Privacy Policy

Our Data Protection Officer

Our Data Protection Officer is Sam Baxter. He can be contacted below:
Address: The Foundry 10 Dolphin Centre Poole Dorset BH15 1SR.
Email: sam@traceerase.co.uk

10. How to complain

If you have any concerns relating to the use of your personal data, you may complain to the Data Protection Officer. You also have the right to complain to the ICO if you believe we have contravened any of your rights. They can be contacted at the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline number: 0303 123 1113

Further details about your rights can be found on the ICO website:
https://www.ico.org.uk

11. The personal data exposure check

This section applies when you use "Check my exposure" on our site. It adds to the rest of this policy and, for this check, takes priority where they differ.

The search provider. To run the check we send a search query containing your name and your town or city to Mojeek Limited, a search provider in the United Kingdom. We do not send it your email address or any other detail. Mojeek is an independent controller of the query it receives: it decides for itself how to handle it, and its own privacy information applies to that. Mojeek publishes its own retention period for search queries (its product information currently says 90 days as standard). We do not control that period.

What we search. We search the provider's index only. We do not open or read the pages that the results link to.

What we keep. We keep the web address of each page that may be about you, a masked label, our notes on why it might match, and what you decide about it. We do not keep the search provider's text, and we do not open or keep the content of the page. The rest of what you give us, such as your county and country, stays with us and is used only to judge whether a result may be about you.

How long we keep it. If you never enter the one-time code, we remove your details after 24 hours. If you confirm your email address but do not add the result to an account, we remove it after 14 days. Once a result is on your account, we keep it until you delete your account. Copies in our database host's backups are kept for up to 7 days and are outside these periods, as are the provider's own records.

Your email address. We use the email address you give for the check only to send you the one-time code and to link the result to your account if you create one. It is not sent to the search provider and is not used for marketing.

What a result is. A result is a possible reference found in a search index. It is not confirmation that the information is about you or that it is still online, and a result of none does not mean that no organisation holds information about you. Confirming your email address shows that you can read mail sent to it. It does not prove that you are the person searched for.

If someone else has searched for you. If you think your name has been searched for by someone else, or you are worried about tracing or stalking, write to help@traceerase.co.uk. We will answer you and, on request, delete matching checks. We refuse any request that looks like tracing or stalking.

12. Email breach checks and the password check

This section applies when you use the email breach check, the scheduled breach checks and the alert email described below, or the password check. It adds to the rest of this policy and, for these checks, takes priority where they differ.

The breach check you start. On a paid plan, with a confirmed account email, you can run a breach check on the Data exposures page. Before the first check we ask you to agree to your account email being looked up. When you run a check, our server sends your confirmed account email address to Have I Been Pwned (haveibeenpwned.com) through its API, version 3. Each check is two requests, one for breaches and one for pastes. Each request carries the address, our API key and the name TraceErase as the user agent. We do not send any other email address, your name, your password or your account details.

What Have I Been Pwned can see. The request comes from our server, not from your device, so Have I Been Pwned sees our server's network address and not yours. It also sees the email address in the request.

Why we do it. To show you which known breaches and pastes list your account email, so that you can decide what to change.

What we keep. We keep the list that Have I Been Pwned returned for your address (for each breach, its published details such as its name, dates, description and the kinds of data it included; for each paste, its source, its date and how many addresses it held), the address it was for, and the time it answered. We reuse that list for up to an hour if you check again, then remove it. If a check cannot finish we keep only the reason for that attempt, never a result. We also add your account email to your own list of checked addresses in your account. That list records that you chose the check. It stays until you remove the address from it or your account is deleted.

Scheduled checks and the alert email. On a paid plan you can also choose scheduled checks of your confirmed account email. That is one choice. Getting an email when a check finds a newly listed breach is a second, separate choice, and it can be on only while scheduled checks are on. Both are off until you turn them on. For each choice we record the version of the wording you agreed to and the time. Scheduled checks also need your account email to be on your list of checked addresses.

How a scheduled check works. Each scheduled check sends your confirmed account email address to Have I Been Pwned in the same way, as one request for breaches. Checks run periodically rather than continuously. How often a check comes round is shown in your account. The first check after you turn them on records the breaches that are already listed and raises no alert. After that, a breach that was not listed at your previous successful check becomes an alert in your account. A newly listed breach may relate to an older incident. If a check cannot finish we record the reason and try again later. A check that did not finish is never treated as a result.

What we keep for scheduled checks. Your settings: whether each choice is on, the wording version and time you agreed to or withdrew each, the names of the breaches known at the last successful check, the times of the last and next check, how many checks finished or did not, and the reason the last one did not finish. For each alert: the breach name and title, the date of the breach, the date it was listed, the kinds of data it included, when we found it, whether you have seen it, and what happened to the email about it.

