Privacy Policy

What we collect

Your account email; the identifiers (such as email addresses) you verify; breach metadata about those identifiers (breach names, dates, and the categories of data exposed); payment references from Stripe; and an audit log of your activity (timestamp, a hashed form of the identifier searched, and IP address). We keep the audit log as both a security measure and evidence that every lookup was for an identifier you had verified.

What we never store

We never store exposed passwords or other exposed secret values. When you unlock a report, those values are fetched from our data provider, shown to you once, and discarded — we retain only breach metadata. The password checker hashes your password inside your browser and sends only the hash, so the password itself never reaches us.

Our legal basis

We only process breach data about an identifier after you prove you control it. That ownership verification — your consent — is our lawful basis for processing, and it is enforced on our servers before every lookup. No verification, no lookup.

We never sell your data

We do not sell, rent, or share your personal data, and we never use it for advertising, profiling, or any purpose other than providing the service to you.

Where EasyToDefend is available

EasyToDefend is offered only in the United States, Canada, and India. We do not offer the service elsewhere, and we block access from regions outside those three countries.

Where your data is processed

Breach data is provided by a third-party breach-intelligence provider; we also rely on Supabase, Cloudflare, and Stripe. Some of these providers process data in the United States, so your information may be transferred and processed outside your country.

Cookies

We use only essential cookies needed to sign you in and keep your session secure. We do not use advertising or cross-site tracking cookies.

Retention

We keep only the minimal records needed to provide the service and for security, abuse prevention, and legal compliance. Breach metadata tied to a check is minimized or deleted when it is no longer needed, and you can request deletion of your data at any time.

Your rights

Depending on where you live — including under Canada’s PIPEDA, California’s CCPA/CPRA, and India’s DPDP Act — you can access, correct, export, or delete your data, object to processing, and withdraw consent. Use the data removal page or contact our support channel. You may also complain to your local data-protection authority.

Children

EasyToDefend is intended for people 18 and older and is not directed at children.

Sub-processors

Supabase (database and authentication), Cloudflare (hosting), Stripe (payments), a third-party breach-intelligence provider (breach data), and our transactional email provider. The specific identity of our breach-intelligence provider is available on request via the data removal page.

Changes

We may update this policy from time to time; material changes will be posted here.