Overview
Transparency is central to our security philosophy. This article explains exactly what data we collect, how we use it, and — equally important — what we don't do.
Data You Provide
| Data Type | Why We Collect It |
|---|---|
| Email address | Account login, notifications, smart domain verification |
| Full name / Company name | Dashboard display, correspondence |
| Domain names | Scanning for credential exposures |
| Payment information | Processed securely by Polar — we never store card numbers |
Data Collected Automatically
| Data Type | Why We Collect It |
|---|---|
| Usage data | Pages visited, features used, scan history — to improve the platform |
| Device information | Browser type, OS, IP address — for security and rate limiting |
| Session cookies | Authentication — required for login functionality |
| Analytics cookies | Platform improvement — only collected with consent (EU/EEA) |
How We Source Breach Data
Our credential exposure database is built from publicly available breach intelligence:
- Stealer log collections — credentials harvested by info-stealer malware, published or traded on dark web forums and Telegram channels
- Breach database dumps — leaked databases from documented security breaches
- Combo lists — aggregated credential lists compiled from multiple sources
We want to be absolutely clear:
- ❌ We do NOT hack into any systems to obtain credentials
- ❌ We do NOT access private networks or internal systems
- ❌ We do NOT create, distribute, or facilitate malware
- ❌ We do NOT purchase credentials directly from attackers
- ✅ We aggregate and index publicly available breach intelligence from known sources
What We Don't Store
- Your plaintext password — hashed with bcrypt before storage
- Credit card numbers — handled entirely by Polar (PCI-compliant)
- Full plaintext passwords from breach data — exposed credentials in reports are partially redacted in our database
Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | Duration of account + 30 days after deletion |
| Scan reports | 12 months from generation |
| Payment records | As required by tax/financial regulations |
| Usage logs | 90 days |
Your Rights
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Delete your personal data (subject to legal retention requirements)
- Export your data in a portable format
- Opt out of marketing communications
Contact: [email protected]