Privacy Policy

Intrudly runs intrudly.com and is the controller of the personal data described in this policy. That means we decide how and why it is used. You can reach our data protection officer at [email protected].

For Enterprise accounts, the organisation is the controller of its members' data, and Intrudly processes that data on the organisation's instructions. See our Data Processing Agreement.

What you give us

• Account details. Your email address, your name, and a profile picture if you add one or sign in with a service that provides one. Your password is handled by Clerk, our sign-in provider, and we never see it.
• Monitored addresses. The email addresses you ask us to watch. On Family, these may include addresses of people in your household. We never connect to the mailboxes behind them.
• Deletion requests. For each request: the company or website, the email address it concerns, your name if you give it, and what you want deleted. We also keep the company's replies and the outcome.
• Proof of identity. We only receive this if a company asks for it before acting on a request and you choose to provide it.
• Messages. What you send us through the contact form, live chat, or email, including your name and email address.
• Subscription details. Your plan, billing period, and subscription status. Your card details go to Stripe, our payment processor, and we never see your full card number.

What we find or create

• Findings. Exposures linked to your monitored addresses: the company involved, where the leak was found (a breach dump, forum, or paste site), when we found it, how serious it is, and what kinds of data were exposed, such as “email, home address”. We record what kinds of data leaked, not a copy of the leaked data itself.
• Dormant accounts and related identifiers. Accounts we believe are yours, and the usernames and other email addresses your breaches reveal.
• Technical data. Your IP address, browser, device, and the pages you visit. This comes from our servers, our sign-in and security providers, and, only if you agree, Google Analytics. Our Cookie Notice lists every cookie we use.

Data protection law requires a legal reason, or basis, for each way we use your data. Each use is listed below with its basis.

• Providing Intrudly. Running your account, monitoring your addresses, alerting you to exposures, finding dormant accounts, sending and tracking your requests, and helping you prepare a complaint to a regulator. Basis: our contract with you.
• Billing. Taking payment and managing your subscription. Basis: our contract with you. Keeping billing records. Basis: our legal obligations under tax and accounting law.
• Emails about the service. Exposure alerts, updates on your requests, and notices about your account, billing, or changes to our terms. Basis: our contract with you. We do not send marketing emails unless you have agreed to receive them.
• Support. Answering your messages. Basis: our contract with you, or, if you are not a customer, our legitimate interest in answering you.
• Security and abuse prevention. Protecting sign-in, blocking bots, preventing fraud, and enforcing our Terms of Service. Basis: our legitimate interest in keeping Intrudly and its users safe.
• Improving the site. Understanding how visitors find and use intrudly.com. Basis: your consent, which you can withdraw at any time.
• Legal requirements. Responding to lawful requests from authorities. Basis: our legal obligations.

If you add a household member's address on Family, you must have their permission. We use their address only to monitor it and send you the results.

To find exposures and dormant accounts, we combine automated scans, AI tools, and review by our own analysts. Analysts only see the data they need for the task in front of them.

• We never connect to your mailbox.
• We do not use your data or your findings to train AI models.
• We make no automated decisions about you that have legal or similarly significant effects. A dormant account we list is a suggestion, and you decide whether to act on it.

We do not sell your data, share it with data brokers, or use it for advertising. We share it only in the following cases.

Companies you send requests to

When you send a deletion request, the company receives what the request needs: the email address it concerns, what you want deleted, and your name if you gave it. It also receives proof of identity if it asks for it and you agree. Once the company has the request, its own privacy policy applies to what it does with it.

Other cases

• When the law requires it, or to protect the rights and safety of our users, the public, or Intrudly.
• If Intrudly is sold or merged, with the company that takes it over. We will tell you before that happens, and this policy will continue to apply to your data.

Our database is hosted in the European Union. Some of the service providers that help us run Intrudly are based in the United States and may process your data there.

For these transfers, we rely on the EU–US Data Privacy Framework when the provider is certified under it. Otherwise, we rely on the European Commission's Standard Contractual Clauses. You can ask [email protected] for a copy of these safeguards.

• Account details, monitored addresses, and findings are kept while your account is open. When you remove an address, we stop monitoring it and delete its findings.
• Request history is kept while your account is open, so the full record is there if a company reopens the matter or a complaint follows.
• Proof of identity is deleted once the request it was provided for is closed.
• Messages to support are kept for as long as we need them to help you.
• Analytics data is kept in Google Analytics for up to 14 months.

When you delete your account, we erase your account details, monitored addresses, findings, and request history within 30 days. We keep billing records for as long as tax and accounting law requires. Copies in our backups are removed as the backups are replaced on their normal schedule.

The same data protection law that your deletion requests rely on also gives you rights over the data Intrudly holds about you. You can:

• get a copy of your data;
• correct data that is wrong;
• have your data deleted;
• restrict how we use your data;
• object to uses that rely on our legitimate interests;
• receive your data in a portable format; and
• withdraw your consent at any time, for example by changing your cookie choices. This does not affect use that happened before you withdrew it.

You can do much of this yourself. Update your details in Settings, remove monitored addresses from your dashboard, or delete your account. For anything else, write to [email protected]. We reply within one month, and we may first need to confirm that the request comes from you.

You can also complain to a data protection authority, for example in the country where you live or work. To learn how erasure works with other companies, see Your rights.

Your data is encrypted in transit and at rest. Only staff who need access to do their work can reach it. If a security breach puts your data at risk, we will tell you and the relevant authority as the law requires.

You must be at least 18 to create an Intrudly account. On Family, a parent or guardian may add a child's email address for monitoring. Otherwise, we do not knowingly collect data about children. If you think we have, write to [email protected] and we will delete it.

When this policy changes, we update the date at the top of this page. If a change significantly affects how we use your data, we will email you before it takes effect.

For questions about this policy or your personal data, write to our data protection officer at [email protected]. For anything else, write to [email protected].