scores and reasons;
- local trusted-site entries, sensitivity settings, recent block history and short-lived scam-campaign fingerprints; and
- signed trusted-domain and protection-rule configuration received from Grenfell Technology.
Trusted official sites and sites allowed by the user are excluded from page scanning. Routine page text, passwords, form values, screenshots and complete browsing history are not sent to Grenfell Technology for scanning.
3. Information sent for licensing and operation
The Service transmits the following over encrypted HTTPS connections when needed to activate and operate a licence:
- the licence key during activation;
- a randomly generated installation identifier;
- an optional customer-supplied device label;
- browser name, operating-system/platform and extension version;
- whether the extension's Protection control is on or off;
- opaque activation, enrolment and uninstall credentials;
- licence check and configuration-refresh times; and
- when the guided Windows setup is used, a product-specific computer identity generated from the Windows installation and handled through the local licensing companion.
The extension does not retain the licence key after successful activation. The licensing service stores one-way hashes of licence keys and identifiers for validation. Grenfell Technology's owner system may retain a separately encrypted recoverable copy of a newly issued licence key so it can be provided to the customer again.
4. Website reputation lookups
For the new-domain protection feature, the extension may send a hostname to the public RDAP registration service at rdap.org. This lookup is used to determine whether a domain appears to have been registered very recently. The lookup does not include page content, form values, the licence key, activation credentials or the user's identity. Results are cached locally. The RDAP service's own privacy practices apply to its processing of the network request.
5. Whitelist requests
When an authorised person enters the protection PIN and allows a blocked website, the website's hostname is allowed locally and queued for Grenfell Technology whitelist review. The request contains the hostname, the licence and anonymous installation identity needed to authenticate the request, and the time of the request.
It does not contain passwords, form values, page content, screenshots or a complete browsing history.
6. Suspicious-website reports
A suspicious-website report is not sent automatically. The user is shown a review screen and chooses whether to submit it. A submitted report may contain:
- the website hostname and complete address;
- the page title;
- the locally calculated score, threshold and detection reasons;
- detected phone numbers;
- the suspected scam or phishing type and affected brand; and
- the licence and anonymous installation identity needed to authenticate the report.
Passwords, form values, screenshots and the full page content are not included.
7. Service providers and disclosure
Grenfell Technology uses service providers needed to operate the Service, including cloud database and serverless-function infrastructure supplied by Supabase. These providers process information on Grenfell Technology's behalf to deliver licensing, signed configuration and dashboard reporting. Public RDAP infrastructure processes hostname lookup requests as described above.
Information is not sold, rented, used for targeted advertising, used for credit decisions, or disclosed for unrelated profiling. Grenfell Technology may disclose information where required by law, to protect users and the Service from fraud or abuse, or to a contracted service provider that is required to protect it and use it only to deliver the Service.
Google and Microsoft separately process information connected with their browsers and extension stores under their own terms and privacy statements.
8. Retention
Local extension data remains in the browser profile until the user clears it, removes the licence where that control is available, or uninstalls the extension. Some information may remain in browser-managed backups according to the browser vendor's behaviour.
Licensing records, authenticated reports, security events and owner audit records are retained for as long as reasonably needed to provide and support the Service, administer licences, investigate abuse, meet legal and accounting obligations, and resolve disputes. Grenfell Technology may de-identify or delete records when they are no longer needed.
9. Security
Information transmitted to Grenfell Technology is sent over HTTPS. Licence and activation secrets are protected using hashing, encryption or randomly generated opaque tokens appropriate to their purpose. Signed licence certificates and protection configuration are verified by the extension before use. No method of storage or transmission can guarantee absolute security.
10. User choices and controls
Users can:
- turn Protection on or off from the extension;
- review and remove local trusted-site entries and recent block history;
- choose whether to submit a suspicious-website report;
- remove the licence from the browser;
- uninstall the extension through the browser's extension settings; and
- contact Grenfell Technology to ask about access, correction or deletion of information associated with their licence, subject to legal and legitimate record-keeping requirements.
Turning off or removing the extension stops its webpage protection. A best-effort uninstall notification may be sent to update the licence dashboard, but it can fail if the computer is offline or the browser does not complete the request.
11. Changes to this policy
Grenfell Technology may update this policy when the Service changes or when legal or store requirements change. The current version and effective date will be published at the privacy-policy URL shown in the browser extension store listing. Material changes will be described through an appropriate customer or product notice where required.
12. Contact
Grenfell Technology
Website: www.grenfelltechnology.com.au
Email: contact@grenfelltechnology.com.au
Phone: 0490 114 551
Users may also have rights to complain to the Office of the Australian Information Commissioner or another applicable privacy regulator.
Privacy Policy
GT Scam & Phishing Protection
Effective date: 22 August 2026
Grenfell Technology provides the GT Scam & Phishing Protection browser extension and its associated licensing service (the Service). This policy explains what information the Service accesses, processes, stores and transmits, why it is needed, and the choices available to users.
1. Service purpose
The extension is designed to help identify scam and phishing websites, display safety warnings, maintain trusted-site choices, verify licences, receive signed data-only protection updates, and allow users to submit website reports for Grenfell Technology review.
