Privacy Policy

1. What we collect when you visit

• IP address and approximate location. When you run a search we record your IP address, the country, city and internet provider it belongs to (looked up through ip-api.com), how often you have visited, and when. If you search for an email address, that address is stored alongside your IP. We use this to prevent abuse and to understand how the service is used.
• Rate limiting. Your IP address (or account, when signed in) is counted in a short-lived store to enforce the hourly search limit.
• Analytics. We use Google Analytics to measure visits and page views. Google sets cookies for this and processes your IP address and browser details under its own privacy policy.

2. Accounts

If you create an account we store your email address and a hashed (never plain-text) password, plus the history of searches you run while signed in, so you can find them in your dashboard. A cookie keeps you signed in for up to 30 days; it is removed when you log out.

3. What you search for

The website, IP address, email address, phone number, IBAN, card BIN or wallet address you enter is stored with the report we generate, so the result can be cached and shared with your team. To build a report we query the public sources relevant to that input — for example domain registration records, DNS, certificate logs, blocklists, breach indexes (XposedOrNot), Gravatar, bank and card issuer registries (OpenIBAN, binlist.net), and public blockchain explorers. The value you searched for is sent to those services as part of the lookup.

Card numbers never reach us. If you paste a full card number, your browser cuts it down to the first eight digits (the BIN) before anything is sent. Only the BIN is looked up and stored.

4. People and businesses in reports

Reports describe websites, addresses and numbers using publicly available information. Website and IP reports can appear in search engines. Reports on email addresses, phone numbers, IBANs, cards and crypto wallets are kept out of search engines. If a report concerns you or your business and you want it removed or corrected, email removal@osintintel.com with the report link and your reason.

5. Where data is stored

The site runs on Vercel. Reports, accounts and visitor records are stored in a PostgreSQL database hosted by Supabase in Europe; website screenshots are stored in Vercel Blob. Rate-limit counters are held briefly in Upstash Redis. Some of these providers, and Google, may process data outside the European Economic Area under their standard safeguards.

6. How long we keep it

Reports are kept so they can be served from cache and refreshed; account data is kept until you ask us to delete your account. Visitor and search records are kept until you ask us to remove them.

7. Your rights

Under the GDPR you can ask to see the data we hold about you, have it corrected or deleted, object to its use, or receive a copy. Email removal@osintintel.com and we will respond within one month. You can also complain to your data protection authority — in the Netherlands, the Autoriteit Persoonsgegevens.

8. Changes

We update this policy when the service changes. The date at the top shows the latest version. See also our Terms of Use.