Privacy Policy

Two kinds of data

Leaked.Domains handles personal data in two distinct roles, and it matters which one applies.

Customer data

Information about you as an account holder: your name, email, billing details and how you use the platform. We are the controller for this, and sections 2 to 9 below describe how we handle it.

Index data

Records originating from third-party breaches, infostealer logs and public sources, which may concern people who have no relationship with us. Section 10 covers this separately.

What we collect about you

Information you give us

• Account details: email address, first and last name, and password (stored hashed, never in plain text).
• Optional profile and billing details: company name, telephone, and postal address where you supply them for invoicing.
• Anything you send us in a support request or domain-verification request.

Information collected automatically

• IP address, browser and device type, and operating system.
• Pages visited, timestamps, and diagnostic data.
• Authentication events, including sign-ins, failed attempts and two-factor activity.
• Your search and export activity on the platform, and API usage against your key.

Payment information

Card and payment details are collected and processed by our payment providers, not by us. We receive confirmation of the transaction and the billing details needed to issue your invoice. We never see or store your full card number.

Why we use it

• To provide the service: creating your account, authenticating you, running searches, generating reports and exports, and delivering monitoring alerts you have configured.
• To take payment: processing subscriptions, issuing invoices and managing renewals.
• To support you: answering questions and resolving problems.
• To keep the service secure: detecting abuse, investigating breaches of our terms, and protecting against fraud.
• To understand how the platform is used: which features are used and where people get stuck, so we can fix what is broken and prioritise what to build. This is aggregate product analysis, not individual profiling, and it is never used to target advertising.
• To meet legal obligations: including tax and accounting records, and responding to lawful requests.
• To communicate with you: service notices about your account and security, which you cannot opt out of while you hold an account, and product or marketing email, which you can turn off at any time in your profile or via the unsubscribe link.

Cookies and storage

We keep this deliberately minimal. We use:

• Essential cookies: session and authentication cookies, without which you cannot sign in or stay signed in. These include a CSRF token used to protect form submissions.
• Preference storage: your interface settings, such as theme, accent colour and text size, stored in your browser so the interface looks the same next time.

We do not use third-party advertising or cross-site tracking cookies. You can block or clear cookies in your browser, but the service will not work signed-in without the essential ones.

Who we share it with

We do not sell your personal data. We share it only in these situations:

• Service providers who operate parts of the service on our behalf: payment processing, email delivery, and hosting and infrastructure. They may only use the data to provide that service to us.
• Legal and regulatory requests where we are required to disclose, or where disclosure is necessary to establish or defend legal claims, prevent fraud, or protect the safety of any person.
• Business transfers: if the business is merged, acquired or sold, customer data may transfer to the acquirer. We will give notice before your data becomes subject to a different policy.

How long we keep it

• Account data: for as long as your account is open.
• Billing and invoice records: retained after closure for as long as tax and accounting law requires.
• Security and access logs: kept for a limited period for investigation and abuse prevention.
• Search and export history: retained while your account is open; you can delete individual entries and sessions yourself.

When you delete your account, it stops being accessible to you and is deactivated. We retain a minimal record where we have a legal obligation or a legitimate need to do so: principally billing history and a record of serious terms violations, so that a banned account cannot simply be recreated.

International transfers

We operate from South Korea, and our service providers may process data elsewhere. Where data is transferred out of your jurisdiction, we take reasonable steps to ensure it remains protected to the standard described in this policy.

Security

Passwords are stored hashed. Traffic is encrypted in transit. Access to production systems is restricted to the people who need it. Two-factor authentication is available on all accounts and we recommend enabling it.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affecting your personal data occurs, we will notify you and the relevant authority as required by law.

Your rights

Subject to the law that applies to you, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or provide it in a portable form. You can also withdraw consent where we relied on it, and opt out of marketing email at any time.

Much of this you can do yourself from your profile. For anything else, email info@leaked.domains from the address on your account. We will respond within the period required by applicable law. You also have the right to complain to your data-protection authority (in Korea, the Personal Information Protection Commission).

Data in the search index

The search index contains records that originated in third-party breaches, infostealer logs and publicly accessible sources. That data concerns people who did not give it to us, and we did not obtain it from them. We did not cause the incidents that exposed it.

We process this data to provide a security research and exposure-monitoring service: so that organisations and individuals can find out what has already been exposed about them and respond. Access is restricted to registered accounts, sensitive fields such as cleartext passwords are gated behind domain ownership verification, and use is bound by our Terms of Service.

If your data is in the index

You can remove your email address, or every address at a domain you own, yourself with Remove My Data. It confirms ownership by a link sent to the address or a DNS TXT record on the domain, then removes matching records from every result and lets you ask for them to be deleted.

You can also contact us at info@leaked.domains to ask what is held about you and to request removal or restriction. We will need enough information to locate the records and to confirm the request genuinely relates to you . We will not act on an unverified request, because doing so would itself be a way to attack someone.

We will consider each request on its merits and against any overriding grounds for continued processing. Removing a record from our index does not remove it from the original source or from anywhere else it has been copied.

Children

The service is not directed at anyone under 18 and we do not knowingly create accounts for them. If you believe a child has registered an account, contact us and we will remove it.

Other websites

The service links to sites we do not control, and search results may reference third-party domains. We are not responsible for their content or their privacy practices. Read their policies before giving them your data.

Changes to this policy

We may update this policy. If a change materially affects your rights, we will notify you by email or in the application before it takes effect, and update the date at the top of this page.