Privacy Policy

Service Providers

We work with trusted third-party service providers who assist us in operating our Service. These providers have access to your personal data only to perform specific tasks on our behalf and are obligated to protect your information.

• Authentication services (Auth0, Google Sign-In) - User identity verification and session management. When you sign in with Google, we receive only your name, email address, and profile picture. We do not request access to any other Google services or data.
• Payment processors - Processing subscription payments and billing
• Cloud infrastructure providers - Hosting, data storage, and computing services
• Customer support platforms - Live chat and support ticket management
• AI service providers - Help our support team prepare replies to your messages, using the conversation and the account details needed to answer you. They process this data only to provide this service to us.
• Email service providers - Transactional and notification emails
• Search and data providers - Web search capabilities for leak detection

Advertising & Conversion Measurement (Google Ads)

We use Google Ads to measure how our advertising performs. When you reach our site from a Google ad and later complete a purchase, we may share a Google click identifier (the "gclid" stored in your browser) together with the purchase event (the amount and currency paid) with Google. This lets us attribute the sale to the ad you clicked and understand which campaigns work. We do not share your name, email, or any gallery content for this purpose.

We capture your advertising-consent signal (Google "ad_user_data" / "ad_personalization") from your cookie preferences at checkout. For users in the EEA, the United Kingdom, and Switzerland this sharing happens only with your consent: we upload a conversion to Google only when you have granted consent for marketing cookies, and if you decline, no purchase data is shared with Google for advertising measurement. Elsewhere we share it by default, and your cookie preferences are passed to Google with it.

Legal basis: Consent (GDPR Article 6(1)(a)). You can withdraw your consent at any time by updating your cookie preferences, which stops any further sharing of this data with Google.

Advertising on Facebook & Instagram (Meta Pixel)

When marketing cookies are on (in the EEA, the UK, Switzerland and Canada, only after you accept them), we use the Meta pixel on our public pages (the homepage, pricing, our product and platform pages, and the blog). Meta Platforms Ireland Ltd. then receives a page view for each of those pages you visit, one event when you start the free scan (it says only whether the scan is for a creator or an agency, with no name or username) and one sign-up event when you create an account, together with the Meta cookies listed in our Cookie Policy (_fbp and _fbc), your IP address, and browser information such as your browser type and the address of the page. We use this to measure how our ads on Facebook and Instagram perform and to show our ads to people who have visited our site.

Through the pixel, Meta does not receive your name, your email address, the usernames you ask us to protect, your scan results, or anything about leaks. The pixel sends no page views from your account, your dashboard, onboarding, or any page that shows leak data or usernames, and we have switched off Meta's automatic data collection features, so it sends only the events described here.

For the collection and transmission of this data, we and Meta Platforms Ireland Ltd. are joint controllers; Meta is responsible for what it does with the data afterwards. Meta may transfer the data to Meta Platforms, Inc. in the United States. These transfers rely on the EU-US Data Privacy Framework, under which Meta Platforms, Inc. is certified, and on the European Commission's Standard Contractual Clauses. You can read how Meta uses this data in the Meta Privacy Policy.

Legal basis: Consent (GDPR Article 6(1)(a)). You can withdraw your consent at any time through your cookie preferences. The pixel then stops sending data and we remove the Meta cookies from your browser. Withdrawing does not affect data already sent.

Advertising on X (X Pixel)

When marketing cookies are on (in the EEA, the UK, Switzerland and Canada, only after you accept them), we use the X pixel on the same public pages as the Meta pixel (the homepage, pricing, our product and platform pages, and the blog). X Internet Unlimited Company then receives a visit when you open one of those pages in your browser, one event when you start the free scan and one sign-up event when you create an account, with no details attached to either event, together with the X cookies listed in our Cookie Policy (_twpid, _twclid and _twsid), the X ad click id if you came from an ad on X, your IP address, and browser information such as your browser type, language and time zone, the address of the page and, as your browser reports it, the address of the website that sent you to us. We use this to measure how our ads on X perform and to show our ads to people who have visited our site. If you live outside the EU, the EFTA States and the UK, the recipient is X Corp.

We do not send X your name, your email address, the usernames you ask us to protect, your scan results, or anything about leaks. Outside our public pages the pixel sends only the free-scan and sign-up events, which can happen during sign-up and carry the address of the sign-up page and nothing you typed; it sends nothing from your account or your dashboard.

For the collection and transmission of this data, we and X Internet Unlimited Company are joint controllers; X is responsible for what it does with the data afterwards, which under its own policy can include combining it with other information it holds. X may transfer the data to X Corp. in the United States. X states that it participates in the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework, and that it relies on the European Commission's Standard Contractual Clauses where applicable. You can read how X uses this data in the X Privacy Policy.

