Privacy Policy

01 Who Is Responsible#

LeakTrace Inc. ("LeakTrace", "we") is responsible for the personal information described in this policy. We are a Canadian company governed by the Personal Information Protection and Electronic Documents Act (PIPEDA), and we also follow the Quebec, Alberta and British Columbia private-sector privacy laws and the US laws described in Sections 12 and 13 where they reach what we do.

When we deliver work under a partner's name (for example an insurance association or a firm that resells our assessments), the partner decides why its members' information is used and we process it for the partner under our agreement with them. You can still write to us directly and we will help, or pass your request to the partner.

02 What We Collect, by Who You Are#

We collect only what we need for the purpose stated at each point. Find the group that describes you.

Website visitors

• Your IP address and browser details, which reach our hosting and network providers with every request and are recorded in request and error logs.
• If you use the assistant on a brief or a help page: your questions and its answers.

People who run the free individual check

• The email address you enter, the IP address the check came from, your region (Canada or US), the number of breach records found, and the time you agreed to our terms.
• The results: the name and date of each breach that lists the address, and the kinds of data each breach exposed. We do not obtain or hold the breach files themselves.
• A copy of the result under a one-way hash of the address, so a repeat check within 24 hours does not query the breach service again.

Firms we assess and the people we write to

• The firm's name, domain, city, sector and public business listing details.
• What anyone can read about the domain from outside: DNS and mail settings, certificates, and published web pages (Section 4).
• The firm's published contact address, and where we can find one, a contact person's name and role. Addresses come from the firm's own website, public business listings, and Hunter, a service that indexes business addresses published on the web. Names come from the firm's site and public search results.
• Whether that contact address, and other work addresses at the domain, appear in breach records, with the breach name and date.
• What public AI assistants and search results say about the firm's phone number, address and standing when asked about it by name.
• Our emails to the firm, whether they were delivered, opened or clicked where our email provider reports it, replies, when the brief link was opened, and any opt-out.

Customers

• Name, email and password when you create an account. Passwords are stored as salted hashes, never in readable form. If you turn on two-step sign-in, an authenticator secret and hashed recovery codes.
• Name, work email, firm, domain, and the answers and signature you give when you order, sign the assessment agreement, request a call or send an enquiry.
• Staff email addresses you ask us to check, supplied by you.
• A record of each purchase: product, amount, date and Stripe's reference. Card details are entered on Stripe's page and never reach our systems.
• Your assessment, delivered documents, monitoring history, alerts sent and your notification preferences.
• The optional “I need this by” date, if you give one when you order. It is stored with the order.
• Sign-in records for your assessment and monitoring pages (Section 10). For each one-time code: a keyed hash of the code, never the code itself, a hash of the address it was sent to, and when it stops working. Each try at entering a code. Each signed-in browser: a hash of the value in its cookie, a hash of the address that signed in, browser details and when the sign-in ends. Each of these carries a keyed hash of the network address it came from, not the address itself. A record that a code was sent, that code entry was paused or that you signed out is also kept in our evidence record (Section 9), with the network address and browser details.
• If you start an order and do not pay: the details you entered and the record of the terms you agreed to. The order is marked abandoned and unlocks nothing (Section 9).

Partners, their staff and the members they enrol

• For partner staff: name, work email, role, sign-in and two-step sign-in records, referral and payout records.
• For a member business a partner enrols: the business name, domain and contact email the partner gives us. Nothing is assessed until that business consents on its own consent page. We record the name typed, the time, the network address and the version of the terms agreed to, or the refusal or withdrawal.

Perimeter households

• Only for an adult who signs their own consent page: the email addresses, phone number, public handles, other names, a distinguishing city or employer, home address and aircraft registrations they choose to list, and the sharing choices they tick.
• What is found about those details on the public sources named on that consent page, stored as excerpts and links, never as copies of others' content.
• The consent record: the name typed, the time and the network address it came from.

Sales representatives, staff and applicants

• Name, contact details, sign-in and two-step sign-in records, the leads assigned and the notes logged on them, voicemail recordings you upload, commission and payment records, and application answers. We do not record sales calls.

03 Why We Use It, and Our Basis#

We do not use personal information for any purpose beyond these without telling you and, where the law requires it, asking again. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it to make decisions about anyone's employment, credit, insurance or housing.

We do not rely on the "publicly available" exception in PIPEDA for information on websites: the regulation that defines it covers only narrow classes such as telephone directories and professional directories required by law. Where we use a published business address, it is for the business purpose above and nothing else.

