Privacy Policy

How FootprintIQ handles your data: what we collect, why we collect it, retention, cookies, analytics, and your rights under UK GDPR.

Run a Free Scan Username Search

Privacy Policy

Last updated: 13 October 2026

Introduction

FootprintIQ provides OSINT-powered digital footprint scanning to help you understand and protect your online privacy. We are committed to handling your data responsibly and in compliance with UK GDPR and applicable data protection laws.

We do not sell your personal data, and scan queries are processed transiently.

What Data We Process

Data You Provide

When you use FootprintIQ, we process the following information you provide:

Scan Inputs: Email addresses, usernames, domain names, IP addresses, and phone numbers you submit for scanning
Account Information: Email address, name (optional), and authentication credentials. If you sign in with Google, we receive your email address, display name and profile picture from your Google Account (see "Google Sign-In & Google Account Data" below)
Support Requests: Any information you provide when contacting support

Usage Data

We automatically collect limited usage data:

Basic Logs: Timestamps of scans, subscription tier, and aggregated usage statistics
Technical Data: Browser type, device type (for responsive design), and general location (country-level for compliance)
Analytics: Privacy-friendly analytics via Plausible (no personal identifiers, respects Do-Not-Track)

Cookies & Consent

We use essential cookies for authentication and session management. Optional analytics cookies are only enabled with your explicit consent. You can manage cookie preferences via our consent banner.

Google Sign-In & Google Account Data

FootprintIQ offers "Sign in with Google" as an optional way to create and access your account. If you choose it, Google asks your permission to share basic profile information with us. We request only the standard sign-in scopes (openid, email and profile) and nothing else: no Gmail, Drive, Contacts, Calendar or other Google service data.

What we receive from Google

Your Google Account email address
Your display name
Your profile picture URL
A unique account identifier used to recognise you on subsequent sign-ins

How we use it

To create your FootprintIQ account and sign you in without a separate password
To show your name and picture inside your own dashboard
To send account and service emails (receipts, scan alerts, security notices) to your email address

What we do not do with it

We do not use Google Account data as an input to any scan. Scans only run on the username, email, phone number or image you type in yourself
We do not sell Google Account data, share it with advertisers or data brokers, or use it for advertising
We do not transfer it to third parties except the processors listed under "Sharing & Third-Party Processors", and only to operate the service
We do not use it to train machine-learning or AI models
No human at FootprintIQ reads it except to resolve a support request you have raised, for security investigation, or where the law requires

FootprintIQ's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke FootprintIQ's access at any time from your Google Account permissions page. Revoking access does not delete your FootprintIQ account; to delete it, use the account settings or email [email protected]. Google Account data is retained for as long as your account exists and is deleted within 30 days of account deletion, in line with the retention periods below.

Legal Basis & Purpose (UK GDPR)

We process your data under the following legal bases:

Performance of a Contract: Processing scan requests you initiate is necessary to provide the service you've requested
Legitimate Interests: Security monitoring, fraud prevention, abuse detection, and service improvement (where not overridden by your privacy rights)
Consent: Analytics cookies and non-essential processing (you may withdraw consent at any time)
Legal Obligation: Compliance with data protection laws, court orders, and lawful requests from authorities

Data Sources

We query only open-source and publicly accessible OSINT providers including Have I Been Pwned, Shodan, VirusTotal, DNS/WHOIS records, and data broker databases. We do not bypass authentication, access private systems, or engage in unauthorized data collection. See our Data Sources & Methodology page for details.

Data Retention

Scan Inputs: Processed transiently and deleted immediately after results are delivered (typically 2-5 minutes)
Scan Results: Stored encrypted in your account for 90 days (Pro users) or 30 days (Free users)
Account Data: Retained while your account is active; deleted within 30 days of account deletion
Aggregate Analytics: Non-personal, anonymized diagnostics may be retained indefinitely for service improvement

Sharing & Third-Party Processors

We share limited data with selected processors who help us operate the service:

Cloud Hosting: Supabase (data storage and authentication) — EU/UK data residency
Analytics: Plausible Analytics (privacy-friendly, GDPR-compliant, EU-hosted)
Email: Transactional email service for account notifications (Resend or equivalent)
OSINT Providers: Have I Been Pwned, Shodan, VirusTotal APIs (scan queries only)

We never sell your personal data. All third-party processors are bound by data processing agreements and security requirements.

Cookies & Analytics

Essential Cookies

Authentication tokens and session cookies (required for service functionality, no consent needed under UK GDPR)

Analytics Cookies

We use privacy-friendly Plausible Analytics with no personal identifiers, no cross-site tracking, and full respect for Do-Not-Track (DNT) browser settings. Analytics are only enabled with your explicit consent.

