Privacy notice

1. Who we are

Hide is operated by Clexa GmbH, Friedrich-Ebert-Straße 31, 92421 Schwandorf, Germany. Clexa GmbH is the controller within the meaning of Article 4(7) GDPR.

Clexa GmbH is represented by Anna-Katharina Schinzel and registered with Amtsgericht Amberg under HRB 8352. For privacy questions or to exercise your rights, email info@hidedata.app.

2. Information we process

The categories below describe what Hide processes across the public product and optional features. Features described as enabled or available are not active until they are offered in the product.

Our infrastructure processes ordinary request information such as network address, browser and device information, requested page, timestamp and error details. For application rate limiting, Hide stores a daily-scoped hash derived from a network address or submitted email; the raw value is not retained in that rate-limit record.

When you create an Exposure Check, you must first verify and sign in to the email address used for the case. Hide rejects a different submitted email before any discovery starts. Hide Personal currently starts searches only after the account owner confirms that the named profile describes them; searching for another person remains unavailable until a verified delegate flow exists. Hide stores a versioned self-search authorization, its supported public-source scope and the authorization time with the discovery brief. Deleting the brief withdraws that authorization and removes its candidates and unfinished source work. We process your name, verified account email address, country, broad role category, selected exposure category, at least one identity-context field, optional public source URL and hostname, authority and consent records, source-coverage status, source-rule identifier and version for each checked source, possible match URLs, confidence and match reasons, your confirmation or rejection, case status, dated ledger events and a one-way technical capability hash that is not returned to the browser. A signed-in account may save up to ten reusable identity profiles. A profile can contain a current name, former names or aliases, current and former cities, current and former employers or public roles, and optional address, email and phone clues. The complete profile is encrypted at rest with authenticated encryption; only the account relationship and technical encryption metadata remain outside that encrypted payload. An authorized discovery brief receives its own encrypted snapshot so later source checks use the clues that the person approved at the time. Hide decrypts these records on the server only to display them to the owning account or perform the separately authorized search. Where automatic discovery is enabled, Hide sends current and former names together with broad city, employer or public-role context through its authenticated Vercel gateway to Serper's Google Search API with region and language settings selected from the profile locations. The gateway validates those settings, returns only a bounded title, public URL and snippet, and does not log or retain the query or response. Hide does not send exact address, email or phone clues as discovery queries; it compares them only against the bounded result already returned and does not retain search-result snippets. If you ask Hide to operate a removal, we also process the approved request text, selected legal playbook, source-rule identifier and version, legal-basis snapshot recorded at approval, recipient email, approval time, whether you approved one follow-up, provider message identifiers, delivery state, response and follow-up deadlines, bounded error details, source-response summaries you enter and escalation or completion state. Outbound and recorded inbound messages receive body hashes for auditability. A scheduled sync reads only recent Strato messages whose subject contains a Hide case reference. It sends Hide the case reference, cryptographic message and content fingerprints, received time, a coarse reply category and whether an attachment exists. Raw reply text, sender details and attachments remain in Strato and are not imported automatically. If the source asks for identity verification, Hide stores the task state, your exact authorization, bounded provider message identifier, delivery state and relevant dates. Hide can send only the displayed data-minimized reply asking the source to explain necessity and offer a protected channel. A trained operator reviews any later source reply and may store a bounded summary of the protected route, minimum evidence, permitted redactions and deadline in your private case; the raw reply and attachments stay in Strato. Identity documents and document fields are not uploaded to or stored by Hide; you complete any necessary verification directly through the source's protected channel and may record only that completion. The approved request is sent only after an account owner confirms it. Before an ordinary website request is sent, Hide makes a bounded request to the supplied public privacy, legal or contact page and checks that the exact recipient address appears there; the page text is not retained. Statutory-register cases are routed to human review because a correction or restriction route may apply instead of erasure.

