U.S. privacy notice

Last updated: 9 October 2026. This notice applies to residents of the United States and describes our practices under United States law. It sits alongside our general privacy policy, which describes how the service works everywhere. Where the two differ for a U.S. resident, this notice controls.

This notice is governing in English. A Spanish translation is provided for convenience; if the two disagree, the English text applies to U.S. residents.

1. Who we are

Am-i-exposed.com is operated by Guillermo Carlin, an individual based in Lima, Peru.

Email: support@selenticgroup.com
Postal address: Av. Mariscal La Mar 750, Interior 510, Edificio LABOX, Miraflores, Lima, Peru

We are based outside the United States. Your data is processed in the United States and the European Union by the providers listed in section 4.

2. What we collect, and what we do not keep

Email address you check. Used to run the lookup and not stored. It is not written to any database, not added to any mailing list, and never placed in a web address, which is the part a server would log.

Password you check. Never sent to our servers. Your browser computes a cryptographic fingerprint and sends only its first five characters to the compromised-password service, which returns a broad set of fingerprints. The comparison happens inside your browser. Neither we nor that service can tell which password was checked.

IP address. Recorded for one purpose: limiting how many lookups come from one origin, so nobody can use the search to check other people's addresses in bulk. It is held against a counter, for minutes, and never stored next to an address that was checked.

Account. If you create an account we hold your email address and an encrypted, irreversible version of your password. We never store a password in readable form. If you sign up with Google or GitHub we receive your email address and an identifier from them, and never your password for those services.

Alert subscription. If you subscribe to class action alerts we hold your first name, last name, and the U.S. state you tell us you reside in. We use the state for one thing: some settlements pay residents of particular states an additional statutory amount, and we flag those for you.

Payments. Payments are processed by Stripe. The seller is Guillermo Carlin; Stripe is the payment processor and takes payment in its own environment. We never receive or store your card details. We keep your account identifier, the amount, the currency, the status of the transaction, the dates, and the identifiers Stripe returns.

Aggregate counts. We count how many lookups are run each day, in which language, of which type, and whether the result was exposed or clean. These are counters. No row identifies a person, and no address or password is part of them.

3. What we use it for

• Running your lookup and producing your action plan
• Sending the alerts you subscribed to
• Tying what you paid for to your account
• Taking payment and issuing receipts and refunds
• Preventing abuse of the service
• Replying when you write to us

We do not sell your personal information. We do not share it for cross-context behavioral advertising. We do not use it to build advertising profiles. We run no advertising cookies and no cross-site tracking.

4. Who we share it with

These providers process data on our behalf and on our instructions, or are necessary for the service to function:

• Supabase — database and account management.
• Vercel — hosting and technical access logs.
• Stripe — payment processing.
• Brevo — delivery of receipt, refund and alert emails.
• Zoho CRM — Guillermo Carlin's customer records. Receives the address you signed up with, the language you use the site in, and, if you bought something, the amount and date. It receives no address you have checked and no result of any check.
• Have I Been Pwned — the email address being checked, to return which breaches it appears in. We send it no passwords.
• Google Fonts — serves the site's typefaces and, by the nature of that connection, receives your IP address when a page loads.

5. Email we send you, and how to stop it

Every commercial email we send carries a working unsubscribe link and our physical postal address, and identifies us as the sender. We honor an unsubscribe request within 10 business days, and we do not sell or transfer your address to anyone else afterwards. Subject lines describe what the message actually says.

Transactional messages about something you bought, such as a receipt or a refund, are not marketing and continue after you unsubscribe from alerts.

6. Your subscription, if you have one

• We disclose the amount and the billing frequency before you confirm your payment details.
• We take your separate, affirmative consent to automatic renewal. It is its own step, never bundled into acceptance of the terms and never a pre-checked box.
• You can cancel at any time, without calling anyone. Write to support@selenticgroup.com and we cancel it the same day.
• We keep the record of your renewal consent for three years, or one year after you cancel, whichever is longer.
• If the price changes, we tell you in advance.

7. Your rights

The comprehensive state privacy laws now in force set revenue and volume thresholds that we are below, so they do not currently require this of us. We offer it anyway:

• Know what data of yours we hold and where it came from
• Correct anything wrong or incomplete
• Delete it, including your account, its purchase history and the matching record in our CRM
• Opt out of a particular use
• Not be discriminated against for exercising any of these

To exercise them, write to support@selenticgroup.com from the address attached to your account, or tell us how we can verify it is you. We reply within 45 days. If we need longer we will tell you why, and take no more than 90 days in total. You may use an authorized agent; we will ask for proof that you authorized them.

Because we hold so little, most requests are short to answer. We cannot tell you which addresses or passwords you have checked, because we never kept them.

8. If we are breached

If a security incident affects your personal information we will notify you and the authorities required by the breach notification law of your state, within the deadlines it sets, and without unreasonable delay.

9. Minors

The service is for adults. We do not knowingly collect personal information from anyone under 13, and we do not direct this service to children. If we learn we hold a child's data we delete it. If you believe a child has given us data, write to support@selenticgroup.com.

10. Security

The site is served entirely encrypted. Account passwords are stored using key derivation functions built for the purpose, never in readable form. Database access is restricted by policies that stop one account reading another's data. No system is invulnerable, which is why the design starts from keeping as little as possible.

11. Changes

If we change this notice we update the date at the top. Where a change materially affects how we handle your data, we say so on the site before it takes effect.