1.About this policy
1.1
This Privacy Policy explains how BreachDetect (“BreachDetect”, “we”, “us” or “our”) collects, uses, shares and protects personal data when you visit breachdetect.net, use the public demo, request a quote, or use the BreachDetect dashboard and API (together, the “Service”).
1.2
BreachDetect is sold to businesses only. Most of the people whose information we handle use the Service as part of their job, at a company that is a customer or is thinking of becoming one.
1.3
We handle two different kinds of personal data, and this policy covers both:
- information about the people who visit our website and use the Service, described in Sections 2 and 3; and
- personal data contained in the stealer logs and breached databases that we index, described in Section 4.
1.4
Unless we have agreed otherwise in writing, BreachDetect is the controller of the personal data described in this policy, which means we decide how and why it is processed.
1.5
Our Terms of Service govern customers’ use of the Service. Terms that are capitalized here but not defined have the meaning given in the Terms.
2.Information we collect
2.1
Account information. When you create an account, we collect your work email address and a password. You can add your name in your account settings. If you choose to sign in with Google, Google shares your name, email address and profile picture with us. Your password is handled by our authentication provider and stored only in hashed form; BreachDetect staff cannot see it.
2.2
Workspace information. When you set up or join a Workspace, we collect your company’s name, your membership of the Workspace, and the invitations you send or receive. We also keep the Monitored Domains your team saves and your Workspace’s plan settings and limits.
2.3
Sign-in and security information. To keep accounts secure, we process verification codes sent to your email, your two-step verification settings, and a record of your active sessions. For each session, this includes the IP address, the browser and operating system, an approximate location derived from the IP address, and when it was last active. You can see these sessions and sign them out from your account page.
2.4
Searches and activity. For each search run in a Workspace, whether in the dashboard or through the API, we record the search type, the term searched for, the number of results, whether it succeeded, the time, and which user or API key ran it. When the search type is a password, we do not record the password that was searched for. The Results themselves are not saved to your Workspace; they are retrieved from our index each time you search. We also count how many searches each Workspace runs per day to apply its daily allowance.
2.5
API keys. For each API key, we keep its name, its first few characters so your team can tell keys apart, a cryptographic hash of the key, who created it, when it was created and last used, and whether and by whom it was revoked. We do not keep the key itself.
2.6
Quote requests. When you ask for a quote, we collect your name, work email address, company name and the domains you would like covered, and we record when our staff reply to you.
2.7
The public demo. When you check a domain on the demo, we receive the domain and your IP address. Before the check runs, Cloudflare’s Turnstile looks at signals from your browser to tell people from bots, and we send Cloudflare your IP address when we confirm its answer. We also use your IP address, or for IPv6 the network it belongs to, to limit how many checks can be run from one network. The demo result is stored against the domain, not against you.
2.8
Technical information. Like most websites, our hosting provider receives technical details with every request, such as your IP address, browser user agent, the page requested, the referring page and the time. We use these to deliver the site, keep it secure and fix problems. We also collect anonymous visit statistics and page performance measurements, described in Section 5.4.
2.9
Communications. If you email us, we keep the message, your contact details and our reply so that we can help you and keep a record of what was agreed.
2.10
We do not buy contact lists, and we do not ask you for sensitive categories of personal data such as health information, religious beliefs or biometric data.
3.How we use information
3.1
The table below lists the purposes for which we use the information in Section 2 and, for people in the European Economic Area, the United Kingdom and Switzerland, the legal basis we rely on for each.
| Purpose | Information used | Legal basis |
|---|---|---|
| Providing the Service: creating accounts and Workspaces, signing you in, running searches, keeping the activity log and operating the API | Account, Workspace, sign-in, search and API key information | Performance of our contract with you or your employer; our legitimate interest in providing the Service to our customers’ staff |
| Applying plan limits and billing | Workspace information and daily search counts | Performance of a contract |
| Responding to quote requests and agreeing subscriptions | Quote requests and communications | Steps taken at your request before entering into a contract; our legitimate interest in responding to business enquiries |
| Keeping the Service secure, preventing fraud and abuse, and enforcing our Terms | Sign-in and security information, IP addresses, Turnstile results, technical information and search activity | Our legitimate interest in protecting the Service, our customers and the people in our data |
| Answering support questions | Account information, Workspace information and communications | Performance of a contract; our legitimate interest in helping our customers |
| Understanding how the Service is used and improving it | Search activity, technical information, visit statistics and page performance measurements, used in aggregated form where possible | Our legitimate interest in developing the Service |
| Meeting legal obligations, such as tax records, and responding to lawful requests | Any information relevant to the obligation | Compliance with a legal obligation |
3.2
We send the emails needed to run your account, such as verification codes, security notices, quotes and notice of changes to our terms. If we send you marketing email, every message will include a way to opt out, and we will respect that choice.
3.3
We do not use your information for advertising. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.
4.Personal data in breach and stealer-log data
4.1
What it is. At the core of BreachDetect is an index of data that criminals have stolen and then published or traded. It includes logs produced by information-stealing malware on infected computers, and databases leaked from breached websites and services. These records can contain email addresses, usernames, passwords, the websites or applications they were used for, IP addresses, details of the infected device, and the date and channel on which the record was posted.