For outcome proof and optional personal monitoring, Hide may also record public HTTP status and headers, content length, access and check time, cryptographic content and source fingerprints, schedule status, comparison result, the email provider's bounded message identifier and delivery state, alert-suppression reason and time, and whether a change is waiting for your review. When a public response fits the product's safety limit, Hide also retains those response bytes as an encrypted, owner-only snapshot so you can inspect what was observed at that time. The snapshot is never executed as a live page: textual responses are escaped and displayed as inert text, and other file types are downloaded as attachments. A bounce, spam complaint or provider suppression pauses email alerts to that address but does not stop scheduled source checks or private-ledger evidence. The proof record distinguishes a source fetched by Hide from an outcome confirmed by you. After a verified removal, you may optionally report whether the workflow was clear without help and provide two rough minute estimates for manual work and active Hide use. Hide stores the selected clarity category and numbers, not free-text feedback or a covert activity log. Exact address, email and phone clues are optional; Hide never requires identity-document uploads. A possible match becomes an exposure case only after you confirm that it describes you and choose the category of personal information actually visible on the source. That answer replaces Hide's automated snippet-based category in the case, request and evidence ledger. If you mark a possible match as unclear, an authorized Hide reviewer may see the saved identity context, source URL, score and match reasons to dismiss a clear mismatch or return the decision to you; the reviewer cannot confirm identity or create a case for you. New personal discovery records are visible only to their owning verified account, are excluded from search indexing and can be deleted through the account's case controls. Legacy browser-controlled records created before this safeguard remain limited to their original 30-day expiry.

You may explicitly create a redacted outcome link from a private exposure case. Hide stores only a one-way hash of the 32-byte capability token and an immutable snapshot containing the broad exposure category, lifecycle stage, day-level dates, private-ledger evidence count, and whether removal or monitoring had been recorded. The account-gated snapshot excludes the person's name, email, address, source, URL, request and reply text, recipient, case identifier, evidence fingerprints and captured source material. A recipient must sign in and possess the unguessable link to view it for up to 30 days. Creating a new link revokes the earlier active link. You can revoke it immediately, and deleting the case or closing the account deletes every linked snapshot.

A signed-in account owner may start one human-support conversation inside a private exposure case. Hide processes the selected reason, urgency, message text, conversation state, timestamps and the name of the responding operator. Message text is encrypted at rest with authenticated encryption tied to that conversation and sender. Support is text-only: do not submit passwords, payment details or identity-document images. An urgent-safety label prioritizes operator review but is not an emergency service.

When you use Scam Check, the submitted text and, if supplied, original email headers are processed transiently to extract infrastructure indicators and derived routing facts. You may paste this evidence or choose an .eml, text, XML or text-based PDF file; the browser sends only a bounded text extract and rejects files over the stated limit. You may also choose a PNG, JPEG or WebP screenshot up to 12 MB. The browser downloads Hide's self-hosted English and German text reader from hidedata.app and performs optical character recognition on your device. The screenshot is not uploaded to or retained by Hide, and neither is the original document. Only their bounded extracted text, QR destination and file metadata are sent. Optical character recognition can be inaccurate, so you should review important details before relying on a result.

Extracted data can include URLs, sender domains, Reply-To and Return-Path domains, supplied SPF, DKIM and DMARC results, referenced DKIM selectors, phone numbers and payment destinations. Recipient addresses in To, Cc, Bcc and Delivered-To header fields are excluded from retained indicator hashes. Hide does not retain the raw message, headers or uploaded file; it also does not retain the screenshot.

Hide stores a keyed, daily-scoped cryptographic fingerprint of the normalized submission, the generated evidence result with its timestamp and a hashed browser-management token. The shared Hide Engine also records the input kind, specialist routes, artifact type, product surface, verdict, category, up to three signal identifiers, latency and an optional verified workspace relationship. It does not store the raw submitted content. Extracted indicator fingerprints and aggregate report counts are stored only after a separate explicit signal contribution choice and while the independently governed contribution feature is enabled. These predictable identifiers use a secret, purpose-scoped keyed hash rather than an ordinary unsalted hash. Ordinary consent to run a check is not consent to contribute a signal. If you are signed in, Hide connects the result to your account so you can open it across devices. You may attach another work email by entering a short-lived code sent to that address. Hide then stores the verified address, its domain and verification time. A check can be tagged with that work domain while remaining a personal check. The domain may be used to show a workspace suggestion and an aggregate count of Hide accounts that verified the same domain; addresses, check contents and personal history are not shown to those accounts or an employer. Creating or joining a workspace does not copy earlier personal checks. Workspace context is accepted only for a signed-in member of that exact verified workspace.

