The short version: we collect what an account needs to work, we keep your searches private to you, and we do not sell personal information. The rest of this page is the detail behind that sentence.
1. Who we are
DetectiveCheck is operated by [Legal Entity Name, Inc.] ("DetectiveCheck", "we", "us"). Our registered address is [Street address], [City], [State] [ZIP], United States. For privacy questions, write to [email protected].
For residents of the European Economic Area and the United Kingdom, we act as the controller of the personal data described in this policy.
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | Email address, password hash, plan, account status | You, at sign up |
| Billing data | Last four digits, card brand, billing country, invoices | Our payment processor. We never receive your full card number. |
| Search activity | The identifiers you look up, timestamps, credits consumed | You, when you run a lookup |
| Report data | The results returned for a lookup you ran | Public and licensed sources |
| Technical data | IP address, browser and device type, pages viewed, error logs | Automatically, when you use the site |
| Support data | Messages you send us and our replies | You |
Passwords you check
The password lookup does not transmit your password. It is hashed in your browser and only a short prefix of that hash is sent, which is not enough to reconstruct the password. We do not store it, log it, or associate it with your account.
3. People you look up
This section matters more here than on most services, so it gets its own heading.
When you run a lookup, we process personal information about a third party: the person you searched for. That information comes from sources that are already public or lawfully licensed. We are the controller of that processing.
If you are the person who was looked up and you want your information suppressed from future results, you can request that at any time, free, without holding an account. See Your privacy choices. We honour suppression requests regardless of where you live, not only where a law requires it.
4. Why we use it
- To provide the service, running lookups, producing reports, keeping your case history. For EEA and UK users, this is performance of a contract.
- To take payment, billing, renewals, refunds, chargebacks. Contract, and legal obligation for tax records.
- To keep the service safe, rate limiting, fraud detection, abuse investigation, enforcing the Responsible Use Policy. Legitimate interests.
- To fix and improve things, aggregated usage patterns, error diagnostics. Legitimate interests.
- To contact you, service notices always; marketing only with consent, and every marketing email has a one-click unsubscribe.
- To meet legal obligations, responding to lawful requests, keeping records we are required to keep.
We do not use your search history to build an advertising profile of you, and we do not use it to train models sold to anyone else.
5. Who we share it with
We share personal information only with service providers who process it on our instructions, under contract, and only for the purposes above:
- Payments, [payment processor], for billing and fraud screening
- Hosting and infrastructure, [hosting provider], in [region]
- Email delivery, [email provider], for account and service email
- Error and performance monitoring, [monitoring provider]
- Data sources, providers of public-record and breach data, who receive only the query needed to answer it
We may also disclose information when required by law, to respond to a valid legal process, to protect our rights or someone's safety, or in connection with a merger or sale of assets, in which case the acquirer remains bound by this policy or gives you notice before anything changes.
6. How long we keep it
| Data | Retention |
|---|---|
| Account data | While the account is open, then [30] days after deletion |
| Search history and reports | [12] months, or until you delete them, whichever is sooner |
| Billing records | [7] years, as tax law requires |
| Security and access logs | [90] days |
| Support messages | [24] months |
Deleting your account deletes your search history and saved reports. It does not delete billing records we are legally required to retain.
7. US privacy rights
Depending on your state, you may have the right to know what we collect, to get a copy, to correct it, to delete it, to opt out of sale, sharing or targeted advertising, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of it.
These rights are available under the California Consumer Privacy Act as amended by the CPRA, and under comparable laws in Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states as they take effect. We extend the same rights to every US resident rather than checking your state first.
To exercise any of them, use Your privacy choices or email [email protected]. We respond within 45 days and may extend once by another 45 where the request is complex. We will verify your identity before acting, in proportion to the sensitivity of the request. An authorised agent may submit on your behalf with written permission.
If we deny a request, we will say why, and you may appeal by replying to that decision. If the appeal is denied you may complain to your state Attorney General.
Global Privacy Control
We honour the Global Privacy Control browser signal as a valid opt-out of sale and sharing, applied automatically and without requiring an account.
8. EU and UK rights
If you are in the EEA, the UK or Switzerland, you have the right to access, rectify, erase, restrict and port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting processing already carried out.
You also have the right to complain to your supervisory authority. In the UK that is the Information Commissioner's Office; in the EEA it is the authority in your country of residence.
9. Sale and sharing of personal information
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months, including for anyone under 16.
Some privacy laws define "sale" broadly enough to capture analytics cookies. If we ever adopt a technology that meets that definition, we will update this section before turning it on, and the opt-out on Your privacy choices will cover it.
10. Security
Traffic runs over TLS. Passwords are stored using a memory-hard hashing algorithm, never in plain text or reversible form. Access to production data is limited to staff who need it and is logged. We run rate limiting and abuse detection on the lookup endpoints.
No system is perfectly secure, and we will not claim otherwise. If a breach affects your personal data we will notify you and the relevant regulator within the deadlines the law sets.
11. Minors
The service is for adults. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn that we have, we delete it. If you believe a child has given us information, write to [email protected].
12. International transfers
We operate from the United States and our infrastructure is located in [region]. If you use the service from outside the US, your information will be transferred to and processed in the US, where privacy law differs from your own.
Where we transfer personal data out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses, together with the UK Addendum where applicable, and carry out a transfer risk assessment.
13. Changes to this policy
We will post any revised version here with a new date at the top. If a change materially reduces your rights, we will give notice by email at least [30] days before it takes effect, so you can close the account first if you disagree.
14. Contact
[Legal Entity Name, Inc.]
[Street address], [City], [State] [ZIP], United States
Privacy: [email protected]
General: [email protected]
[If offering the service in the EEA or UK, an Article 27 representative must be appointed and named here.]