Privacy policy

Last updated: 25 September 2026. This document describes what we do with your data on this service, in the same terms the system is actually built.

1. Who is responsible

The data controller is Guillermo Carlin, an individual based in Lima, Peru, who operates am-i-exposed.com.

For anything concerning your personal data, including the rights described in section 8, the channel is support@selenticgroup.com.

2. What we handle, and what we do not keep

Free email check

When you type an email address to look it up, that address is used to run the query and is not stored. It is not saved to any database, not added to any mailing list, and does not travel inside the page's web address, which is the part that would be recorded in the server's access logs.

Password check

The password you type is never sent to our servers. Your browser computes a cryptographic fingerprint and transmits only its first five characters to the compromised-password service, which replies with a broad set of fingerprints; the final comparison happens inside your browser. Neither we nor that service can tell which password was checked.

IP address

We record the IP address queries come from, for one purpose only: to limit the number of queries per origin and stop anyone using the search to check other people's addresses in bulk. It is stored against a counter, not against the addresses checked.

User account

If you create an account, we handle your email address and an encrypted, irreversible version of your password. We never store the password in the clear. If you choose to sign up with Google or GitHub, we receive your email address and an identifier from that provider; we do not receive your password for those services.

Purchases

If you buy the action plan, we keep your account identifier, your email, the amount, the currency, the state of the transaction, the dates and the identifiers returned by the payment processor. We neither receive nor store your card details: those are handled directly by Stripe in its own environment.

3. What we use it for

• Running the check and producing your action plan.
• Tying the access you bought to your account for the period purchased.
• Taking payment and issuing the receipt and, where applicable, the refund.
• Preventing abuse of the service.
• Replying to messages you send us.

We do not use your data for advertising, we do not sell it, and we do not pass it to third parties for commercial purposes.

4. Who we share it with

We work with providers that process data on our behalf and on our instructions, or that are necessary for the service to work at all:

• Supabase: database and account management.
• Vercel: site hosting and technical access logs.
• Stripe: payment and refund processing. Receives your email to attach to the transaction.
• Brevo: delivery of receipt and refund emails.
• Zoho CRM: Guillermo Carlin's customer records. Receives the address you created your account with, the language you use the site in and, if you bought the plan, the amount and date of the payment. It receives no address you have checked and no result of any check.
• Have I Been Pwned: receives the email address being checked in order to return which breaches it appears in. We send it no passwords.
• Google Fonts: serves the site's typefaces and, by the nature of that connection, receives your IP address when the page loads.

5. Where it is processed

The providers above run servers outside Peru, mainly in the United States and the European Union. Using the service therefore involves a cross-border transfer of your data to those jurisdictions, within the meaning of Peru's Law 29733 and its regulations. We choose providers offering adequate levels of protection and contractual data processing terms.

6. How long we keep it

• Addresses checked in the free lookup: not kept.
• Per-IP counters: as long as the abuse-control window needs, on the order of minutes or hours.
• Account: as long as you keep it open. If you ask us to delete it, we delete it, along with the matching record in the CRM.
• Purchase records: for the duration of the relationship and afterwards for the period required by applicable accounting and tax obligations.

7. Cookies and browser storage

We use no advertising cookies. To know how many people visit the site we use Vercel Web Analytics, which uses no cookies and stores nothing that identifies you. We also count how many checks are run and whether the result was exposed or clean, without storing the address. There is no cross-site tracking and no profiling.

One thing is kept in your browser's local storage, and it never reaches our servers on its own: your session token if you signed in, without which you would have to sign in again on every page. You can clear it at any time from your browser settings. The language is not stored: each version of the site has its own address.

8. Your rights

Law 29733 grants you the rights of access, rectification, cancellation and objection, along with rights to information and to withdraw consent. Concretely, you can:

• Ask what data of yours we hold and where it came from.
• Correct anything wrong or incomplete.
• Ask us to delete it, including your account and its purchase history.
• Object to a particular use.

To exercise them write to support@selenticgroup.com from the address attached to your account, or tell us how we can verify your identity. We will reply within the deadlines set by the regulations to Law 29733 and, in any event, within a maximum of twenty business days.

If you believe your request was not handled properly, you may take it to Peru's National Authority for Personal Data Protection at the Ministry of Justice and Human Rights.

9. Security

The site is served entirely encrypted. Account passwords are stored using key derivation functions designed for the purpose, never in the clear. Database access is restricted by policies that prevent one account from seeing another's data. No system is invulnerable, which is why the design starts from keeping as little data as possible.

10. Minors

The service is intended for adults. We do not knowingly collect data from minors. If we find an account created by a minor without the authorisation of a parent or guardian, we will delete it.

11. Changes to this policy

If we change this policy we will update the date at the top. Where a change materially affects how we handle your data, we will say so on the site.