The check compares submitted domains with source domains already in your private Exposure Ledger and adds only aggregate confirmed-case counts, broad exposure categories and the number of overlaps to the result. It does not copy exposed values or unrelated ledger source names into the result, and overlap does not prove who sent a message or how information was obtained. Lightweight product feedback stores only was scam, was legitimate or unsure with the displayed signal identifiers. When a member marks a workspace check legitimate, the submitted domains can also appear for up to 90 days as pending allowlist suggestions for an administrator. They are not approved automatically. A separately confirmed outcome also records the structured category describing how the outcome was established. Hide does not request or store a provider name or incident story, and customer content is not used to train or fine-tune models. Reports without a valid confirmation basis do not count as confirmed ground truth.

The owner of a Scam Check may create one active redacted verdict link that expires after 30 days and can be revoked earlier. The immutable, account-gated snapshot contains the three-state verdict, broad category, day of the check, up to three redacted reasons and a redacted next action. Hide replaces detected links, domains, email addresses, phone-like numbers and payment destinations before storing the snapshot. The card excludes the original message, private account and workspace history, source evidence, case identifier and management token. A recipient must sign in to Hide and possess the unguessable link to view or copy the card until it expires or is revoked.

The result may contain derived domain names, approximate registration age, public certificate-history context, sender-policy status, bounded redirect hostnames and status codes, threat-list match categories, concern levels and recommended actions. Hashing reduces disclosure but is not anonymisation where an input can be guessed. Public DNS resolvers, domain-registration services and certificate-transparency services receive the domain names required for checks. When commercial threat intelligence is enabled, Google Web Risk receives up to three complete public URLs supplied in the message and returns whether they match its phishing, malware or unwanted-software lists. A query string can contain personal or secret values, so remove unnecessary secrets before submitting a message. For up to three supplied links, the linked hosts may also receive bounded HEAD requests through a maximum of four redirects; Hide checks each host against private and reserved networks and does not request page bodies, execute scripts or submit forms.

A signed-in account owner may explicitly check whether the primary account address or an attached verified work address appears in Have I Been Pwned's known-breach corpus. The current provider plan requires Hide to send the exact selected address to Have I Been Pwned when the person starts that check. Hide prevents searches for addresses that are not verified by the signed-in account. When the provider returns a match, Hide saves a minimal action record with the incident names, dates, exposed-data categories and containment steps. The saved record does not copy the checked email address or the provider's full response. A result with no match is displayed for the current session and is not treated as proof that the address was never exposed.

When you request a Vendor Check, we store the submitted domain, optional expected company name and market, public search references, public DNS, registrar-provider and HTTPS observations, source links, timestamps, method version, generated findings and review steps, and any comparison with an earlier scan. The domain, expected company name and market are sent through Hide's authenticated search gateway to its contracted public-search provider to retrieve public company, register, news, review and professional-network references. Search titles, URLs, snippets and displayed dates returned for the report are retained with the check. Do not enter confidential contract terms, bank details, personal contact data or other secrets.

Registrar discovery reads the public RDAP service selected through IANA's bootstrap registry and retains only the identified registrar, not registrant contact data. Vendor Check also requests public DNS records through a DNS resolver and may request the submitted website, its security.txt file and its MTA-STS policy. Those operators receive the technical information normally needed to answer the request. Vendor Check does not test ports, attempt logins, access paid databases or simulate attacks. If the creating browser uses remediation controls, we also store the selected action status, optional responsible person or team, work contact, due date and note with that report. A report may later be associated with a company workspace only when the creating browser authorizes the claim and the exact domain has been verified.

Clear reports are available to anyone who has the unguessable report URL. They are excluded from search indexing, but no technical measure can prevent a recipient from sharing a URL or copy. Do not submit confidential information or use the service to create a report for harassment, employee profiling or another unlawful purpose.

If you request business monitoring, we process your work email, domain, source scan, consent version, verification status, monitoring runs and delivery status. If an authenticated person starts personal monitoring after verifying a removal, or separately approves automatic monitoring as part of a removal operation while an eligible plan is active, Hide rechecks that case's public source every 30 days and emails only when the source fingerprint changes or a page that returned not found responds again. The alert asks the account owner to review the source. Personal information may still be absent. Monitoring emails include a direct unsubscribe link. For personal-product early access, we process the submitted email, optional country and consent version.

