Questions and answers about TraceErase

TraceErase helps people in the UK protect their personal data. You can check a password against known breaches, search a directory of online services for account clean-up steps, prepare and track privacy requests and complaints, and, for organisations on its managed list, have eligible requests handled for you.

It isn’t antivirus or device security, and it doesn’t prevent breaches. See the directory and how it works.

You give your name, email address and a password, and agree to the Terms of Service and Privacy Policy. Where we ask you to confirm your email address, your account isn’t ready until you open the link we send. You then sign in and reach your dashboard, which opens on the account clean-up directory with the password check and request tracking alongside.

Creating an account doesn’t buy anything. When you want the plan, you choose monthly or annual from your dashboard and press “Continue to checkout”; payment is taken on Stripe’s own page.

With a free account: the password check, the account clean-up directory with official guidance that TraceErase has checked and dated, request drafts, and a case tracker with response dates worked out from the dates you record. The plan adds eligible requests handled for you (Loan Broker Cleanup first, when it is open), the removal centre (with your own checklist of data brokers, a private to-do list that sends nothing), progress updates, and the email breach check, scheduled breach checks and the breach directory (the breach tools when the breach data service is switched on). Detailed exposure reports and weekly protection are temporarily unavailable and are not part of what the plan gives today. Follow-ups on requests with no reply are planned and not switched on yet. Each tool’s page shows whether it is working for you right now. A tool being switched on doesn’t mean every organisation, source or action is supported: each one says what it covers.

The breach check for your account email depends on a breach data service.

The free exposure check, where it’s available, searches a licensed search index for possible references to your name on supported websites. It is not a promise and it is not part of what a plan gives you. Coverage is very limited at present, because the index holds almost none of the person pages of the one website we may search, so “nothing found” is the expected result for almost everyone and is not an all-clear. The check page says where it stands, and it is paused when the search service can’t be reached.

Separate account checks, each with its own source, date and limits, and none added to any other result: a Companies House public-register check (with an optional weekly watch of one record you choose, which needs an active plan and is switched on only by you), a GitHub profile check, an archived-copy check of one web address you give us, and a photo privacy check that runs on your device. Each says when it is unavailable, and a check that could not run is never shown as “nothing found”.

Nothing runs in the background unless you turn it on. Breach checks and the password check run when you ask, and breach checks can also run on a schedule if you turn that on. Weekly protection, an optional repeat of the exposure check, is temporarily unavailable. Reminder emails about the dates on your own requests depend on the reminder service running and have no promised delivery time; the dates are always shown on screen.

We don’t receive or store the passwords you check. The complete password is never sent to us or to Have I Been Pwned: your browser works out a one-way hash and sends only its first five characters to a Have I Been Pwned service. Your TraceErase sign-in password is handled by our sign-in service, and TraceErase never asks for the passwords of other services. You never need to give us a login for another organisation, and you should never put a password in a request.

Enough to find your records: your name and details such as the email address or username on the account, or a reference number they gave you. Give only what helps them find you. An organisation may ask for proof of who you are if it has a reasonable need, and in some cases the time limit starts only once it has what it needs. The ICO’s guidance covers this.

TraceErase drafts have a field for these details and tell you not to include passwords or card numbers. For managed requests, your written permission names the organisation, the actions and an end date, and uses your verified email address; further evidence is asked for only where a recipient reasonably needs it.

Whenever a step needs you: signing in to your own account, confirming by email or a code, proving your identity when the organisation asks, or confirming that you want an account closed. TraceErase can’t and doesn’t sign in for you. The guidance for each organisation shows which steps are yours, and managed requests only cover organisations on the managed list.

No. Erasure applies in particular circumstances and isn’t absolute: an organisation can keep data it must keep, for example to meet a legal obligation or to deal with legal claims, and closing an account isn’t the same as erasing data. For banks, credit, energy, phone and health services TraceErase gives rights-request guidance only, not closure or erasure advice.

Closing an account on the organisation’s own site varies, and where the guidance TraceErase checked records a period (for example a deletion window) it is shown, with the date it was checked. For a data protection request, ICO guidance gives the organisation one calendar month to respond, with up to two more months if the request is complex and it tells you within the first month. For a complaint, the organisation should acknowledge it within 30 days.

TraceErase shows these as provisional dates worked out from the dates you record, marked “needs confirming” when uncertain. Staff review each managed request first and only a limited number are sent each day, so there is no promised time.

It must still reply, say why it is refusing, and tell you how to complain. If it asks for clarification or identification, answer through the same route and record it in your case. If you aren’t satisfied, complain to the organisation, then to the ICO if you are still unhappy. TraceErase helps you record replies and prepare a follow-up or complaint draft for you to review and send.

TraceErase is the whole platform: security checks, the account clean-up directory, privacy request drafts and tracking. Broker cleanup is one specialist managed feature inside it, for payday and short-term loan brokers, and has its own page. You can use everything else without ever using it. About Loan Broker Cleanup.

The password check tells you whether a password appears in known breaches. With the plan, and when the breach service is available, the breach check shows which known breaches include your account email address, with practical next steps such as changing a password. A separate reading list shows recently reported breaches.

None of them can tell you that you are safe: a result only covers what the service has recorded. If the service is unavailable, TraceErase shows the result as unavailable. It never shows “all clear” in its place.

Where it’s available, you give your name and where you live, confirm your email address with a one-time code, and TraceErase searches a licensed search index for supported websites. You see how many possible references it found and across how many websites, and you can review them and see the steps available. The Check my exposure page says whether it’s available today, and what is sent to which search provider and how long results are kept.

