Privacy Policy

Effective Date: 7/13/2026

Introduction

This Privacy Policy describes how BehindTheEmail ("we," "us," or "our") collects, uses, and discloses personal information when you use our software as a service, websites, APIs, and related services (collectively, the "Service").

We take privacy seriously. This Privacy Policy explains what information we collect, how we use it, and what rights you may have in relation to it. It applies to:

• Customers and visitors who create accounts, search, subscribe, contact us, or otherwise use the Service
• Individuals whose publicly available information may appear in search results when someone looks up an email address or related identifier (a "Lookup Target")

Please read this Privacy Policy carefully. By using the Service, you acknowledge the practices described here. Our Terms of Service also apply to your use of the Service.

Definitions

• Cookie: a small file placed on your device to enable certain features and functionality.
• Company, we, us, or our: BehindTheEmail.
• Country: where BehindTheEmail or its owners/founders are based, in this case the United States.
• Customer: the company, organization, or person that signs up to use the Service.
• Device: any internet-connected device such as a phone, tablet, or computer that can be used to visit BehindTheEmail and use the Service.
• Personal Data: any information that directly, indirectly, or in connection with other information allows for the identification of a natural person.
• Service: the software as a service and related offerings provided by BehindTheEmail.
• Website: BehindTheEmail's site, which can be accessed via https://behindtheemail.com.
• You: a person or entity that visits, registers with, or otherwise uses the Service.

Information We Collect

We collect several categories of information to operate and improve the Service.

Information You Provide as a Customer or Visitor

When you create an account, subscribe, contact us, or use certain features, we may collect:

• Email address
• Password (stored in hashed form) or authentication identifiers from Google Sign-In (such as Google account ID and verified email)
• Billing and subscription records associated with your account (processed through our payment processor)
• API keys you generate
• Contact form submissions, including name, email address, subject, and message
• Email addresses and lists you submit for search or bulk search
• Feedback and support requests

We do not require first name, last name, phone number, or postal address to create an account. We may receive name or other details if you voluntarily provide them (for example, in a contact form) or if a payment or support provider shares limited account-related information needed to process a transaction or request.

Information About Lookup Targets

When a Customer or visitor searches an email address or related identifier, we may collect, retrieve, infer, cache, and display publicly available information associated with that Lookup Target. Depending on available sources and the searcher's plan, this may include:

• Names, usernames, profile photos, bios, and profile URLs
• Professional history, education, and related public metadata
• Social or platform account signals and registration indicators
• Domain and email-related metadata
• Breach-related or credential-exposure indicators associated with publicly reported incidents
• Other publicly available profile attributes or inferences derived from public sources

We process Lookup Target information to provide the core search and enrichment functionality of the Service.

Automatically Collected Information

When you access the Service, we may automatically collect:

• IP address
• Browser type and version
• Device and diagnostic information
• Pages visited, timestamps, and approximate time spent
• Referring URLs and general usage patterns
• Search activity logs, including searched email addresses, request status, and associated account or IP identifiers
• Approximate location derived from IP address or network headers (for example, for security, abuse prevention, or regional pricing)

Cookies, Local Storage, and Similar Technologies

We use cookies, local storage, and similar technologies to operate the Service. These may include:

• Authentication cookies: to keep you signed in (for example, a secure session/token cookie)
• Security and anti-abuse technologies: Cloudflare Turnstile and hCaptcha may set cookies or collect device/browser signals to verify that requests are made by humans
• Analytics cookies: Google Analytics may set cookies to help us understand how the Service is used
• Preference storage: local storage may remember UI preferences such as dismissing a banner

You can control cookies through your browser settings. Blocking certain cookies may affect Service functionality, including login and captcha verification. Where required by law, we will obtain consent for non-essential cookies.

How We Use Your Information

We use collected information to:

• Provide, maintain, and improve the Service
• Perform email lookups, reconstruct profiles, cache results, and display research outputs
• Authenticate users, manage accounts, and enforce plan limits and rate limits
• Process payments, subscriptions, invoices, and usage-based billing
• Provide customer support and respond to inquiries
• Detect, prevent, and address fraud, abuse, security incidents, and technical issues
• Monitor usage, analyze product performance, and improve features
• Send transactional messages such as welcome emails, password-reset emails, claim/verification emails, and service notices
• Comply with legal obligations and enforce our Terms
• Fulfill any other purpose for which you provide information, or with your consent

Sources of Information

We may obtain information from:

• You directly (account registration, searches, bulk uploads, contact forms, and preferences)
• Your devices and browsers when you use the Service
• Authentication providers when you sign in with Google
• Payment processors when you subscribe or update billing details
• Publicly available websites, platforms, directories, and other open sources associated with Lookup Targets
• Service providers that help us operate captcha, support, analytics, email delivery, infrastructure, and related functions

Retention of Your Personal Data

BehindTheEmail retains Personal Data only for as long as necessary for the purposes set out in this Privacy Policy, including to provide the Service, maintain security and integrity, resolve disputes, enforce agreements, and comply with legal obligations.