4.2
Where it comes from. We collect this data from the places where compromised data circulates, including criminal forums, markets and messaging channels, and from public breach disclosures. We do not obtain it by gaining unauthorized access to anyone’s systems. Because we do not collect it from you directly and usually have no reliable way to contact the people in it, we explain our practices publicly here instead of notifying each person individually.
4.3
Why we process it. We process this data so that organizations can find out that their people, accounts and systems have been exposed, and act before the data is misused: by resetting passwords, revoking sessions and securing infected devices. The people in these records are the ones most at risk if nobody acts on it. Our legal basis is the legitimate interest, ours and our customers’, in network and information security and in preventing fraud, which the GDPR expressly recognizes. We have weighed that interest against the rights of the people concerned and put the safeguards in Sections 4.4 and 4.5 in place to protect them.
4.4
Who can see it. Only businesses with a subscription, whose Workspaces our staff have switched on, can search the index. Our Terms allow them to use it only to protect their own organization, its people and its users, and forbid them from using it to access accounts they do not control, to profile or harass anyone, or to pass it on. Passwords are shown only to customers whose plan includes them, and are masked for everyone else. The public demo shows only summary figures and a small sample with logins partly masked, and never shows passwords.
4.5
What we do not do. We do not sell or publish the index or any record in it, and we do not use it for advertising, marketing or building profiles of individuals.
4.6
How long we keep it. We keep this data for as long as it remains useful for the security purposes described above. Leaked passwords are often reused for years, so an old record can still point to a live risk. We delete records once we decide they are no longer needed for that purpose.
4.7
If you think you are in it. You can contact us at privacy@breachdetect.net to exercise your rights under Section 10. Before we tell you anything about an email address or username, we will ask you to prove that it is yours, because we will not disclose one person’s data to someone else. Deleting a record can leave you, and the organizations you work with, unaware that your credentials are exposed. If we decline a request to erase or stop processing your data because our security purposes override it, we will tell you why, and you can complain to a supervisory authority.
7.International transfers
Our service providers operate in the United States and other countries, so your information may be processed outside the country where you live. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country that has not been found to provide adequate protection, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, or on the recipient’s certification under the EU–US Data Privacy Framework and its UK and Swiss extensions. You can ask us for more information about these safeguards.
8.How long we keep information
8.1
We keep personal data only for as long as we need it for the purposes in this policy, then delete or de-identify it.
| Information | How long we keep it |
|---|---|
| Account information | Until you delete your account, or until your company’s Workspace is closed |
| Workspace information, search activity and API key records | For as long as your company has a subscription, then deleted or de-identified within 90 days after it ends |
| Quote requests | Up to two years after our last contact with you, or for as long as your company is a customer if it becomes one |
| Demo results | Stored by domain and replaced each time the domain is checked again; never linked to the person who ran the check |
| Demo rate-limit records, which include IP addresses | Deleted on a rolling basis once they are more than two days old |
| Technical information held by our hosting provider | For a short period, typically no more than 30 days |
| Invoices, contracts and related records | For as long as tax, accounting and other laws require |
| Breach and stealer-log data | See Section 4.6 |
8.2
We may keep information for longer where the law requires it, or where we need it to resolve a dispute, investigate a security incident or abuse, or enforce our agreements.
9.How we protect information
9.1
We use administrative, technical and organizational measures designed to protect personal data against unauthorized access, loss and alteration. These include:
- encryption of all traffic to the Service, with HTTP Strict Transport Security enforced;
- encryption of our database at rest by our hosting provider;
- storing only a hash of each API key, and never recording password search terms;
- two-step verification for accounts, and access to internal tools restricted to authorized staff; and
- bot checks and rate limits on the public demo.
9.2
No system is perfectly secure. If a security incident affects your personal data, we will notify you and the relevant authorities where the law requires it.
10.Your rights and choices
10.1
Depending on where you live, you may have the right to:
- know what personal data we hold about you and receive a copy of it;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to our processing of it, including processing based on our legitimate interests;
- receive the data you gave us in a portable format;
- withdraw any consent you have given, without affecting processing that took place before; and
- not be treated differently for exercising any of these rights.
10.2
You can update your name, manage your sessions and delete your account yourself from your account page.
10.3
To exercise any other right, email us at privacy@breachdetect.net. We will need to verify your identity before we act on a request, and we may ask for more information to do so. You may use an authorized agent, in which case we may ask for proof that they act for you. We will respond within one month, or within 45 days where US state law applies. Where the law allows us more time for complex requests, we will tell you if we need it and why.
10.4
If you use BreachDetect through your employer, some requests about Workspace information may be best handled by your company’s Workspace administrator. We may consult them, or refer you to them, where that is appropriate.
10.5
If we decline your request, we will explain why. You may appeal by replying to our decision, and we will review it and respond within the period required by law. You also have the right to complain to the data protection authority where you live or work. In the United Kingdom, this is the Information Commissioner’s Office.
11.Children
The Service is meant for businesses and is not directed at children. No one under 18 may create an account. If we learn that we have collected account information from a child, we will delete it. Breach and stealer-log data can sometimes include information about minors; we handle it as described in Section 4, and parents or guardians may contact us to exercise a child’s rights.
12.Changes to this policy
We may update this policy from time to time. The date at the top of this page shows when it last changed. If we make a material change, we will tell customers by email or through the Service before it takes effect.
13.Contact us
Questions or requests about this policy or your personal data can be sent to privacy@breachdetect.net.
Legal notices should be sent to legal@breachdetect.net, as set out in our Terms of Service.