With an active Hide Personal plan, an account owner may separately authorize recurring discovery for a saved self-identity. Every 30 days, Hide creates a new evidence-preserving discovery cycle from the encrypted identity snapshot and repeats the supported source searches for the locations saved with that profile. Hide compares normalized source URLs with earlier cycles for that identity, marks already-seen results separately and alerts only when a new possible match requires review. The alert contains no source URL or exposure detail. A new result remains unconfirmed and cannot become a case or removal request until the account owner reviews the original source and confirms identity. Hide stores the schedule, versioned consent, cycle number, linked discovery brief, source attempts, next and last run times, new-result count, bounded failure state and email delivery reference. The account control or signed email link stops future cycles without erasing the dated searches already performed; those remain in the private account until the person deletes the linked brief, identity or account. Losing paid entitlement pauses the schedule.

A person with an active Hide Personal plan can separately opt in to a monthly Exposure Ledger email. The email contains only six aggregate outcome counts for the preceding 30 days: sources found, requests delivered, source responses, removals verified, clear rechecks and changes requiring review. It does not contain source names, exposure details or case history. Hide stores the preference, next and last send times, a bounded provider message identifier, delivery state and bounded failure information. The email links to the private account for details and includes a signed one-click preference link. Stopping this optional summary does not stop source monitoring, delete an account or cancel a subscription.

For personal and company accounts, we process email, optional display name, sign-in challenges, hashed session tokens, authorization and audit events, and records created in the account. Hide signs you in with a six-digit code sent to your email. A code expires after ten minutes, works once, and is limited to five attempts. Hide stores only a cryptographic hash of the code, not the readable code itself. Earlier encrypted authenticator records may remain for accounts that used the retired authenticator feature, but they are no longer requested during sign-in and are deleted with the account.

A verified workspace owner or administrator may invite a colleague by email and role. Hide stores the invited address, role, inviting account, workspace, one-way link hash, seven-day expiry and acceptance state. The recipient must sign in with that exact address or attach it as a verified work email before accepting. An invitation never exposes or transfers the recipient's personal checks.

A personal account owner can request permanent account closure while signed in. Hide first blocks closure if a checkout, still-chargeable subscription, payment retry or withdrawal review is open, or if the account belongs to an organization that must be transferred or left safely. A subscription whose renewal has already been cancelled does not delay closure. Closure requires both the active signed-in session and a separately emailed, single-use confirmation link that expires after 30 minutes. On final confirmation, Hide stops monitoring and optional email schedules; deletes the account, sessions, sign-in methods, encrypted identity profiles, discovery records, cases, evidence fingerprints and encrypted response snapshots, removal operations, private support messages, account-linked Verify reports and outcomes, and the account's optional indicator contributions from the live product; and removes direct identifiers from product events. If object storage is temporarily unavailable, snapshot deletion remains in a restricted retry queue until it succeeds. Accounting and resolved refund records that must remain are separated from the deleted account, assigned a non-identifying internal closure reference and given a synthetic email address. Required security and transaction audit events may remain without the account identifier.

Guided Access Review stores only the provider category, optional account nickname, app or service name, permissions and original provider scope names that you choose to record, your expected-or-unnecessary decision, review dates and follow-up state. Hide does not receive provider tokens or the content an app may access. If a provider review cannot be completed, Hide stores a bounded reason, provider category, attempt time and suggested retry date as an unavailable coverage gap. A later completed review resolves the gap but retains its dated ledger evidence until you delete the record or close the account.

The optional Hide Local Protector is a native macOS client. It reads Hide Local Protector's own camera, microphone, location, contacts, photos, screen-recording and accessibility state through supported macOS APIs. It can also attempt a read-only review of supported application grants recorded in the local macOS Transparency, Consent and Control databases. Those databases are not a public, stable global-permission API: macOS, App Sandbox or missing Full Disk Access may make them unavailable, and Hide shows that state instead of treating it as clear. A recorded grant does not prove that an application used the permission. Local Protector does not inspect another application's content, monitor its activity, or claim a complete inventory of applications or permissions.

