Privacy Policy

We practice data minimization: we collect only what is needed to identify listings tied to you and to act on your behalf.

• Identity and contact details you give us (name, current and past addresses, emails, phone numbers) so we can find records that match you and file removals.
• Findings we discover about you (broker listings, breach and dark web exposure, content posted about you, AI exposure signals) assembled into your briefing.
• Account and billing data needed to run your subscription, including your plan, billing interval, and transaction history. Card details are collected and processed directly by our payment processor. We never receive or store full payment card numbers.
• Minimal operational logs needed for security and to run the service, such as authentication events and error records. We do not use third-party advertising trackers, and we do not run session-recording scripts on this site.

• We never sell or rent your personal information.
• We never share your data with advertisers or use it for advertising.
• We never use your data to train AI models.
• We never scan or build a profile of anyone who has not consented.

Only to deliver the service: to find records tied to you, file and track removals and takedowns, monitor for re-exposure, communicate with you about your case, take payment, secure the service, and meet legal obligations. That is the whole list.

• Our specialists and the agents they direct, limited to the case they are working.
• Service providers strictly necessary to operate the service. We use providers in four categories: payment processing, cloud hosting and storage, transactional email delivery, and breach and exposure data sources. Each is bound by contract to use your information only to provide its service to us, and none may use it for its own purposes. We maintain a current list of these providers and will give you the list on request at privacy@wipetrace.com.
• Our discovery engine, operated by WipeTrace, which queries public sources, people-search and data-broker sites, and exposure data sources using the identifiers you gave us, in order to build your briefing. Where a source requires an identifier to run a search, only the identifiers needed for that search are submitted.

We do not disclose your personal information to any other third party except as described in this policy, or with your direction, such as when we file a removal request with a data broker on your behalf.

We will be honest about a limit every company shares: a valid legal order can compel disclosure. If we are legally required to produce data, we will comply with the narrowest response the law allows, and we will notify you unless we are legally prohibited from doing so. We design for data minimization precisely so there is as little to produce as possible.

We keep data only as long as needed for your active case, your subscription, or a specific legal obligation, then delete or de-identify it.

• Briefing content and findings: kept for the life of your subscription, and deleted within 30 days of account closure unless you ask us to delete it sooner.
• Removal correspondence: retained as evidence of the requests we filed as your authorized agent, for as long as needed to prove a request was made and to defend it, and no longer than three years after the request is closed.
• Billing records: retained for the period required by tax and accounting law.
• Product analytics: not collected.

You can request deletion of your data at any time, as described below.

Depending on where you live, you may have the right to know what personal information we hold about you, to access a copy of it, to correct it, to delete it, to limit how we use sensitive information, and to opt out of the sale or sharing of your information. We do not sell or share your information, so there is nothing to opt out of, but the right exists and we honor it.

To exercise any right, email privacy@wipetrace.com. We will acknowledge your request within 10 business days and respond within 45 days, and we will tell you if we need a further 45 days. We may need to verify your identity before we act, and we will not use anything you give us for verification for any other purpose. Exercising a right never costs you anything and we will never treat you differently for using one.

If you want someone to act for you, they may submit a request as your authorized agent. We will ask for your signed permission and will verify your identity directly before acting.

California residents. Under the California Consumer Privacy Act as amended, you have the rights to know, access, delete, correct, and limit, and the right not to be discriminated against for using them. In the preceding twelve months we collected the following categories of personal information:

• Identifiers such as your name, postal addresses, email addresses, phone numbers, and account identifiers. Collected from you. Used to match records to you, file removals, and operate your account.
• Personal records under Cal. Civ. Code § 1798.80(e) such as your name, address, and telephone number. Collected from you.
• Commercial information such as your plan, billing interval, and transaction history. Collected from you and our payment processor. Used to run your subscription.
• Internet or other electronic network activity limited to security and operational logs. Collected automatically. Used to secure and operate the service.
• Inferences such as your exposure risk score, derived from the findings in your briefing. Used to prioritize and explain your case.

We disclose these categories to the service providers described above for the business purposes described above. We have not sold or shared personal information, and we have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age. This policy serves as our notice at collection.

We encrypt customer data in transit using TLS 1.2 or higher and at rest using AES-256, with backups encrypted under independent keys. Each case sits behind its own access boundary, and access is limited to the specialist assigned to your case and the agents they direct. Any security incident affecting customer data triggers immediate investigation and prompt notification of affected customers. Our security posture is described in plain language on the Pledge page. No system is perfectly secure, and we do not claim otherwise.

We scan a family member only when that person has consented. For a household member under 18, a parent or guardian on the account must consent on their behalf, and that consent is recorded against the account before any scanning begins. A child under 18 is a profile under the account and does not receive a login. The service is not directed to children using it on their own behalf, and we do not knowingly collect personal information from a child who has signed up without a parent or guardian. If you believe a child’s information has reached us that way, email privacy@wipetrace.com and we will delete it.

WipeTrace is offered to individuals who are residents of the United States, and your information is processed and stored in the United States. The site can be viewed from elsewhere, but we do not offer the service outside the United States and we do not target visitors in other countries. If you use the service from outside the United States, you understand that your information will be transferred to and processed in the United States.

We will post any change to this policy on this page and update the effective date above. If a change materially affects how we handle your information, we will notify you by email before it takes effect.

For any privacy question or to exercise a right, email privacy@wipetrace.com. This policy is issued by WipeTrace, Inc., a Delaware corporation.