The alert email. If you choose it, we send one email to your confirmed account email when a check finds a newly listed breach, however many it finds. It does not name the breach and it links to your account. Breaches found before you turned the email on are not emailed. We send it through our email provider, named in section 13.

If your plan ends. Scheduled checks are part of the paid plan. While your plan is not active, no scheduled check is made and the alert email is not sent. If we cannot tell whether your plan is active, nothing is looked up. Your choices and earlier alerts are kept.

Turning them off. You can turn off either choice at any time on the Data exposures page. Turning off scheduled checks stops them at once, turns off the alert email and cancels any alert email still waiting. Turning off only the alert email leaves the checks on. If you remove your account email from your list of checked addresses, scheduled checks do not run for it.

How long we keep it. The list of results is removed after the hour described above. The other records in this section (your list of checked addresses, your choices, the wording versions and times, the known breach names, the check history and the alerts) are kept while your account exists and are removed as a step of deleting your account. We have not set any other period. Copies in our database host's backups are covered by section 11.

Have I Been Pwned. The service is run by Superlative Enterprises Pty Ltd, a company based in Queensland, Australia. We read its privacy policy and terms of use on 21 October 2026. Its privacy policy, which says it was last updated in May 2025, says that it does not collect or store personal information when someone searches its database; that its web server logs are kept for up to 31 days and may include browser details and, in some cases, the IP address; that personal information it holds is stored in a Microsoft Azure data centre in the western United States; and that it uses Cloudflare to block malicious requests. It does not say whether it acts as a controller or a processor for an address sent through its API, or how long it keeps one, and we do not describe it as either. Its terms of use say that each side handles personal information under its own privacy policy and the privacy laws that apply to it. Your email address is therefore sent to a provider outside the United Kingdom. We have not recorded a separate transfer safeguard for these lookups.

The password check. The password check runs in your browser. Your browser turns the password into a SHA-1 hash and sends only the first five characters of that hash to the Pwned Passwords service (api.pwnedpasswords.com), which Have I Been Pwned runs, asking for padding in the reply. The request goes from your browser straight to that service and not through TraceErase, so, as with any website, that service receives your network address and browser details from your browser, and we do not. Your browser compares the list that comes back with the rest of the hash on your device. The complete password is never sent to TraceErase or to Have I Been Pwned. We never receive your password, its hash or the answer, and we do not store or log them.

What a result is. A breach check covers only breaches that Have I Been Pwned has listed. No result is not a guarantee, a check that could not run is never shown as clear, and a result does not establish whether your information has been misused.

13. The services we use to run TraceErase

These are the providers that receive personal data when you use TraceErase, and what each is used for.

• Supabase: sign-in, and the database that holds your account records.
• Render: runs our API and our background worker, in Frankfurt, Germany.
• Vercel: serves the website.
• Stripe: payments and subscription billing. You enter card details on Stripe's own payment page. We keep Stripe's identifiers for your customer record and subscription, and the subscription status.
• Resend: sends the emails from traceerase.co.uk, such as sign-in confirmation, reminders, support notices, progress updates and the breach alert email if you choose it. It receives the recipient address and the message.
• Have I Been Pwned: breach, paste and Pwned Passwords lookups, as described in section 12.
• Mojeek: the search provider for the free exposure check, as described in section 11.
• GitHub: the public profile lookup for the GitHub profile check, as described in section 14.
• Companies House: the public register of company officers, for the Companies House register check, as described in section 15.
• Internet Archive: the Wayback Machine availability lookup for the archived-copy check, as described in section 16.
• addy.io: a restricted test of an email-forwarding feature, which is not open to every account. Where it is open to your account, the destination address you choose and the messages sent through the test address pass through addy.io.

14. The GitHub profile check

This section applies when you use the GitHub profile check in your account. It adds to the rest of this policy and, for this check, takes priority where they differ.

What you give us. A GitHub username that you tell us is your own. You can type the address of your profile page instead, and we take the username from it. We never search by email address or by name, we never look for accounts on your behalf, and we never use a username you did not give us.

What we send, and to whom. When you press the button, our server asks GitHub (api.github.com) for the public profile of that username. The request carries the username and the name TraceErase-profile-check as the user agent. If we have set one, it also carries an access token that belongs to TraceErase and not to you. It carries nothing else about you: no email address and no account details. The request comes from our server, not from your device, so GitHub sees our server's network address and not yours.

Why we do it. To show you what the public profile for that username shows to anyone, and how to change it.

GitHub's role. The service is run by GitHub, Inc. and GitHub B.V. We read its general privacy statement, which says it was effective from 27 April 2026, on 26 October 2026. It says that GitHub acts as the controller of the personal data it processes when people use its services, that the data it collects includes IP addresses, device information and the date and time of requests, that it stores and processes personal data in the United States and other countries, and that it relies on the standard contractual clauses and on the data privacy framework for transfers from the United Kingdom. It does not say anything specific about requests made through its API. We use GitHub's public API under GitHub's standard terms. We do not describe GitHub as our processor. It decides for itself how to handle the requests it receives, and its own privacy statement applies to that. The username is therefore sent to a provider outside the United Kingdom. We have not recorded a separate transfer safeguard for these lookups.