04 Assessing Firms From Outside#

We assess the public-facing systems of firms in Canada and the US, including firms that have not asked us to. These assessments are limited to what any visitor can read: public records (DNS and mail settings, certificates, certificate logs, registration data, breach databases and public internet indexes) and the firm's published web pages and the scripts they load. They open no connection to any of a firm's service ports, request no hidden paths or files such as /.env, do not list a site's authors, and do not check storage bucket names or sign-in portals. A paid assessment adds those checks, and only after the buyer authorises it in a signed assessment agreement. Our Outside Reading Policy lists each kind of review and every check it runs.

Findings about a firm are disclosed to that firm, or to the customer who ordered the assessment. A brief we send to a firm is reached through a private link that stops working on the date shown on it. A customer’s own assessment and monitoring pages are not opened by a link alone: they open only after a one-time code is sent to an email address already on that customer’s record and entered on the page (Section 10). Where an assessment finds work addresses at the firm’s domain in breach records, the addresses we can name, and the breaches each is listed in, are shown to the signed-in customer on that assessment page.

05 Email We Send#

Business email to firms

• We write to the published business address of a firm about the firm's own externally visible exposure. Often this is a general address such as info@.
• In Canada we rely on implied consent under Canada's Anti-Spam Legislation (CASL) s.10(9)(b): the address was conspicuously published without a statement that the firm does not want unsolicited messages, and the message relates to the recipient's business role. In the US our email follows the CAN-SPAM Act.
• Every commercial email identifies LeakTrace Inc. and the person sending it, gives our mailing address, and carries an unsubscribe link.
• The unsubscribe link takes effect as soon as you confirm on the page it opens. An opt-out by reply or by email to [email protected] is acted on within 10 business days, and in practice sooner.
• An opt-out goes on a suppression list that every send checks before it goes out, so it holds even if your address reaches us again from another source. A domain-wide opt-out is available on request.

Email to individuals

• Running the free check does not put you on any mailing list. We do not send marketing email to people who run a check and do not buy.
• If you start a checkout and do not finish it, we may send up to three reminders over three days. Each has an unsubscribe link.
• Customers receive receipts, delivery notices, alerts and service messages about what they bought.

06 Automated Scoring and AI#

• Rating: a firm's Rating from 0 to 100 is calculated by fixed rules from the findings, such as a missing mail protection record or an address found in a breach. It describes a domain's exposure. It is not a decision about any person.
• AI drafting: some written summaries in briefs and assessments are drafted by an AI model (Anthropic's Claude) from the findings. The AI Impersonation Check asks AI assistants what they say about a firm by name.
• AI review of paid assessments: before a paid assessment is released, an AI model reviews its findings and the text of the firm's public web pages, which can include staff names and work addresses. A person then checks that review and approves the release.
• Email we receive: email sent to our addresses, including [email protected] and therefore privacy requests sent there, is passed to Anthropic's model to sort it and, for some messages, to draft a reply. The model sees the sender's name and address, the subject and the first part of the message. A person reads any drafted reply before it is sent, and a person handles every privacy request.
• Finding a contact: to find who to write to at a firm, we ask an AI model with web search (Anthropic's Claude, or Google's Gemini when staff choose it) for the name and published work address of a person at the firm.
• Perimeter: where a household member has consented, AI models (Anthropic's Claude and Google's Gemini) help decide whether a web result found in a sweep is about that person.
• Review by a person: every paid External Cybersecurity Assessment is reviewed and approved by a person before it is released. Individual check results and the briefs we send to firms are produced automatically.
• Assistant chat: questions typed into the assistant on a brief, an assessment, a help page, our representatives' portal or a website we host for a client are sent to Anthropic to produce an answer. On a brief, the conversation is kept with that brief so we can follow up. Do not type personal information about clients, patients or staff.

You can ask us which information and factors produced a result, ask for it to be corrected, and ask for a person to review it. Write to the Privacy Officer.

07 Who Processes It for Us#

These service providers process personal information for us, only to provide their service to us, under their own contractual and security terms:

To run a check or an assessment we also send a query to the services that hold the information being checked. Our product pages call these monitored breach databases and public sources; here we name them, because you are entitled to know who receives your information:

• Breach records: a breach-data provider, which receives the email address or phone number being checked, or a firm's domain.
• Search results: Serper, which receives a firm's name or domain and, for Perimeter, the names, other names and public handles of household members who consented.
• Published business addresses: Hunter, which finds and verifies a published work address, and Google Places, which returns business listings.
• The AI Impersonation Check: Anthropic (Claude), Google (Gemini, and Google Places for the business listing) and, where enabled, Perplexity, OpenAI, xAI (Grok) and Microsoft (Azure AI with Bing search), which receive a firm's name, domain and city.
• Domain, network and reputation records: Shodan, VirusTotal, SecurityTrails, AbuseIPDB, PhishTank, URLhaus, crt.sh, CertSpotter, HackerTarget, ipapi.co, Mozilla Observatory, the Internet Archive, domain registries (RDAP and WHOIS, including CIRA) and the federal insolvency records search. These receive a domain, an IP address or a firm name only.
• Perimeter only: Reddit search and the Internet Archive also receive the names of household members who consented and the web addresses of pages found about them.