Installed-application names, versions, locations and detailed permission observations are stored in encrypted form on the device. Nothing from a review is selected for synchronization by default. When you explicitly select and synchronize an observation, Hide receives the permission category and state, observation time, collector and operating-system version, evidence boundary, and an opaque keyed application reference. An application name is synchronized only where the product offers that choice and you enable it. The device credential is held in the macOS Keychain. Hide stores a one-way hash of that credential, the paired-device name, operating-system version, consent setting, last-seen time, selected synchronized observations and their resulting Exposure Ledger state. A one-time pairing code expires after ten minutes. Disconnecting the device invalidates its server credential and stops later synchronization; local encrypted data remains under the native client's controls until it is erased from that device.

For an organization that deliberately connects Microsoft 365 shared or functional mailboxes, Hide processes the Microsoft tenant identifier, provider and connection status, the consenting administrator relationship and times, selected shared-mailbox addresses, bounded subscription identifiers and expiry times, a hashed client-state value, provider message identifiers, job state and the resulting security evidence. Hide does not connect personal employee mailboxes by default. The workflow requires an authorized Microsoft administrator and an organization policy identifying the permitted mailboxes and purpose. Disconnecting Microsoft inside Hide stops Hide's use of the connection but does not itself remove the Microsoft tenant grant. An administrator must also remove that grant in Microsoft Entra. If the administrator later confirms this in Hide, the ledger records a user-confirmed revocation; it is not described as provider-verified.

If paid features are enabled, the payment provider processes payment-method and billing details. Hide stores only the provider references, amount, currency, payment status and records needed for entitlements, refunds, accounting and support. Hide does not receive or store full card numbers.

Hide records limited first-party events such as scan starts, completions, failures, removal approvals, sends, responses, follow-ups, escalations, verified outcomes, selected outcome and clarity categories, report shares, exports and monitoring requests. Launch attribution is restricted to bounded campaign labels; we do not store raw referrer URLs, request bodies, scan evidence, feedback prose or email addresses in analytics properties. Public personal-outcome metrics are aggregate only and remain unpublished until the exact metric has at least 20 eligible cases or responses. The public report contains no names, email addresses, source URLs or individual case records. We also retain information you send in support, privacy or security correspondence.

3. Why we process information

• Provide the scan, report, export, account or other service you requested.
• Preserve dated source fingerprints and user-confirmed outcomes, and let you verify a later change.
• Deliver a removal request you explicitly approved, track its response deadline and route contested or statutory-register cases to a reviewer.
• Operate consented monitoring and send change, service or optional aggregate monthly outcome messages.
• Verify company-domain control and enforce organization permissions.
• Protect Hide and third parties from abuse, investigate errors and maintain reliability.
• Respond to requests, comply with law and establish or defend legal claims.

We do not sell personal data, use scan evidence for advertising, or use cross-site advertising trackers.

4. Legal bases

We rely on consent under Article 6(1)(a) GDPR to create a private discovery brief or personal exposure case, to process and hash indicators submitted to Scam Check, and to process optional outcome, clarity and time-estimate feedback you choose to provide. Consent can be withdrawn at any time, including by deleting a personal case or contacting us. We rely on performance of a contract or steps requested before a contract under Article 6(1)(b) to provide requested account and paid services.

Local Protector synchronization is based on your explicit, versioned choice to pair a device and synchronize reviewed observations. Organization-connected accounts and shared mailboxes are processed to perform the organization service requested by an authorized administrator and, where applicable, the organization determines the permitted protective purpose and affected workforce policy.

We rely on legitimate interests under Article 6(1)(f) to provide requested public-domain scans, secure and improve the service, keep bounded evidence, prevent abuse and answer support requests. Our interests are limited by the non-invasive public scope of Clear, short retention, source transparency and deletion controls. We rely on Article 6(1)(c) where processing is required by tax, accounting, security or other law.

5. Retention

Private Exposure Check discovery and cases

Account-owned discovery briefs, cases and dated ledger events remain in the private account until you delete the individual record or close the account. Legacy browser-only records expire after 30 days. Mandatory legal retention may apply to a separated, restricted record.

Encrypted personal evidence snapshots

A bounded public response may remain encrypted for the life of its linked private case. It is deleted when you delete the case, close the account or a legacy case expires. If object storage cannot be reached at that moment, Hide keeps only its storage key in a restricted retry queue until deletion succeeds.

