Privacy Policy

Revealer LLC ("Revealer," "we," "us," or "our") operates Revealer.US and its related search, account, API, and investigation features (the "Service"). This Policy describes information we handle about visitors, account holders, people who contact us, and individuals represented in search results.

Information you provide to operate an account is distinct from information returned by a search, although the same identifier can appear in both contexts. Search results come from public profiles and third-party providers, including breach and stealer-log sources. These source categories have different origins; availability through the Service does not mean a person published or verified every record.

This Policy describes practices and choices; it does not make use of the Service a substitute for consent where consent is required. Our Terms of Service and Acceptable Use Policy govern permitted use. Nothing in these documents excludes rights or obligations that cannot lawfully be excluded.

You may contact us to request access, correction, deletion, or a portable copy of personal information we hold about you. Requests may concern an account or information about you in search results. You do not need an account or paid subscription to make a request.

The rights available, their scope, and applicable exceptions depend on the law governing your request. Where provided by that law, rights may also include:

• Opting out of a legally defined sale or sharing of personal information, targeted advertising, or qualifying profiling;
• Limiting certain uses of sensitive personal information;
• Objecting to or restricting processing, or withdrawing consent to processing based on consent;
• Using an authorized agent, appealing a decision, or complaining to a competent privacy authority.

Email [email protected] with enough information to locate the account or record and explain your request. For search-result suppression, you can also use our opt-out form. Tell us your state or country if relevant. Do not include a password, full payment-card number, government-ID number, or unnecessary sensitive documents.

We may seek proportionate verification of identity or an agent's authority where permitted and necessary. Verification is not required for statutory opt-out requests where the applicable law prohibits that condition; those requests can be sent directly by email. We handle requests within applicable legal deadlines and use extensions only where allowed. Our general response target is 30 days, subject to any different legal requirement. If we decline a request, we explain the applicable reason and any available review or appeal route. We do not discriminate against a person for exercising applicable privacy rights.

You can opt out of promotional email using the unsubscribe link in a message or by contacting us. Marketing preferences are separate from your website-analytics choice. Necessary account, payment, security, and request-related communications may continue after a marketing opt-out.

We do not sell account-registration lists or optional website-analytics records to advertisers. Account registration records are not used to populate the third-party search profiles offered to other users. The Service does provide free and paid access to third-party search records; information returned in those records is disclosed to the person requesting the search. Privacy rights apply according to the relevant law, including its definitions of "sale" and "sharing," rather than the labels used for a feature.

Information may be disclosed in connection with:

• Requested features: Search providers receive submitted identifiers and related criteria needed to perform a lookup. Requested AI analysis, geolocation, images, and other connected features involve the providers described in Section 8.
• Service operations: Providers assist with hosting, account security, payment processing, email, support, and operational alerts.
• Your actions: Exports, shared links, team access, and material you send elsewhere can disclose information to recipients you choose, subject to the features available to your account.
• Legal and protective purposes: Disclosures described in Section 6, including valid legal requirements and appropriate action concerning fraud, abuse, disputes, or safety.
• Business transactions: A proposed or completed financing, merger, acquisition, reorganization, or transfer of assets, subject to applicable confidentiality, notice, and other legal requirements.
• Other authorized purposes: Where you direct the disclosure or provide consent when required.

We use technical and organizational controls designed to protect information and limit misuse. Controls in the Service include password hashing, account authentication, role-based access checks, session controls, request validation, rate limits, and security challenges. Two-factor authentication is available for supported accounts. Browser connections to our public website use HTTPS.

Security controls depend on the system and feature involved and may change as we maintain the Service. These descriptions are not a certification, a promise that every system uses a particular encryption standard, or a guarantee against unauthorized access, loss, or disruption. No Internet service, transmission method, or storage system can guarantee absolute security. Applicable security and incident-response obligations remain in effect.

Keep your account credentials and API keys confidential, use available security controls, and notify us if you suspect unauthorized access to your account.

Running a search, saving a record, closing an account, and requesting erasure are different operations. We retain information for service delivery, administration, security, dispute handling, and legal purposes, with the period depending on its category and purpose. We consider operational need, the nature of the information, your instructions, and applicable legal requirements.

