Privacy Policy

1. Who we are

BLACKEYES is a data-removal service operated from the United Kingdom. We are the data controller for the personal data we process, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We are a privacy company: we only ever use your data to run your exposure check and your removals. We never sell, rent, or trade it. For any privacy question, contact us.

2. What this policy covers

This policy explains how we handle personal data for visitors to our website and for people who use the free exposure check or the data-removal plan.

3. Information we collect

a) Account information

When you register, we collect your email address and a securely hashed password, along with account metadata such as your subscription status.

b) Identity details you give us for removals

To send removal requests on your behalf, we collect the details you choose to provide — such as your full name, date of birth, current and previous addresses, phone numbers, and other names you've used. These are used solely to identify your records to the companies that hold them, so they can be removed.

c) Exposure-check data

When you run an exposure check, we process your email address and store the results (which may include breached credentials, usernames, and where your data appears online) in your account so you can see and act on them.

d) Technical data

We automatically collect standard technical data such as IP address, browser and device information, and pages visited, for security, performance, and abuse prevention.

e) Payment data

Payments are handled by a third-party payment provider. We do not store your card details.

f) Communications

If you contact us, we keep those messages to resolve your enquiry.

4. Legal basis for processing

• Contract (Article 6(1)(b)) — to provide the exposure check and removal service you have asked for and to manage your account and subscription
• Legitimate interests (Article 6(1)(f)) — to secure our service, prevent fraud and abuse, and improve what we do
• Consent (Article 6(1)(a)) — where you provide identity details and authorise us to submit removal requests on your behalf, and for any optional marketing (which you can withdraw at any time)
• Legal obligation (Article 6(1)(c)) — to meet tax, accounting, and legal requirements

5. How we use your information

• Run your exposure check and show you the results
• Send data-erasure and opt-out requests to data brokers on your behalf, and monitor for new exposure
• Manage your account, subscription, and authentication
• Send transactional emails (confirmations, password resets, status updates)
• Detect and prevent fraud and abuse, and keep the service secure and reliable
• Comply with our legal obligations

6. Sharing your data to remove it

To do the job you've hired us for, we send your identifying details to the data brokers and people-search sites you want removed from — because that is how they locate and delete your records. We share only what's needed to identify you, only with companies that hold (or may hold) your data, and only to have it removed or suppressed. Requests are sent as your authorised agent.

We also use trusted providers for hosting, databases, email delivery, and payments; these are bound to protect your data. We may disclose data where the law requires it. We never sell your personal data.

7. International data transfers

Some providers, and some of the brokers we send removal requests to, are outside the UK. Where your data is transferred internationally, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions. Where you ask us to remove you from a broker in another country, sending your details there is a necessary part of performing that request.

8. Data retention

• Account & identity details — kept while your account is active and for up to 90 days after you close it
• Exposure results & removal records — kept in your account until you delete them or close your account
• Server logs — up to 90 days
• Payment records — 6 years, as required by UK tax law
• Support messages — up to 2 years

9. Data security

We use appropriate technical and organisational measures, including encryption in transit (TLS), access controls, and secure authentication. Your exposure results and identity details are visible only to your account. No system is completely secure, so we cannot guarantee absolute security.

10. Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict, port, or object to the processing of your data, and to withdraw consent. To exercise any of these, contact us — we'll respond within one calendar month. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

11. Cookies & measurement

We use essential cookies needed for the website to work, such as authentication and session management. Separately, and only to measure our own marketing, we use analytics and advertising-measurement tags: Google Analytics and Google Ads conversion measurement, and — when we run campaigns there — the Meta Pixel. These set cookies and share usage signals (pages visited, whether a free check or purchase happened) with Google or Meta solely so we can measure our own campaigns; we never sell your data or use it for third-party advertising.

If you visit from the UK or EU, none of these measurement tags load unless you accept the cookie notice — declining means nothing is loaded, and you can change your choice at any time via “Cookie choices” in the footer.

12. Age restriction

BLACKEYES is for people aged 18 and over, acting on their own data. We do not knowingly collect data from children; if we learn that a user is under 18, we will close the account and delete the data.

13. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email or a prominent notice on our website. The “last updated” date shows when it was last revised.

14. Contact

For any privacy enquiry or to exercise your rights, please contact us.