Personal removal and verification operations

For the life of the linked private case, unless you delete the case sooner or longer retention is required to establish, exercise or defend legal claims. Deleting the case removes its operation, verification-task and message-audit records from the live product. Hide does not retain identity documents used through a source's protected channel.

Private case support conversations

For the life of the linked private case, unless the case is deleted sooner or longer retention is required for a legal claim. Deleting the case removes the encrypted conversation from the live product.

Hide Engine check records and outcome categories

Personal check records are kept for up to 12 months. A verified workspace keeps checks for three years by default; its administrators can choose a period from 90 days to seven years for audit needs. A scheduled privacy job removes expired check records and linked feedback, shares and operational evidence. Raw submitted message, email and image content is not retained in either record.

Optional Hide Engine indicator contributions

After a separate explicit signal contribution choice, Hide stores a purpose-keyed hash, broad indicator type, source check reference, contribution owner, contribution time and expiry so that one account or workspace can withdraw its own contribution without changing anyone else's record. Active contributions expire within 90 days and are excluded from report counts immediately when withdrawn. Account closure deletes account-owned contributions; a company owner can withdraw workspace contributions. Running an ordinary check does not contribute a signal. Pre-lineage aggregate rows are no longer written and expire within their original bounded 90-day window.

Vendor Check reports and evidence

90 days, unless the creating browser deletes the report sooner.

Pending workspace domain suggestions

90 days, unless an administrator approves or dismisses them sooner.

Rate-limit identifiers

24 hours.

Application and platform logs

Hide emits content-free operational status and error codes. Submitted message text, provider response bodies, email bodies, images and payment instructions are excluded from application logs. Railway's current Pro plan retains platform logs for 30 days; the 14-day target in Hide's product specification remains an unmet hosting requirement.

Monitoring requests

Until consent is withdrawn, the linked source or case is deleted, or the service ends. Personal monitoring evidence may remain in the private outcome ledger for the case lifetime; operational run records are retained for up to 400 days so annual monitoring history can be shown and audited.

Monthly Exposure Ledger email preference

Until you stop the optional summary, delete the account or the service ends. Delivery references, status and bounded failure information remain with the preference for its life and up to 30 days afterwards, except where longer retention is required for a legal or security claim.

Early-access details

Until launch, unsubscribe or a deletion request.

Sign-in, session and security-email records

Expired email challenges are kept for no more than 24 additional hours; sessions expire after 30 days or on sign-out. Hide records the time, kind and delivery state of new-session notices for the account lifetime, but does not collect an IP address, location, device name or browser fingerprint for them. Legacy authenticator and recovery records are no longer used for sign-in and are deleted with the account. Live notification records are deleted with the account; bounded security audit events may remain where needed to investigate account access.

Account, encrypted identity profiles and organization membership

Until the account or saved identity is deleted, except records subject to legal, contractual or security retention. Completing personal account closure removes live operational account data immediately and signs out all sessions. Organization membership must be transferred or removed before personal closure. Deleting a reusable identity alone does not silently delete an existing discovery brief or outcome ledger; those have their own visible deletion controls.

Paired devices and synchronized observations

Pairing credentials remain until the device is disconnected or the account is closed. Synchronized observations remain in the private Exposure Ledger until the linked record or account is deleted, subject to required security retention. Locally encrypted observations remain on the device until erased there.

Guided connected-account reviews

Permission records, accepted baselines, revocation follow-ups and unavailable-review gaps remain until you delete the relevant record or close the account. Resolving an unavailable review preserves the dated ledger evidence while the account remains active.

Organization-connected accounts and mailboxes

Connection and bounded job records remain while the organization connection is active and for the workspace retention period afterwards. Disconnecting stops new Hide processing but does not revoke a provider-side grant. Provider identifiers and audit evidence may remain where needed to document authorization, disconnection or a security event.

Account-closure request

The confirmation link expires after 30 minutes and the plain token is never stored. A completed request keeps only its hashed token, non-identifying closure reference and security timestamps; replaced or failed requests are deleted or expire.

Payment and authorization records

For statutory accounting periods or the documented authorization period. Card data is retained by the payment provider, not Hide.

Support and legal correspondence

As long as needed to answer the request and for applicable legal limitation periods.

Access-restricted backups may retain deleted information until their normal expiry. They are not used for ordinary product processing.