It doesn’t open the pages the results link to, so a result is a possible reference, not confirmed exposure. A search index may not include everything, and confirming your email address doesn’t prove who you are, so finding none isn’t an all-clear and a result isn’t proof. It runs when you ask. It doesn’t remove anything by itself. The check and its count are free. Detailed exposure reports are temporarily unavailable and are not part of what a plan gives today; the removal centre is separate and works without them.

When the check is available you can start one a week yourself; the check page says whether it is available today. Weekly checks are temporarily unavailable; when they are available they run separately, once a week. A check that couldn’t run, or that failed, doesn’t use your check for the week.

Your password is checked in your browser. The complete password is never sent to TraceErase or to Have I Been Pwned. Only the first five characters of a one-way hash of it are sent, from your browser, to a Have I Been Pwned service called Pwned Passwords. That service replies with a list, and your browser checks the list. The request goes straight from your browser to that service and does not pass through TraceErase. Like any web request, it shows that service your internet address. The method is called k-anonymity, and the request asks for padding. This applies to the password check only; other features work with the details you give us.

Only if you choose it. Breach checks and the password check run when you ask. On a paid plan you can turn on scheduled checks of your confirmed account email. That is one choice. Getting one email when a check finds a newly listed breach is a second, separate choice. Both are off until you turn them on, and how often a check comes round is shown in your account. Weekly protection, which would repeat the exposure check, is temporarily unavailable, so nothing else is re-checked for you. TraceErase doesn’t scan broker databases or the wider web: the free exposure check, when it is available, searches a licensed search index for supported websites when you ask it to, and only then. Reminder emails about request dates depend on the reminder service running and have no promised delivery time; the dates are always shown on screen.

A searchable directory of online services across everyday life, such as shopping, social media, entertainment, travel, technology and banking, adapted from a community directory with additions from official sources. The coverage page shows live counts and lets you search it without an account.

Where TraceErase has read an organisation’s own pages, the entry says “Checked by TraceErase” and shows the date; the organisation may have changed its pages since. Most entries haven’t been checked yet, and say so.

A listing means the service is in the directory, nothing more. It isn’t an account of yours that we have found, not a supported removal and not a tested sign-in flow. “Checked by TraceErase” means TraceErase read the organisation’s own pages and recorded the date; you still act on the organisation’s own site, and it may have changed its pages since. For banks, credit, energy, phone and health services TraceErase gives no closure or erasure advice, only rights requests. An outcome is only what an organisation says it did, and who vouches for it.

You use the tools and guided routes yourself. For organisations on the managed list, TraceErase can handle supported requests on your behalf, under written permission you can revoke: software prepares each request, you read and approve the exact wording, a member of staff approves the same wording, and only then does TraceErase send it. The service note on this page says whether Loan Broker Cleanup is open to you right now. You do the steps that need your own login, identity check or confirmation.

Checking whether broker cleanup is open…

Closing an account stops you using a service. It doesn’t necessarily remove your data, because many organisations keep some of it afterwards.

Erasure is a separate request: you ask the organisation to delete personal data it holds about you. TraceErase keeps the two apart and its guidance says which one each step does. The five requests, in plain words.

TraceErase works them out from the dates on record, such as the date a request was sent, using versioned rules based on ICO guidance. When something is uncertain, the date is shown as “needs confirming”. A date doesn’t change because an organisation says it needs longer. A date passing isn’t a finding that an organisation did anything wrong.

For a complaint, there is no fixed final deadline for the organisation to resolve it, so any chase date you choose is your own target. Dates are a guide, not legal advice.

You choose a monthly or an annual plan. The annual plan is charged in full, once a year, upfront; any monthly figure shown for it is only an equivalent, not a monthly charge. Both renew automatically until you cancel from Manage billing in Settings (it opens Stripe’s customer portal). The Pricing page reads the amounts from our billing records, so none is written here.

The account tools (the directory and guidance, privacy requests and complaints, the case tracker and the password check) come with your account. The plan is the connected service around them: eligible managed requests handled for you with progress updates (Loan Broker Cleanup first, while it is open), the removal centre (with your own broker checklist), and breach information for your account email when the breach service is available, with scheduled breach checks and the breach directory. Detailed exposure reports and weekly protection are temporarily unavailable and are not part of what the plan gives today; nothing that worked has been taken away. Follow-ups on requests with no reply are planned and not switched on yet. It doesn’t buy a particular outcome, unlimited capacity or a response time. The commercial terms and refunds are set out in the Terms of Service, and nothing here is a guarantee of removal.

You don’t have to. Your rights don’t depend on TraceErase, and the official steps in the directory are free to follow with or without an account. The plan pays for the work around them: finding each organisation’s route, a prepared draft, one record of what you sent and when replies are due, and, for supported requests, help from our team when Loan Broker Cleanup is open. If you only have a request or two, the free route may be all you need.

See the free route and TraceErase side by side.

Deleting your account is a process. Your access stops at once, your permission for managed requests is revoked, unsent requests are cancelled, an active subscription is cancelled, except one whose ownership is under review, which our team handles with you, and your saved lists are removed. Request records and billing records are kept or removed according to retention rules that are still being confirmed, so the page doesn’t say your data is deleted until it is. The Privacy Policy explains how we handle your data.

If you have an account, open Support in your dashboard: each message gets a reference and a status. Otherwise see Contact and support. The support email address is help@traceerase.co.uk. We don’t promise a reply time.