What we keep. Nothing that identifies you or the profile. We do not save the username or the details we read, in our database or in our logs, and the result is shown to you once. We keep only a count, in the memory of the server that handled the request, of how many times your account has used the check in the last hour, so that we can limit use. It holds no username, it is not written to our database, and it is cleared as the hour passes or when the server restarts. Your confirmation that the profile is yours is not saved either.

What a result is. It shows what the public profile showed when we looked. It does not show that the profile is yours, because you tell us that, and it does not cover everything GitHub or anyone else holds or shows about you. A check that could not run is never shown as a clear result.

15. The Companies House register check

This section applies when you use the Companies House register check in your account. It adds to the rest of this policy and, for this check, takes priority where they differ.

What you give us. A name that you tell us is your own. You can add a year of birth to shorten the list. We do not search for anyone else for you, and we never use a name you did not give us.

What is checked, and what we send. When you press the button, our server asks Companies House, the public register of company officers, for officer records that match the name you typed. The request carries that name and an access key that belongs to TraceErase and not to you. It carries nothing else about you: no email address, no account details and no year of birth. The request comes from our server, so Companies House sees our server's network address and not yours. The register sends back up to twenty records. We keep only those whose name includes the last word of the name you typed, show you them, and tell you how many we left out. The year of birth, if you gave one, is used on our server to narrow that list and is not sent to Companies House or saved.

What you choose. A name that matches is not proof that a record is yours, so you choose. Only then do we ask Companies House for that record's appointments, and keep it.

What we keep. The other results are not kept. For the record you choose we keep the register's reference for it, the date you chose it, and a copy of what it showed when we looked: the name, month and year of birth, nationality, occupation, one correspondence address, and up to fifty appointments (company number, company name, role, and the dates). Only you can see it, and you can remove it at any time; removing it clears the copy at once. We also keep, for each day you search, a count of how many searches your account made, with no name in it. Our application does not write the name you type, or what the register returns, to its logs.

How long we keep it. The copy stays until you remove it, switch watching on and later end it, or ask us to delete your account. A saved record that you are not watching and have not used for twelve months is cleared automatically. Choosing it again, switching watching on or off, marking a change as seen, or pressing Keep starts the twelve months again. Opening the page does not. The daily search count is kept while your account exists.

Watching a record. Watching is a separate choice that you switch on yourself, for one record at a time, and it needs an active plan. While it is on, about once a week our server asks Companies House for that one record, using its reference, and compares it with the first version it read. To do the comparison we keep short fingerprints of each field, not the text. If something meaningful changed we show you in the check which kind of change it was, such as an appointment added or an address changed, and how many, but never the details. If you switch watching off, remove the record, or your plan ends, it stops. We keep a note that you switched it on (the wording you saw and when) for twelve months after watching ends, and a note of each change for ninety days.

Companies House's role. Companies House publishes the register and decides for itself how it handles requests. We use its public API under its standard terms. We do not describe Companies House as our processor.

The register is public. The details on the register are published by law, whether or not you use this check, and TraceErase cannot have them removed. Companies House has its own routes to remove or protect some details; the check links to them.

What a result is. It shows what the register showed when we looked. It does not show that the record is yours, because you tell us that, and it does not show that nothing else about you is public anywhere else.

16. The archived-copy check

This section applies when you use the archived-copy check in your account. It adds to the rest of this policy and, for this check, takes priority where they differ.

What you give us. The address of one public web page. We show you the address and ask you to confirm before anything is sent.

What we send, and to whom. Our server sends that address, with the user agent TraceErase-archive-availability, to the Internet Archive (archive.org) and asks only whether its Wayback Machine lists a saved copy. We never contact the page itself, never ask the Internet Archive to save it, and never read the saved copy. The request comes from our server, so the Internet Archive sees our server's network address and not yours.

What we keep. We do not save the address or the answer, in our database or in our logs. We keep only a count, in the memory of the server that handled the request, of how many times your account has used the check in the last hour, so that we can limit use. It holds no address and is cleared as the hour passes or when the server restarts.

The Internet Archive's role. The Internet Archive is a separate organisation. Its Terms of Use and Privacy Policy apply to what it receives, and we do not describe it as our processor. It is based in the United States, so the address is sent to a provider outside the United Kingdom, and we have not recorded a separate transfer safeguard.

What a result is. It shows what the archive reported when we asked, and the date of the closest saved copy it listed. It does not show that the copy contains your personal information, and when no copy is listed that is not proof that none exists.