6. Providers and recipients

Hide uses service providers only for the functions needed to operate the product. Current categories include Cloudflare-hosted application, database and DNS-resolution infrastructure; public IANA/RDAP and certificate-transparency services for domain evidence; a Vercel custom-domain and authenticated search gateway; Google Web Risk when commercial malicious-link intelligence is enabled; Serper's Google Search API when automatic personal discovery is enabled, including results for publicly indexed documents; Have I Been Pwned for an email-breach lookup started by the signed-in owner; Microsoft Graph when an authorized organization enables selected shared-mailbox protection; Twilio when the owner explicitly requests a phone-verification SMS; email delivery through Resend when email features are enabled; and Stripe when payments are enabled. Hide does not open files behind logins or outside the public index. Submitted website operators receive the network requests required to perform the public checks. A source operator or its privacy contact receives the identity, contact details, source reference and request text that you explicitly approve for delivery. Replies are received in Hide's Strato-hosted mailbox and reviewed before an outcome is recorded.

We may disclose information when legally required, to protect rights and security, or as part of a corporate transaction subject to appropriate safeguards. We do not share personal data with advertisers.

7. International transfers

Some providers may process information outside the European Economic Area. Where required, transfers rely on an adequacy decision, the European Commission's Standard Contractual Clauses or another lawful safeguard. You may request more information about applicable safeguards at info@hidedata.app.

8. Your GDPR rights

Depending on the circumstances, you may request access, rectification, erasure, restriction, portability or objection, and may withdraw consent at any time. You also have the right to complain to a competent data-protection supervisory authority.

The verified account that creates a private Exposure Check can delete the discovery brief, case, complete ledger and linked encrypted response snapshots directly. A signed-in person can also download a versioned JSON archive of the account's current identity profiles, discovery coverage, candidate decisions, exposure cases, evidence, removal outcomes, monitoring state, support conversation, privacy-rights requests, Scam Check summaries, preferences and bounded billing state. Authentication material, encryption material, response-snapshot bytes and provider object identifiers are excluded from that JSON archive; each available snapshot has its own owner-authorized view and download control. The account's Privacy & data screen supports access, rectification, erasure, restriction, portability and objection requests with encrypted request and response text and a visible response date. Complete account closure uses a separate short-lived email link and the active session before deletion. Billing, an open withdrawal review or organization membership must be resolved first so closure cannot abandon a payment or shared workspace. A legacy browser-controlled personal record remains deletable from the browser that created it until it expires. The browser that creates a Vendor Check report can delete that report and its linked monitoring request. You may also email info@hidedata.app. We may need to verify your identity or authority and normally respond within one month.

9. Automated analysis

Exposure Check requires a current or former name plus at least one independently matching location, employer, public role, address, email or phone clue before it surfaces a possible identity match. A former name or alias can never create a candidate by itself. Exact contact and address clues strengthen only a result already returned by the public index and are excluded from search terms. Hide excludes results below a conservative source-specific threshold and caps automatic confidence below certainty. The person must confirm every match before it becomes an exposure case or can lead to a removal request. Hide Engine classifies technical indicators into OK, Caution or Stop. OK means only that completed checks found no warning; it is never a guarantee that a message, payment or site is safe. The engine does not produce legal or similarly significant effects under Article 22 GDPR. Results include evidence, limitations and source status so they can be reviewed.

10. Security

Hide uses transport encryption, access controls, hashed single-use sign-in codes and session tokens, authenticated encryption for saved identity profiles, private case support messages and retained source snapshots, user-scoped authorization, bounded retention, rate limiting and network-target validation. Encryption keys are kept separately from encrypted records. No online service can guarantee absolute security. Security concerns can be reported through the trust center.

11. Cookies and local controls

Hide uses only essential first-party cookies for creator-authorized report management and, when enabled, secure company sessions. We do not currently use advertising cookies, optional analytics cookies, session replay or cross-site tracking. The cookie policy lists each cookie, its purpose and duration.

12. Children

Hide is a business and privacy service and is not directed at children under 16. If you believe a child has submitted personal information, contact us so we can review and delete it where appropriate.

13. Changes and contact

We may update this policy when the product, providers or legal requirements change. We will post the revised policy with a new date and provide additional notice when a material change affects existing account holders.

Questions, complaints and rights requests can be sent to info@hidedata.app. The operator details are available in the Impressum.