They receive the information being checked, not your account details. We no longer use BreachDirectory (through RapidAPI) or Apollo. The subprocessor list sets out every provider above, what it receives and where, on one page.

We may disclose information where the law requires it, for example in answer to a court order, or to protect our rights or someone's safety. If LeakTrace is sold or merged, the information would pass to the new owner under this policy, and we would tell you first.

08 Where It Is Stored#

We are a Canadian company, but our application and database are hosted in the United States, and most of the providers in Section 7 are in the United States. If you are in Canada, your information is transferred to and stored in the United States. While it is there it is protected by our contracts with those providers, but it is subject to US law and may be accessed by US courts, law enforcement and national security authorities.

Our breach-data provider is operated from Australia and Hunter from France; they receive only the query described in Section 7.

Quebec law requires a privacy impact assessment before personal information about people in Quebec is sent outside Quebec. We have not yet written that assessment for the providers in Section 7. The Privacy Officer can tell you about any of our providers outside Canada and how they protect your information.

09 How Long We Keep It#

Most of what we hold is kept until you ask us to delete it. We do not yet run automatic deletion on most records, so we say so here rather than promise a period we do not enforce. The exceptions are listed.

When we delete information, we remove it from our database and it ages out of backups as described. We may keep a minimal record that a deletion took place.

The evidence record

We keep an evidence record: a list of dated entries, each tied to the one before it so that a later change to any entry can be detected. It records what was agreed, ordered, paid for, delivered and changed:

• the terms and agreements a person accepted, with the time and the network address;
• orders, payments, refunds and card disputes;
• each outside check we ran on a firm and the authority for it;
• when an assessment was held, approved and released, and the fingerprints of its documents;
• the emails our systems sent;
• sign-ins to customer pages, and each time a member of our staff opened one;
• changes made to a firm’s email records on its approval;
• privacy requests, deletions, and changes our staff made to records.

Why: so that in a dispute, a card dispute or a legal claim we can show what happened and that the record has not been edited. Who sees it: our staff with administrative access and, where one of those matters calls for it, a card issuer, a court, a regulator or our professional advisers. How long: 15 years from each entry, the longest period in which a claim about it can still be brought in Ontario. No entry is deleted before then, and nothing yet deletes one at 15 years. One part goes sooner: the network address and browser details on a sign-in entry are removed 24 months after the sign-in, unless that record has a refund or a card dispute, in which case they are kept with it. If you ask us to delete your information, the evidence record is kept for that purpose, and we tell you so.

10 Security and Breaches of Our Systems#

• In transit: all traffic to our site is served over HTTPS, with HSTS set for one year.
• Backups: database backups are encrypted with AES-256-GCM before they leave our hosting provider, and the key is kept outside our code repository.
• Sign-in: passwords are stored as salted hashes. Two-step sign-in is required for staff, sales representatives and partner portal owners and administrators, and customers can turn it on. Repeated failed sign-ins are rate limited and the originating address is blocked. Sessions end after seven days.
• Customer pages: a customer’s assessment and monitoring pages, and a read-only view a customer shares, open only after a one-time code is sent to an email address already on that record and entered on the page. The link alone does not open them. A code works once and for 10 minutes, and five wrong codes pause code entry for 15 minutes. The browser then stays signed in for 30 days. If “This is a shared computer” is ticked, it stays signed in only until the browser closes, and for no longer than 12 hours. Signing out ends it at once. The one exception is the browser that has just placed an order, which can open that order’s page for up to two hours without a code. A member of our staff opens a customer’s page only when signed in with two-step sign-in, and that access is recorded. The code is sent by our email provider (Section 7).
• Access: access to customer data is limited to staff roles that need it.
• Payments: card details are handled by Stripe and never reach our systems.

We hold no security certification such as SOC 2 or ISO 27001, and we do not claim one. No system is perfectly secure.

If our systems are breached

If a breach of our security safeguards involves your personal information and creates a real risk of significant harm, we report it to the Office of the Privacy Commissioner of Canada, notify you as soon as feasible, and notify any other organisation that can reduce the harm, as PIPEDA s.10.1 requires. We also notify the Commission d'accès à l'information for a confidentiality incident affecting people in Quebec, the Alberta Commissioner where Alberta law requires it, and people and authorities in US states as each state's breach law requires. We keep a record of every breach of our security safeguards for at least 24 months, as PIPEDA requires, and for at least five years where it affects people in Quebec.