• Search processing and working state: Inputs and results are processed to perform requested lookups. Browser session storage can retain search inputs, results, and aliases automatically so a working session can be restored. Profile-builder work and preferences may also remain in local browser storage. This storage is separate from optional website analytics.
• Usage and diagnostic records: Service records can include account or visitor identifiers, search category, timestamps, IP addresses, and operational details. Current routine usage-record writes remove query and result payload fields. Other diagnostic records can contain identifiers, URLs, error information, or provider-response details. Search-related content can therefore remain in retained records even when it is not presented as a saved search history.
• Saved investigations and monitoring: Saved incidents, builder profiles, notes, monitoring identifiers and findings, and report snapshots persist to provide the selected feature. Their contents may include information about you and other people.
• Caches: Derived location and IP-enrichment data, source feeds, and images can be cached by the Service, your browser, or infrastructure providers. Some caches are refreshed by age; others are replaced by capacity limits or a process restart. Certain image responses permit caching for up to one year. A cache reuse interval is not a guaranteed erasure deadline.
• Account, financial, and correspondence records: Account administration, payments, support, privacy choices, removal decisions, and related communications have separate operational and legal retention needs. Approved suppression identifiers are retained to maintain the suppression.

Routine usage records are configured for database cleanup after 90 days, pricing-funnel events after 400 days, and unverified removal requests after seven days. Automated cleanup runs asynchronously and does not establish simultaneous deletion from every log, backup, browser, provider, or previously shared copy. These operational intervals do not replace applicable legal duties or the handling of a valid privacy request.

The account-closure control deactivates access and revokes the account session. It does not automatically erase all associated personal information, saved material, or operational records. To request erasure of information we hold, contact us under Section 2. We assess and act on requests under applicable law; retained information may be necessary for legal requirements, fraud prevention, disputes, or other permitted exceptions.

Reports previously made accessible by a sharing link may remain accessible through that link until access is revoked, subject to feature availability. Revoking a link restricts access; it is not the same as erasing the stored snapshot. Account closure does not necessarily revoke previously issued links. Copies a recipient downloaded or retained, and records held independently by originating sources or payment providers, are outside our direct deletion control.

We evaluate requests from law enforcement and other authorities under applicable law. We may disclose information in response to valid, binding legal process, or where disclosure is otherwise required by law. We may also disclose information when we reasonably believe doing so is appropriate to address fraud, abuse, an imminent safety threat, a legal claim, or protection of the rights and security of the Service, our users, or others, to the extent permitted by law.

We may seek clarification, object to, or challenge a demand where appropriate. When legally permitted, we make reasonable efforts to notify affected users of requests for their account information. The information available to disclose depends on what is retained at the relevant time; we do not promise either that a particular record exists or that no responsive information exists.

We use cookies and browser storage for authentication, security, privacy preferences, requested working sessions, interface settings, and optional website analytics. The purposes and choices differ:

• Necessary and requested functions: Authentication, anti-abuse checks, session controls, working search results, and preferences continue when optional analytics are declined.
• Optional website analytics: First-party visit, referral, and pricing-interaction analytics and their browser identifiers are enabled only with a valid acceptance. A missing or expired choice, or merely closing the notice, does not authorize this collection.
• Campaign short links: Short links on revealer.us/go/ keep an aggregate, per-hour count of how often each link is opened. Opening one sets no cookie or identifier, and no IP address or browser details are stored with the count. Opens from a browser sending a GPC or DNT signal are not counted.
• Changing a choice: Use Privacy choices at the bottom left of the page. Choosing Essential only stops future optional website analytics and clears the related browser identifiers. It does not itself erase analytics previously recorded; you can make a separate privacy request.

A browser choice is remembered for up to 180 days. We record the choice and the time it was made as a preference receipt. A detected Global Privacy Control (GPC) or Do Not Track (DNT) signal keeps optional website analytics off, including after a previous acceptance. Choices apply to the browser where made; clearing storage or using another browser may require a new choice. Browser settings can restrict storage, but blocking necessary cookies can interfere with sign-in and other functions.

The website-analytics choice is separate from processing associated with accounts and requested services. Registration and access records can include IP-derived approximate location used for account administration and geographic service reporting, as described in Section 12. Declining optional website analytics does not disable that account-related collection or operational records.

Providers used by the Service include Stripe and NOWPayments for payment functions; Google for supported sign-in and AI features; Cloudflare Turnstile for bot protection; Resend for email; and communication services such as Discord for staff operational alerts. We also use hosting, public-profile, breach-data, image, IP-location, and geocoding providers. The provider and information involved depend on the feature used. Operational alerts may include account, transaction, support, or removal-request details.