In general:

• Account information is retained while your account remains active and for a reasonable period afterward as needed for security, billing, fraud prevention, and legal compliance
• Search logs, bulk-search records, cached profile results, and related operational logs are retained as needed to operate the Service, improve accuracy, prevent abuse, and support customer features such as recent searches
• Support communications are retained as needed to handle your request and maintain service records
• Billing and invoice records are retained as required for tax, accounting, and legal purposes
• Usage and analytics data may be retained for shorter or longer periods depending on security, product-improvement, and legal needs

When Personal Data is no longer needed, we will delete it, de-identify it, or securely isolate it from further processing, subject to applicable legal requirements.

Transfer of Your Personal Data

Your information, including Personal Data, may be transferred to — and maintained on — computers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ from those of your jurisdiction.

If you are located outside the United States and choose to provide information to us, please note that we transfer the data, including Personal Data, to the United States and process it there.

Your use of the Service and submission of information represents your agreement to that transfer, where such consent is a valid legal basis. BehindTheEmail will take steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy, and that transfers occur only where adequate controls are in place.

Disclosure of Your Personal Data

Service Providers

We may employ third-party companies and individuals to facilitate our Service ("Service Providers"), to provide the Service on our behalf, to perform Service-related services, or to assist us in analyzing how our Service is used. These third parties have access to Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for other purposes, except as permitted by law and their agreements with us.

Named Service Providers currently include:

• Cloudflare Turnstile: used to help protect the Service against bots and abuse. Cloudflare's privacy practices are described at https://www.cloudflare.com/privacypolicy/
• hCaptcha: used to help verify human users in certain flows (including profile claim). hCaptcha's privacy practices are described at https://www.hcaptcha.com/privacy
• Help Scout: used to handle customer support conversations submitted through our contact channels. Help Scout's privacy practices are described at https://www.helpscout.com/company/legal/privacy/

We also use other Service Providers for functions such as payment processing, email delivery, analytics, hosting, security, and operational tooling. Those providers process Personal Data only as needed to provide their services to us.

Analytics

We may use third-party Service Providers to monitor and analyze use of our Service.

• Google Analytics: Google Analytics tracks and reports website traffic. Google may use collected data in accordance with its policies, including to contextualize and personalize ads on Google's advertising network. You can opt out of Google Analytics by installing the Google Analytics opt-out browser add-on. For more information, visit https://policies.google.com/privacy

Payments

We may provide paid products and/or services within the Service. In that case, we use third-party services for payment processing.

We will not store or collect your payment card details. That information is provided directly to our third-party payment processors whose use of your personal information is governed by their Privacy Policy. These payment processors adhere to PCI-DSS standards as managed by the PCI Security Standards Council.

The payment processors we work with include:

• Stripe: https://stripe.com/us/privacy

Business Transactions

If BehindTheEmail is involved in a merger, acquisition, or asset sale, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.

Disclosure for Law Enforcement and Legal Requirements

Under certain circumstances, BehindTheEmail may disclose Personal Data if required to do so by law or in response to valid requests by public authorities. We may also disclose Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of BehindTheEmail
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of users of the Service or the public
• Protect against legal liability

Security of Your Personal Data

The security of your Personal Data is important to us, but no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

Children's Privacy

Our Service is intended only for users who are at least 18 years old. We do not knowingly collect Personal Data from anyone under the age of 18. If you are a parent or guardian and you become aware that a child under 18 has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from anyone under 18, we will take steps to remove that information from our servers.

Your Data Protection Rights

Depending on your location and applicable laws, you may have certain rights regarding your personal information, including rights to access, correct, delete, or restrict use of your information. We honor these rights as required by applicable law and are committed to providing reasonable access to the information that you have shared with us.

General Data Access and Deletion Rights

Regardless of your location, you can make the following requests regarding your personal data, subject to verification and applicable exceptions:

• Delete Your Data: You can request that we delete your personal information from our systems. We will comply with this request unless there is a legal requirement or other permitted exception for us to keep certain information.
• Self-Service Profile Removal: If your publicly available profile appears in our search results, you can remove it automatically by verifying your email address at https://behindtheemail.com/claim. Enter your email on that page and confirm via the link we send you. Once verified, your profile will no longer appear in search results. Changes may take a few hours to take effect across our systems.