11 Your Rights and How to Use Them#

How to ask

• Use the privacy request form, or email [email protected] with "Privacy request" in the subject, or write to the Privacy Officer at the address in Section 1.
• We may ask you to confirm that you control the email address, phone number or domain concerned, and we ask only for what is needed to do that.
• We answer within 30 days of receiving your request. If we need longer, we tell you within those 30 days why, and how much longer (no more than 30 more days).
• If you need help putting a request in writing, we will help you. There is no charge. If we refuse any part of a request, we tell you why in writing and how to complain.
• Someone you authorise in writing can make a request for you.
• We will not treat you differently for using any of these rights.

If you are not satisfied

Tell the Privacy Officer first; we investigate every complaint and tell you the outcome. You can also complain at any time to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, the Office of the Information and Privacy Commissioner of Alberta or of British Columbia, or, in the US, your state Attorney General or the Federal Trade Commission.

12 Canada and Quebec#

PIPEDA governs our handling of personal information across Canada. Section 11 describes your rights under it. In addition:

• Quebec: our Privacy Officer is the person in charge of the protection of personal information. You can also ask us to stop disseminating information about you, or to de-index a link to it, where the dissemination breaches the law or a court order or causes you serious injury. Your right to portability (Section 11) applies to computerized information you gave us. We tell you when a result is based only on automated processing (Section 6).
• Alberta: our service providers outside Canada, the countries where they collect, use, store or disclose information, and why, are listed in Sections 7 and 8. Our written policies on them are available from the Privacy Officer, who answers questions about them.
• British Columbia and Alberta: those laws do not treat business contact information used only to reach a person about their work as personal information to be protected under them. Everything else in this policy applies to you in full.

13 United States#

• State consumer privacy laws: as a small company we do not meet the thresholds of the California Consumer Privacy Act or of most similar state laws, which apply above set revenue or consumer-count levels. Where a state law does apply to us, we honour the rights it gives. We offer the rights in Section 11 to everyone anyway, including people in California, and answer within 30 days.
• Categories and sources: the categories we collect and their sources are in Section 2; the purposes in Section 3; the providers in Section 7. In the last 12 months we have not sold personal information or shared it for cross-context behavioural advertising, and we have no actual knowledge of selling or sharing information of anyone under 16.
• Do Not Track and Global Privacy Control: our website runs no analytics or advertising trackers, so there is nothing for these signals to switch off.
• Other parties on our site: Google (through Fonts) and Stripe (on checkout pages) receive information about your visit and may collect information about your activity over time, including on other websites that use their services, under their own privacy policies. We allow no advertising network to do so.
• Health and financial information: we are not a HIPAA covered entity or business associate and do not receive patient or client records. Our assessments read a firm's public-facing systems only.

14 Cookies#

These are the cookies our website sets. Our Cookie Policy has the same list with more detail.

We use no analytics or advertising cookies, and no third-party trackers: no Google Analytics, no advertising pixels and no social media pixels, so there is no cookie notice to answer. Blocking csrftoken or sessionid prevents signing in and running a check, and blocking the customer sign-in cookie (lt_ps_) prevents opening your assessment or monitoring page; blocking the others changes nothing you rely on.

Our website also loads fonts from Google Fonts, which receives your IP address but sets no cookies. Emails our systems send can report to us whether they were delivered or opened, where the recipient's mail program allows it.

15 Children#

Our services are for adults and businesses. They are not directed to children, and we do not knowingly collect personal information from anyone under 13, or under 14 in Quebec, without the consent of a parent or guardian. Perimeter watches a person under 18 only when a parent or guardian is named on that person's consent and signs it with them; a child a parent lists without a consent page of their own is never watched. If you believe we hold a child's information, write to the Privacy Officer and we will delete it.

16 How We Govern Personal Information#

• Roles: the Privacy Officer approves new uses of personal information, answers requests and complaints, and keeps our incident record. Staff and representatives see only the records their role needs.
• New projects: Quebec law requires a written privacy impact assessment for a new system that involves personal information and before information about people in Quebec is sent outside Quebec. We have not yet written one (Section 8).
• Complaints: we acknowledge a complaint, investigate it, tell you the outcome and what we changed, and keep a record of it.
• Retention: Section 9 is our retention schedule. When a period ends or you ask, we delete the information.
• Providers: we use only the providers in Section 7 and confine them to the service they provide to us. The subprocessor list is updated before we add a provider that processes customer personal information.

17 Changes to This Policy#

We change this policy when what we do changes. The effective date at the top shows the current version. We tell customers by email before a change that affects how their information is used, and we ask for consent again where the law requires it.

18 Contact#

• Privacy Officer, LeakTrace Inc.
• Email: [email protected]
• Mail: 1200 Bay Street, Suite 1201, Toronto, ON M5R 2A5, Canada
• Requests: privacy request form