Your Rights (UK/EU GDPR)

Under UK GDPR and the UK Data Protection Act 2018, you have the following rights:

Right of Access: Request a copy of all personal data we hold about you
Right to Rectification: Correct inaccurate or incomplete data
Right to Erasure ("Right to be Forgotten"): Request deletion of your data (subject to legal retention requirements)
Right to Restrict Processing: Limit how we use your data in certain circumstances
Right to Object: Object to processing based on legitimate interests
Right to Data Portability: Receive your data in a machine-readable format
Right to Withdraw Consent: Withdraw consent for analytics or non-essential processing at any time
Right to Lodge a Complaint: File a complaint with the UK Information Commissioner's Office (ICO)

To exercise any of these rights, contact us at [email protected]

International Transfers

We primarily use EU/UK-based service providers. Where data is transferred outside the UK/EEA, we ensure adequate safeguards via Standard Contractual Clauses (SCCs) or other approved transfer mechanisms.

Enterprise Data Processing

For Enterprise customers, we offer enhanced data protection terms:

Data Processing Agreement (DPA): Full GDPR-compliant DPA available (see DPA Terms)
Data Residency: Choose EU, UK, or US data storage regions for scan results
Extended Retention: Customizable retention periods up to 2 years with encrypted archival
Dedicated Instances: Single-tenant deployments available for sensitive workloads
Audit Logs: Complete audit trails of all data access and processing activities

Contact [email protected] for Enterprise data protection requirements.

Children's Privacy

Our service is not intended for individuals under 16 years of age. We do not knowingly collect personal data from children. Parents may scan their minor children's digital footprint with appropriate consent (see our Responsible Use Policy).

Contact & Data Protection Officer

For privacy questions, data subject access requests, or concerns:

Email: [email protected]

UK ICO Registration: FootprintIQ Ltd is registered with the Information Commissioner's Office, reference ZC124972

Updates to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email or a prominent notice on our website.

The "Last updated" date at the top of this page indicates when the policy was last revised.

Governing Law: This Privacy Policy is governed by the laws of England and Wales. Any disputes will be subject to the exclusive jurisdiction of the courts of England and Wales.

Privacy Policy

FootprintIQ

FootprintIQ — Ethical Digital Footprint Intelligence

FootprintIQ is an ethical digital footprint intelligence platform. We use open-source intelligence (OSINT) techniques to help people understand their online exposure — without surveillance, monitoring, or invasive data collection. Our platform scans usernames across 400+ social media platforms and forums, detects email breaches, identifies data broker listings, and labels every finding through our proprietary LENSiQ engine, which keeps a checker's measured per-site baseline separate from identity evidence — all built on publicly available data with full transparency.

Scanning Capabilities

Username search across 400+ social platforms, forums, and developer communities
Email breach detection using multiple data sources including Have I Been Pwned
Data broker exposure identification across major people-search aggregators
Phone number lookups and reverse phone intelligence (Pro plan)
Name-based people search aggregation and cross-referencing
Dark web mention monitoring for leaked credentials and personal data
LENSiQ scoring that labels each hit with a measured per-site detector baseline, kept separate from identity evidence

Our Ethical Principles

Public data only — we never access private accounts or bypass authentication
No surveillance, monitoring, or tracking of individuals
User-initiated scans with full informed consent
LENSiQ scores are policy numbers built on measured detector baselines — not probabilities, and not identity confirmation
Designed for ethical self-audit as the safest and most responsible use case
Transparent methodology — we explain exactly how our tools work

Privacy & Data Removal Resources

FootprintIQ provides comprehensive guides for removing personal information from the internet, including step-by-step data broker opt-out instructions for sites like Spokeo, BeenVerified, and MyLife. Our Privacy Centre gives you full control over your data, and our guides cover Google content removal, address removal from Google Maps, and strategies for cleaning up your digital footprint after a data breach.

Educational Content & Research

Explore our blog covering topics like what is OSINT, how data brokers work, username reuse risks, identity theft prevention, and the role of AI in modern intelligence gathering. Visit our AI Answers Hub for instant, expert-level responses to your digital privacy and OSINT questions.

Who Uses FootprintIQ

Individuals auditing their own digital footprint, job seekers preparing for employer background checks, developers checking for leaked credentials, crypto users protecting wallet-linked identities, executives managing impersonation risks, and security professionals conducting authorised investigations. FootprintIQ is not a data broker, people-search site, surveillance tool, or background check service.