To submit other data access or deletion requests, please contact us using the contact information provided at the end of this Privacy Policy. We will respond to your request within 30 days, or within the timeframe required by applicable law. We may need to verify your identity before processing your request.

GDPR Rights (EEA and Related Jurisdictions)

If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction with similar laws, you may have the following rights with respect to your personal data, subject to applicable limitations:

• Right to access
• Right to rectification
• Right to erasure
• Right to restrict processing
• Right to data portability
• Right to object to certain processing
• Rights related to automated decision-making, where applicable
• Right to withdraw consent where processing is based on consent

We process personal data under one or more lawful bases, which may include:

• Performance of a contract with you
• Our legitimate interests in operating, securing, and improving an OSINT research Service, provided those interests are not overridden by your rights
• Compliance with legal obligations
• Your consent, where required

If we transfer personal data outside the EEA or UK, we will ensure appropriate safeguards are in place, such as adequacy decisions, Standard Contractual Clauses, or other lawful transfer mechanisms. You may contact us for more information about the safeguards we use.

For Lookup Targets in the EEA/UK, profile removal via https://behindtheemail.com/claim is available in addition to other rights requests submitted to [email protected].

CCPA Privacy Rights (California Residents)

If you are a California resident, you are entitled to learn what data we collect about you, ask to delete your data, and not to sell (share) it. To exercise your data protection rights, you can make certain requests and ask us:

• What personal information we have about you. If you make this request, we will return to you, as applicable:

  • The categories of personal information we have collected about you
  • The categories of sources from which we collect your personal information
  • The business or commercial purpose for collecting or selling your personal information
  • The categories of third parties with whom we share personal information
  • The specific pieces of personal information we have collected about you
  • A list of categories of personal information that we have sold, along with the category of any other company we sold it to
  • A list of categories of personal information that we have disclosed for a business purpose, along with the category of any other company we shared it with

• To delete your personal information. If you make this request, we will delete the personal information we hold about you as of the date of your request from our records and direct any service providers to do the same, subject to permitted exceptions. In some cases, deletion may be accomplished through de-identification of the information. If you choose to delete your personal information, you may not be able to use certain functions that require your personal information to operate.

• To stop selling your personal information. We don't sell or rent your personal information to any third parties for any purpose. We do not sell your personal information for monetary consideration. However, under some state laws, sharing your data through certain targeted advertisements may be considered a "sale" of information. You are the only owner of your Personal Data and can request disclosure or deletion at any time.

We will respond to verified requests within 45 days as required by the CCPA. If we need more time, we will inform you of the reason and extension period in writing.

Please note, if you ask us to delete or stop selling your data, it may impact your experience with us, and you may not be able to participate in certain programs or membership services which require the usage of your personal information to function. But in no circumstances will we discriminate against you for exercising your rights.

To exercise your California data protection rights described above, please send your request(s) by email to [email protected]. You can also remove your profile from our search results automatically by verifying your email at https://behindtheemail.com/claim.

Your data protection rights described above are covered by the CCPA (California Consumer Privacy Act). To find out more, visit the official California Legislative Information website. The CCPA took effect on 01/01/2020.

California Do Not Sell My Personal Information

Under the CCPA, California residents have the right to opt out of the sale of their personal information. BehindTheEmail DOES NOT sell personal information as defined by the CCPA.

Information Collection Notice for California Residents

In the past 12 months, we have collected the following categories of personal information, as applicable:

• Identifiers (such as name, email address, IP address, account identifiers)
• Commercial information (such as products purchased or considered)
• Internet or other electronic network activity (such as browsing and search activity)
• Geolocation data (approximate, derived from IP or network headers)
• Inferences drawn from other personal information

We use this information for the business and commercial purposes described in this Privacy Policy.

Controller and Processor Roles

For most processing described in this Privacy Policy—including operating the Service and processing information about Lookup Targets—BehindTheEmail acts as an independent controller (or equivalent under applicable law).

Where we process personal data solely on a Customer's documented instructions under a separate written agreement (for example, certain enterprise arrangements), the Customer may be the controller and BehindTheEmail may act as a processor for that specific processing. Our Terms of Service describe those limited processor obligations.

Links to Other Sites

Our Service may contain links to other sites that are not operated by us. If you click a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

If you have any questions about this Privacy Policy, please contact us:

• By email: [email protected]