Your Privacy Matters

1. Introduction

DarkStrata Ltd ("we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website, use our services, or otherwise interact with us.

We are registered in England and Wales (Company No: 16521338) and are the data controller responsible for your personal data. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We are registered with the Information Commissioner's Office (ICO), the UK's independent authority for data protection.

Contact details:
Email: hello@darkstrata.io

2. Information We Collect

We may collect and process the following categories of personal data:

2.1 Information You Provide

• Account information: Name, email address, company name, job title, and password when you register for our services
• Contact information: Name, email, phone number, and message content when you contact us
• Payment information: Billing address and payment details (processed securely by our payment providers)
• Domain check requests: Name, email, and domain information when you request a security check
• Stealer Check requests: The personal email address you ask us to check, the address you turn alerts on for, and any further addresses you add to a personal account for ongoing monitoring (see Section 2.4)

2.2 Information Collected Automatically

• Technical data: IP address, browser type and version, time zone, operating system, and platform
• Usage data: Pages visited, time spent on pages, navigation paths, and features used
• Cookie data: Information collected through cookies and similar technologies (see Section 7)

2.3 Information from Third Parties

• Single Sign-On providers: If you use SSO to access our services, we receive basic profile information from your identity provider
• Business partners: Information from resellers or referral partners regarding your account

2.4 Stealer Check (personal exposure checks)

Stealer Check lets an individual find out whether their own email address appears in infostealer logs, breach data or other criminal-marketplace sources that we have collected. It works differently from the rest of our services, so we explain it separately.

• Ownership first: We only ever send the result to the address you asked us to check, so only someone who can open that inbox sees it. The website never confirms whether an address is or is not in our data.
• What we show you: By email: which stealer logs your address was found in, the date each was captured and the services involved. In a personal account, and where the source data includes them: usernames, details of the infected device, any session cookies that were taken, and passwords shown masked so you can recognise one without it being displayed in full. We never send passwords, masked or otherwise, by email.
• Source data: The exposure data we match against was published or traded by criminals, not supplied by you. We hold it to detect and respond to compromise, under our legitimate interests and the security interests of the people and organisations affected. We do not use it for any other purpose.
• Alerts: If you turn on alerts with the link in your result email, we keep that address and check it against new data as we collect it, and email the address when new data contains it: the services involved and when the data reached us. Our data-processing systems receive only a one-way hash of the address, not the address itself. Every alert has a one-click unsubscribe, and once a year we ask whether you still want alerts; if you don't confirm within 30 days, we stop them.
• Ongoing monitoring: If you create a personal account, we keep the addresses you have verified and check them against new data as we collect it. Each further address must be verified in the same way. You can remove an address, or delete the account and every address with it, from the account at any time.
• Other people's addresses: You may not use Stealer Check to look up an address you do not control. Because results only ever go to the address itself, a request for someone else's address tells you nothing and sends a confirmation email to them.
• Password checks: If you choose to check whether a password of yours has been exposed, the check uses a k-anonymity method: only a short prefix of a hash of the password leaves your browser. We never receive, store or see the password.

3. How We Use Your Information

We use your personal data for the following purposes and legal bases:

4. Data Sharing and Disclosure

We may share your personal data with:

• Service providers: Third parties who provide services on our behalf, such as hosting, payment processing, email delivery, and analytics. These providers are contractually obligated to protect your data and use it only for specified purposes.
• Professional advisers: Lawyers, accountants, and auditors where necessary for legal, accounting, or audit purposes.
• Law enforcement: Government bodies, regulators, or law enforcement agencies where required by law or to protect our legal rights.
• Business transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity.

We do not sell your personal data to third parties. We do not share your data with third parties for their own marketing purposes without your explicit consent.

5. International Transfers

Our services are hosted in the United Kingdom (London). Customer account data, monitored assets and alerts are stored and processed there. For customers in the European Economic Area, the UK benefits from an EU adequacy decision, so no additional transfer mechanism is required. Where a service provider processes personal data outside the UK, we ensure appropriate safeguards are in place, including:

• Transfers to countries with adequate data protection laws as determined by the UK Government
• Standard Contractual Clauses approved by the UK Information Commissioner's Office
• Other legally recognised transfer mechanisms

The providers that process personal data on our behalf, where they do so and the safeguard relied on are listed on our Subprocessors page. Our Data Processing Agreement applies where we process personal data on behalf of customers.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.

• Account data: Retained for the duration of your account and for 6 years after closure for legal and tax purposes
• Contact enquiries: Retained for 2 years from the date of enquiry
• Stealer Check one-off requests: The address and request record are deleted 30 days after the result is sent. Turning on alerts or creating a personal account keeps the address separately, as below
• Stealer Check alert addresses: Retained while alerts are on. Unsubscribing, or not confirming the yearly reminder within 30 days, ends alerts; the address and its alert history are then deleted within 30 days
• Personal account addresses: Retained while the address is on your account. Removing an address, or deleting the account, deletes it and its match history within 30 days
• Analytics data: Aggregated and anonymised after 26 months
• Marketing preferences: Retained until you withdraw consent

7. Cookies and Similar Technologies

Our website uses cookies and similar technologies to enhance your experience. When you first visit our website, you will be asked to consent to non-essential cookies.

7.1 Essential Cookies

These cookies are necessary for the website to function and cannot be switched off. They are usually set in response to actions you take, such as setting privacy preferences or logging in.

7.2 Analytics Cookies

With your consent, we use Google Analytics to understand how visitors interact with our website. This helps us improve our services. Google Analytics uses cookies to collect information about your use of the website, including your IP address (anonymised), pages visited, and time spent on each page.

You can withdraw your consent for analytics cookies at any time through our cookie preferences banner or by clearing your browser cookies.

For more information about Google Analytics, visit: Google Privacy Policy

8. Your Rights

Under UK data protection law, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data in certain circumstances
• Right to restrict processing: Request that we limit how we use your data
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent: Where we rely on consent, you can withdraw it at any time
• Rights related to automated decision-making: Not to be subject to decisions based solely on automated processing that significantly affect you

To exercise any of these rights, please contact us at hello@darkstrata.io. We will respond within one month of receiving your request.

To stop Stealer Check alerts and have the address deleted, use the unsubscribe link in any alert. If you hold a Stealer Check personal account, you can remove monitored addresses or delete the account yourself from within the account, without contacting us. Erasure requests about the exposure data itself (data collected from criminal sources that mentions you) are handled case by case: we will stop matching your addresses against it on request, but we may retain the underlying record where it is needed to protect the organisations and other people it also affects.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated: ico.org.uk/make-a-complaint

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Access controls and authentication mechanisms
• Regular security assessments and monitoring
• Staff training on data protection and security
• Incident response procedures

While we strive to protect your personal data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security but are committed to maintaining industry-standard protections.

10. Third-Party Links

Our website may contain links to third-party websites, plugins, and applications. Clicking on these links may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy practices. We encourage you to read the privacy policy of every website you visit.

11. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately and we will take steps to delete such information.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Email: hello@darkstrata.io
Website: darkstrata.io

DarkStrata Ltd
Registered in England and Wales
Company No: 16521338
VAT Registration No: GB495674335