Privacy Policy

• 🔍
  Breach Monitoring: Check your email addresses against known breach databases and dark web credential dumps
• ⚡
  Instant Alerts: Notify you via email when a breach is detected affecting your monitored addresses
• 📊
  Security Dashboard: Display your breach history, risk score, and remediation guidance
• 💳
  Subscription Management: Process payments via Stripe and enforce your plan's feature limits
• 📧
  Security Digests: Weekly emails summarising new findings or confirming all-clear status (legitimate interest — can be disabled in Settings)
• 🎁
  Marketing Communications: Referral invitations and promotional emails — only sent to users who have given explicit consent

• •Active accounts: Data retained for as long as your account is active and for up to 30 days after account deletion
• •Deleted accounts: All personal data permanently deleted within 30 days of account deletion request
• •Technical logs: Server and security logs retained for up to 90 days, then deleted
• •Financial records: Payment and transaction records retained for 7 years as required by UK tax law
• •Marketing consent logs: Retained for 3 years to demonstrate compliance

We use the following third-party processors to operate BreachWatch. All are bound by Data Processing Agreements (DPAs):

• •
  Stripe: Payment processing (PCI-DSS Level 1 certified). Stripe receives only the data necessary to process your payment. We never store full card details. Data may be processed in the USA under standard contractual clauses.
• •
  Base44 Platform: Secure cloud infrastructure, database hosting, and authentication. All data is encrypted at rest and in transit. Processes data in accordance with applicable data protection law.
• •
  XposedOrNot API: Breach database lookup service. Only your email address is transmitted to perform breach checks. No personal data is retained by XposedOrNot beyond the lookup request. A Data Processing Agreement (DPA) — executed 31 May 2026 — governs all transfers between BreachWatch and XposedOrNot in accordance with UK GDPR Article 28. For queries about XposedOrNot's own data practices, visit xposedornot.com/privacy.
• •
  HaveIBeenPwned API (HIBP): Publicly available breach lookup service operated by Troy Hunt. Queries are made using k-anonymity (only a partial hash of your email is transmitted). No personal data is stored. See haveibeenpwned.com/Privacy.
• •
  AI / LLM Services: Anonymised, aggregated threat data is processed by AI models to generate security insights. No personally identifiable information is shared with AI providers.

Some of our service providers are based outside the UK/EEA. Where personal data is transferred internationally, we ensure appropriate safeguards are in place:

• •UK International Data Transfer Agreements (IDTAs) or EU Standard Contractual Clauses (SCCs) for transfers to third countries
• •UK adequacy decisions for transfers to countries deemed adequate by the ICO
• •Data Processing Agreements with all international sub-processors

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• •
  Right to Know: Request details about personal information collected, used, disclosed, or sold in the past 12 months
• •
  Right to Delete: Request deletion of your personal information (available in Settings → Delete Account)
• •
  Right to Correct: Request correction of inaccurate personal information
• •
  Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioural advertising. No opt-out action is required.
• •
  Right to Limit Use of Sensitive Personal Information: We do not collect sensitive personal information as defined by CPRA.
• •
  Non-Discrimination: We will never discriminate against you for exercising your privacy rights.

To exercise CCPA rights, contact us at privacy@breachwatch.co.uk or use the in-app self-service tools in Settings.