Legal
LeakBrief privacy policy
Draft privacy policy of LeakBrief: the account and usage data it processes, why, the legal bases, the providers involved, retention and your rights.
Who is the controller of my data?
Luis Tschurtschenthaler, Italy, is the controller; write to privacy@leakbrief.com about anything in this policy.
Which data does LeakBrief process about its users?
Your account details, what you scan and unlock, and the technical data needed to run the service securely.
- Account: your email address, and your name if you give one.
- Sign-in with Google, only when you choose "Continue with Google": the name, email address and profile image Google shares with us.
- Use of the service: the store addresses you submit, the briefs, unlocks and exports of your account, and the branding you upload.
- Security: sessions with the IP address and browser they started from, request counters for rate limits, and Turnstile checks on public forms.
- Billing, once paid plans launch: business details, VAT number and payment records, with card data handled by Stripe.
Which data does LeakBrief process about stores?
Facts from public storefront pages, as described in the notice for store owners.
Why does LeakBrief process this data, and on what legal basis?
To provide the service you signed up for (contract), to keep it secure and stop abuse (legitimate interests), and to meet tax and accounting duties (legal obligation).
Who receives my data?
Only the providers that run LeakBrief, listed on the subprocessors page, and Google when you choose to sign in with it.
Where is my data stored?
In the EU where we can choose: the database in Frankfurt and files in Cloudflare R2's EU jurisdiction; some providers also process data outside the EU.
Safeguards for each transfer outside the EU are confirmed during legal review.
How long is my data kept?
As long as your account is open, then deleted, except the records the law requires us to keep.
- Sign-in sessions end after 7 days.
- Briefs of paid accounts are kept for up to 12 months.
- Records of accepted terms and invoices are kept as long as Italian law requires.
What are my rights?
You can access, correct, export or delete your data, and object to or restrict its processing, by writing to privacy@leakbrief.com.
You can also lodge a complaint with the Garante per la protezione dei dati personali, the Italian data protection authority.
Does LeakBrief use cookies or analytics?
Only the technical cookies that sign-in and anonymous scans need, and no analytics or advertising pixels.