Privacy Policy

1. Who we are

BLACKEYES is a data-removal service operated from the United Kingdom. We are the data controller for the personal data we process, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We are a privacy company: we only ever use your data to run your exposure check and your removals. We never sell, rent, or trade it. For any privacy question, email the address above or contact us.

2. What this policy covers

This policy explains how we handle personal data for visitors to our website and for people who use the free exposure check or the data-removal plan.

3. Information we collect

a) Account information

When you register, we collect your email address and a securely hashed password, along with account metadata such as your subscription status.

b) Identity details you give us for removals

To send removal requests on your behalf, we collect the details you choose to provide — such as your full name, date of birth, current and previous addresses, phone numbers, and other names you've used. These are used solely to identify your records to the companies that hold them, so they can be removed.

c) Exposure-check data

When you run an exposure check, we process your email address and store the results (which may include breached credentials, usernames, and where your data appears online) in your account so you can see and act on them.

d) Technical data

We automatically collect standard technical data such as IP address, browser and device information, and pages visited, for security, performance, and abuse prevention.

e) Payment data

Payments are handled by a third-party payment provider. We do not store your card details.

f) Communications

If you contact us, we keep those messages to resolve your enquiry.

4. Legal basis for processing

• Contract (Article 6(1)(b)) — to provide the exposure check and removal service you have asked for, to manage your account and subscription, and to include the identity details you give us inside the removal requests we send on your behalf. Putting those details in a request is the only way a company can find and delete your records, so it is necessary to perform the service you have bought rather than something separate you consent to.
• Legitimate interests (Article 6(1)(f)) — to secure our service, prevent fraud and abuse, and improve what we do
• Consent (Article 6(1)(a)) — for the optional analytics and advertising-measurement cookies described in section 12, which load only if you accept them and which you can withdraw at any time
• Legal obligation (Article 6(1)(c)) — to meet tax, accounting, and legal requirements

We do not rely on consent to run your removals. That matters in practice: withdrawing a consent you never had to give cannot switch off a service you are paying for, and we cannot stop part-way through on the basis that a consent lapsed. If you want removals to stop, cancel your plan — see section 11 for the rights that always remain available to you.

5. How we use your information

• Run your exposure check and show you the results
• Send data-erasure and opt-out requests to data brokers on your behalf, and monitor for new exposure
• Manage your account, subscription, and authentication
• Send transactional emails (confirmations, password resets, status updates)
• Detect and prevent fraud and abuse, and keep the service secure and reliable
• Comply with our legal obligations

6. Sharing your data to remove it

To do the job you've hired us for, we send your identifying details to the data brokers and people-search sites you want removed from — because that is how they locate and delete your records. We share only what's needed to identify you, only with companies that hold (or may hold) your data, and only to have it removed or suppressed. Requests are sent as your authorised agent.

We also use a small number of specialist providers to run the service. Each one acts only on our instructions under a written data-processing agreement, and none of them is permitted to use your data for their own purposes. The categories, and where each is based, are:

• Website and application hosting — United Kingdom, under a provider established in the United States
• Database and account authentication — European Economic Area
• Automation that sends and tracks your removal requests — Germany
• Transactional email delivery — European Economic Area (France)
• Business email, used to send and receive your removal correspondence — United States
• Payment processing — a PCI-DSS compliant provider in the United States and Ireland. We never see or store your card details.
• Breach and exposure data lookups — United States, Australia and the European Economic Area
• Search, language-model and anti-abuse services supporting the exposure check — United States
• Optional analytics and advertising measurement — United States, and only if you accept the cookie notice (section 12)

Where we use artificial intelligence, we restrict what it is allowed to keep. Your exposure check is largely AI-driven, and one step in preparing your removals uses a language model to tidy your address into the different formats data brokers hold it in. The service that routes those requests to the underlying models is our processor under a written agreement. The model providers behind it are not its subcontractors, so rather than take anyone's default settings on trust we restrict the routing ourselves: a request may only be served by a provider that does not collect data for its own use and does not train on it, and only by an endpoint that retains nothing once it has answered. No model provider is permitted to keep your data or learn from it.