The extension is an additional safety layer. It cannot identify every malicious website and does not replace browser and operating-system updates, antivirus software, backups, or careful review of unexpected requests.
2. Information processed locally
For supported websites, the extension may process the following information on the user's device:
- the current website address, hostname, page title and redirect chain;
- visible text, login branding, warning phrases and the presence of form controls, but not values typed into forms;
- page behaviours associated with scams, such as rapid redirects, pop-up activity, fullscreen changes, cursor locking, alarm-style audio indicators and detected support phone numbers;
- locally calculated safety scores and reasons;
- local trusted-site entries, sensitivity settings, recent block history and short-lived scam-campaign fingerprints; and
- signed trusted-domain and protection-rule configuration received from Grenfell Technology.
Trusted official sites and sites allowed by the user are excluded from page scanning. Routine page text, passwords, form values, screenshots and complete browsing history are not sent to Grenfell Technology for scanning.
3. Information sent for licensing and operation
The Service transmits the following over encrypted HTTPS connections when needed to activate and operate a licence:
- the licence key during activation;
- a randomly generated installation identifier;
- an optional customer-supplied device label;
- browser name, operating-system/platform and extension version;
- whether the extension's Protection control is on or off;
- opaque activation, enrolment and uninstall credentials;
- licence check and configuration-refresh times; and
- when the guided Windows setup is used, a product-specific computer identity generated from the Windows installation and handled through the local licensing companion.
The extension does not retain the licence key after successful activation. The licensing service stores one-way hashes of licence keys and identifiers for validation. Grenfell Technology's owner system may retain a separately encrypted recoverable copy of a newly issued licence key so it can be provided to the customer again.
4. Website reputation lookups
For the new-domain protection feature, the extension may send a hostname to the public RDAP registration service at rdap.org. This lookup is used to determine whether a domain appears to have been registered very recently. The lookup does not include page content, form values, the licence key, activation credentials or the user's identity. Results are cached locally. The RDAP service's own privacy practices apply to its processing of the network request.
5. Whitelist requests
When an authorised person enters the protection PIN and allows a blocked website, the website's hostname is allowed locally and queued for Grenfell Technology whitelist review. The request contains the hostname, the licence and anonymous installation identity needed to authenticate the request, and the time of the request.
It does not contain passwords, form values, page content, screenshots or a complete browsing history.
6. Suspicious-website reports
A suspicious-website report is not sent automatically. The user is shown a review screen and chooses whether to submit it. A submitted report may contain:
- the website hostname and complete address;
- the page title;
- the locally calculated score, threshold and detection reasons;
- detected phone numbers;
- the suspected scam or phishing type and affected brand; and
- the licence and anonymous installation identity needed to authenticate the report.
Passwords, form values, screenshots and the full page content are not included.
7. Service providers and disclosure
Grenfell Technology uses service providers needed to operate the Service, including cloud database and serverless-function infrastructure supplied by Supabase. These providers process information on Grenfell Technology's behalf to deliver licensing, signed configuration and dashboard reporting. Public RDAP infrastructure processes hostname lookup requests as described above.
Information is not sold, rented, used for targeted advertising, used for credit decisions, or disclosed for unrelated profiling. Grenfell Technology may disclose information where required by law, to protect users and the Service from fraud or abuse, or to a contracted service provider that is required to protect it and use it only to deliver the Service.
Google and Microsoft separately process information connected with their browsers and extension stores under their own terms and privacy statements.
8. Retention
Local extension data remains in the browser profile until the user clears it, removes the licence where that control is available, or uninstalls the extension. Some information may remain in browser-managed backups according to the browser vendor's behaviour.
Licensing records, authenticated reports, security events and owner audit records are retained for as long as reasonably needed to provide and support the Service, administer licences, investigate abuse, meet legal and accounting obligations, and resolve disputes. Grenfell Technology may de-identify or delete records when they are no longer needed.
9. Security
Information transmitted to Grenfell Technology is sent over HTTPS. Licence and activation secrets are protected using hashing, encryption or randomly generated opaque tokens appropriate to their purpose. Signed licence certificates and protection configuration are verified by the extension before use. No method of storage or transmission can guarantee absolute security.
10. User choices and controls
Users can:
- turn Protection on or off from the extension;
- review and remove local trusted-site entries and recent block history;
- choose whether to submit a suspicious-website report;
- remove the licence from the browser;
- uninstall the extension through the browser's extension settings; and
- contact Grenfell Technology to ask about access, correction or deletion of information associated with their licence, subject to legal and legitimate record-keeping requirements.
Turning off or removing the extension stops its webpage protection. A best-effort uninstall notification may be sent to update the licence dashboard, but it can fail if the computer is offline or the browser does not complete the request.
11. Changes to this policy
Grenfell Technology may update this policy when the Service changes or when legal or store requirements change. The current version and effective date will be published at the privacy-policy URL shown in the browser extension store listing. Material changes will be described through an appropriate customer or product notice where required.
12. Contact
Grenfell Technology
Website: www.grenfelltechnology.com.au
Email: contact@grenfelltechnology.com.au
Phone: 0490 114 551
Users may also have rights to complain to the Office of the Australian Information Commissioner or another applicable privacy regulator.