Legal basis: Consent (GDPR Article 6(1)(a)). You can withdraw your consent at any time through your cookie preferences. We then stop sending data to X and remove the X cookies from your browser. Withdrawing does not affect data already sent.

Customer Lists for Our Ads (Meta)

If you are or were a paying customer and the country on your account is outside the EEA, the United Kingdom, Switzerland and Canada, we may give Meta Platforms Ireland Ltd. an encrypted version of your email address: we turn it into a SHA-256 hash before it leaves our systems. Meta matches the hash with its own users, uses the match only to show our ads to people similar to our customers and to avoid showing them to people who already use LeakRemover, and deletes the hashes after matching. Meta does not receive your name, the usernames you ask us to protect, your scan results, or anything about leaks. The transfer terms described for the Meta pixel above apply here too.

You can say no at any time: reply to our email about this, or write to admin@leakremover.com. We then leave you out of every future upload and remove you from the lists already given to Meta. Customers in the EEA, the UK, Switzerland and Canada are never included.

Legal basis: Legitimate interest in promoting our service (GDPR Article 6(1)(f)), with your right to object at any time (Article 21).

Advertising on Bing (Microsoft Advertising)

When marketing cookies are on (in the EEA, the UK, Switzerland and Canada, only after you accept them), we use the Universal Event Tracking (UET) tag of Microsoft Advertising on our site. Microsoft then receives a page view for each page of our site you visit, one event when you create an account, one event when the first scan of a new account finds more than a set number of possible leaks (the event does not include the number, your username or any link), and one event when you make a purchase, with the amount and currency paid. With them it receives the Microsoft cookies listed in our Cookie Policy (_uetsid, _uetvid and _uetmsclkid), the Microsoft click id (the "msclkid" in the link) if you arrived from one of our ads on Bing or another Microsoft site, your IP address, and browser information such as your browser type and the address of the page. We use this to measure which of our ads on Bing lead to sign-ups and purchases.

Through the tag, Microsoft does not receive your email address or your phone number: we have not switched on Microsoft's enhanced conversions, which would send them.

Microsoft Corporation and, for people in the EEA, the UK and Switzerland, Microsoft Ireland Operations Limited are responsible for what Microsoft does with this data. It may be processed in the United States by Microsoft Corporation, which is certified under the EU-US Data Privacy Framework. You can read how Microsoft uses this data in the Microsoft Privacy Statement, and you can turn off personalised ads from Microsoft in your Microsoft ad settings.

Legal basis: Consent (GDPR Article 6(1)(a)). You can withdraw your consent at any time through your cookie preferences. The tag then stops sending data. Withdrawing does not affect data already sent.

Advertising in ChatGPT (OpenAI)

We advertise in ChatGPT. When you reach our site from one of our ads in ChatGPT, the link carries an ad click reference from OpenAI (the "oppref"), which we keep in a first-party cookie (lr_attr, listed in our Cookie Policy) and with your account. If you then create an account, if the first scan of your new account finds more than a set number of possible leaks, or if you buy a subscription, our server sends OpenAI one event for it. Each event contains only the click reference, the type of event (account created, qualifying first scan or subscription), when it happened, the address of the page without anything after the "?" and, for a subscription, the amount and currency paid. We use this to measure which of our ads in ChatGPT lead to sign-ups and purchases.

OpenAI does not receive your name, your email address, your phone number, your IP address, the usernames you ask us to protect, the number of leaks found, your scan results, or anything about leaks. We do not use OpenAI's pixel or any OpenAI script on our pages: the events go from our server to OpenAI.

OpenAI is responsible for what it does with this data and may process it in the United States. You can read how OpenAI uses data in the OpenAI Privacy Policy.

In regions where we ask before optional advertising measurement, including the EEA, the United Kingdom, Switzerland and Canada, we send these events only after you accept marketing under the current consent notice, which names OpenAI. A choice saved under an earlier notice does not authorize OpenAI measurement, so we ask again. Elsewhere we send events unless you have turned marketing off. We do not send events when your browser signals Global Privacy Control or when we cannot establish your country. For subscription events, we also require a consent signal recorded at checkout.

Legal basis: Consent (GDPR Article 6(1)(a)). You can withdraw your consent at any time through your cookie preferences. We then stop sending these events to OpenAI. Withdrawing does not affect events already sent.

Website Operators (DMCA Takedown Notices)

When we send DMCA takedown notices on your behalf, we share limited information with website operators: your name/username (as copyright holder), description of copyrighted work, URLs of infringing content, and our contact information as your authorized agent.

Legal Authorities

We may disclose your personal data if required by law, court order, or government request, or to protect our legal rights and the safety of our users.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity. You will be notified of any such change.