Privacy

Privacy notice

This is written to be read, not to be survived. If anything here is unclear, ask us.

Where we got your email address

If we wrote to you first, mostly from your own website — the published contact, home, about and team pages — or, where only a shared inbox is published, from a business contact provider that holds published business details. We do not buy consumer lists, email private individuals at home, or guess addresses from a pattern.

Why we are allowed to write to you

Our emails go to businesses about something relevant to that business, which UK law (PECR, and the legitimate interests basis under UK GDPR) permits without prior consent, provided we identify ourselves, give a postal address and offer a way to stop. Replying with the word STOP blocks your address the same day, automatically, and you can ask us to block your whole domain too. Sole traders and partnerships have stronger protection — tell us and we remove you immediately.

What we hold

If we emailed you

Your business name, domain, the published email address, the result of the public check we ran, and whether you replied.

If you ran a check

The domain concerned and the result, so the same answer can be shown again rather than re-run. No account or password. This site also remembers the last domain you checked in your own browser, so the buy buttons can fill it in; it stays on your device.

If you bought a report or monitoring

Your business name, the domain, a contact email, the reports we produced, and — for monitoring — the schedule and results over time. Payment is handled by Stripe; your card details go straight to them and never reach us.

If you asked us to stop

Your address on a suppression list, kept indefinitely, used for nothing else.

Leaked passwords checks

We only look an email address up in breach records when the person who owns that address asks us to. If you type an address on our page, we do not check it — we send a private link to that address, and the check runs only when you open the link and press “Check”. That request is your consent, and you can withdraw it at any time.

• What we hold: the address, when you asked, the result (the names and dates of known breaches and what each one exposed) and, for a short time, your internet address so we can stop the form being misused.
• What we never hold: passwords. We never ask for one, and our provider never sends us one.
• Who checks it: a specialist breach-data provider based in the United States, which receives only the email address being checked and does not store the query.
• How long: private links and their results are deleted after 30 days.
• Team checks (paid): a business sends us its own staff addresses and confirms it has the authority to do so. The report goes only to an address at that business’s own domain. Breaches of a sensitive or personal nature are counted but never named.

Website and internet exposure checks

These use public information only. The website check reads Google’s public results for a site and the site’s public pages. The internet exposure check reads public internet scan records, made by a third-party scanning service, about machines linked to a domain, plus public DNS. We never connect to, test or log in to anyone’s systems.

• What we hold: the domain, the business name, the findings (for example a machine’s address, what it showed and when it was seen) and, if we wrote to you, the published address we wrote to.
• Personal data: if a record or page happened to contain someone’s personal data, we do not open it, store it or mention it.
• Why: legitimate interests — telling a business about a risk that public information shows about its own systems, and, if it asks, helping it close it.
• How long: as for the other checks below: prospect records within 12 months if you never replied, results 30 days, customer records as set out below.

How long we keep it

Prospect records are deleted within 12 months if you never replied. Check results expire after 30 days. Customer and monitoring records are kept while your service is active and for up to 6 years afterwards, as UK tax and accounting rules require. Suppression entries are permanent, on purpose.

Who else sees it

Our email is sent through Google Workspace; our websites are hosted in the UK and EU; payments are processed by Stripe. We do not sell or share your data with anyone else for their own use, and there are no advertising trackers on this site.

Your rights

You can ask us what we hold about you, ask for it to be corrected, or ask for it to be deleted (subject to records we must keep for tax). Email [email protected] and we will answer within 30 days, usually the same day.

If you are unhappy, please tell us first. You also have the right to complain to the Information Commissioner’s Office.

Cookies

This site sets no advertising cookies. A simple visitor counter (StatCounter) records which pages are opened and from where.

Data controller: Leisure Websites Limited, Unit 79723, PO Box 4336, Manchester M61 0BW.