We deliberately do not publish the individual vendor names here, because naming the exact components of a live system helps anyone trying to attack it. That is a security decision, not an attempt to be vague: if you want the full named list before you sign up — or you are carrying out a supplier risk review — email privacy@blackeyes.io and we will send it to you. We may disclose data where the law requires it. We never sell your personal data.

7. International data transfers

Some of our providers, and many of the companies we send removal requests to, are outside the UK. There are two different situations, and they rely on different safeguards.

a) Our own providers. Where a provider processes your data outside the UK, we rely on one of the transfer mechanisms UK law actually recognises:

• UK adequacy regulations, for providers in the European Economic Area
• the International Data Transfer Agreement, or the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, for other countries
• the UK Extension to the EU–US Data Privacy Framework, where a US provider is certified under it

EU Standard Contractual Clauses on their own are not a valid safeguard for a UK transfer, which is why we rely on the UK Addendum alongside them rather than the clauses by themselves.

b) The companies we ask to delete your records. When you ask us to get you removed from a company in another country, sending your identifying details to that company is not an optional extra — it is the request itself, and it cannot be done without it. That transfer is made because it is necessary to perform the contract you have entered into with us, under Article 49(1)(b) of the UK GDPR. We send only what that company needs in order to find your records, and only to have them removed or suppressed. If you would rather we did not contact companies in a particular country, tell us and we will exclude them, though we will not then be able to get you removed from them.

8. Data retention

• Account & identity details — kept while your account is active and for up to 90 days after you close it
• Exposure results & removal records — kept in your account until you delete them or close your account
• Server logs — up to 90 days
• Payment records — 6 years, as required by UK tax law
• Support messages — up to 2 years

9. Data security

We use appropriate technical and organisational measures, including encryption in transit (TLS), access controls, and secure authentication. Your exposure results and identity details are visible only to your account. No system is completely secure, so we cannot guarantee absolute security.

10. Automated processing and artificial intelligence

Parts of the service are automated, and we think you should know which. Your exposure check is run by software, and artificial intelligence is used to search for where your data appears and to read and sort the replies that come back from the companies we write to. Automated systems get things wrong: they can confuse you with someone of a similar name, or surface information that is out of date. Anything the check reports is there for you to review, not to be relied on as verified fact.

No decision that affects you is left to a machine. We do not carry out automated decision-making of the kind described in Article 22 of the UK GDPR — nothing automated decides whether you can buy, what you pay, whether you get a refund, or whether your account stays open. Where a judgement like that has to be made, a person makes it. If you ever want to know why something happened on your account, ask and we will tell you.

11. Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict, port, or object to the processing of your data, and to withdraw consent. To exercise any of these, email privacy@blackeyes.io or contact us — we'll respond within one calendar month. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Correcting your account email address. Your account email is the identifier your whole removal history is attached to, so there is no self-service way to change it — but your right to have inaccurate data corrected is not affected by that. Email us and we will change it by hand, keeping your removal history intact. We will ask you to confirm the new address first, because it is the address we act on.

12. Cookies & measurement

We use essential cookies needed for the website to work, such as authentication and session management. Separately, and only to measure our own marketing and improve the site, we use these third-party tags: Google Analytics and Google Ads conversion measurement; Microsoft Clarity, which records anonymised page interactions so we can see where the site confuses people; and — when we run campaigns there — the Meta Pixel. These set cookies and share usage signals (pages visited, whether a free check or purchase happened) with Google, Microsoft or Meta solely so we can measure our own campaigns and fix our own pages; we never sell your data or use it for third-party advertising.

If you visit from the UK or EU, none of these measurement tags load unless you accept the cookie notice — declining means nothing is loaded, and you can change your choice at any time via “Cookie choices” in the footer.

13. Age restriction

BLACKEYES is for people aged 18 and over, acting on their own data. We do not knowingly collect data from children; if we learn that a user is under 18, we will close the account and delete the data.

14. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email or a prominent notice on our website. The “last updated” date shows when it was last revised.

15. Contact

For any privacy enquiry or to exercise your rights, please contact us.