When you request an AI feature, selected search evidence is sent to the AI provider, currently Google Gemini. Depending on the feature and source material, this can include identifiers, profile images, biographies, contact or location information, and other returned details. Credential-field masking limits specified values; it is not a guarantee that all personal information is removed. AI output can be incomplete or incorrect and should be checked against its sources. Requesting AI analysis is separate from accepting optional website analytics.

A submitted IP address or location may be sent to a location provider to supply an account or search feature. IP-derived location is an estimate, not a statement of a person's current physical location. Card details entered in a processor-hosted payment form are handled by that processor; we receive transaction and subscription information needed to administer the service.

Information may be processed in the United States and other countries where we or providers operate. Privacy laws and government-access rules can differ. Applicable requirements for international transfers remain in effect; this Policy does not itself supply consent or replace a required transfer safeguard. Third parties may also have independent responsibilities and privacy terms. Contact us for questions about the processing relevant to a particular feature.

We are not the original source of the public-profile and provider records returned by searches and do not control the underlying websites or databases. On-demand retrieval does not establish that the source information is current, accurate, complete, or independently verified. Records can contain mismatches, omissions, outdated information, or incidental personal details. A result does not establish identity, account ownership, current compromise, or wrongdoing.

We do not request Social Security numbers, government-ID documents, medical records, genetic information, or biometric identification templates for ordinary account registration. That limit on what we request is not a representation that every third-party record, saved note, image, or unsolicited communication is free of sensitive information. Certain views omit or mask specified fields; automated controls cannot establish that every source-provided value or passage has been classified or removed.

To request suppression of your information, use the opt-out form or contact our privacy address. The form uses email verification: a verified request for the same email identifier is processed automatically; usernames, phone numbers, names, addresses, and other identifiers require review. Verifying a contact email alone does not establish ownership of every identifier in a request. Manual review generally aims to finish within four weeks, subject to shorter applicable legal deadlines.

Suppression applies to approved identifiers within Revealer's supported matching and search controls. It does not delete a record at its original source, recall downloaded or previously shared copies, or establish that every variant, alias, or cached reference has disappeared. Different identifiers may require additional review. We retain the information needed to maintain approved suppression. These operational limits do not remove statutory rights; you can contact us about a request that is not adequately handled by the form.

You must use the Service lawfully and comply with our Terms and Acceptable Use Policy. Unauthorized access, credential misuse, harassment, and other prohibited conduct are not authorized by the Service. The Service is not offered for producing consumer reports or making eligibility decisions covered by the Fair Credit Reporting Act; our Terms prohibit such uses.

The Service is intended for adults aged 18 or older. We do not knowingly permit minors to register for or maintain accounts, and we do not solicit children's information for account registration. Sources may omit or misstate a person's age; our adult-use rules do not establish that everyone appearing in a third-party record is an adult.

If we learn that an account belongs to a person under 18, we take prompt steps to restrict the account and delete personal information collected directly through that account, subject to retention required by applicable law. We also take prompt steps to address personal information we learn was submitted directly to us by a child outside an account. Reports concerning a child's information in third-party results are reviewed promptly for suppression and other appropriate action. A parent or guardian can contact [email protected] with enough detail to locate the account or result. Please avoid sending additional sensitive documents unless they are necessary for an agreed verification process. These statements do not limit applicable protections for children.

We may revise this Policy as the Service and applicable requirements change. We post the revised version here and update the revision date. We provide email notice for significant changes, consistent with our notice commitments, and additional notice or consent where required by applicable law.

Revisions apply prospectively. A change to this text does not by itself authorize a materially different use of previously collected information or eliminate obligations arising under an earlier policy. Continued use is not a substitute for separately required consent, including optional website analytics.

Information you provide or request us to process includes:

• Account details: Email address, authentication and session information, optional two-factor settings, preferences, and name or profile image supplied through a supported sign-in provider. Account passwords are stored as hashes.
• Search and investigation material: Usernames, email addresses, phone numbers, names, addresses, IP addresses, and other supported search criteria; returned source records; saved profiles, notes, images, and monitoring identifiers.
• Billing and correspondence: Plan selections, payment and subscription metadata, refund or dispute details, and information supplied in support, sales, or privacy communications.

Information associated with use of the Service includes:

• Operational records: Account or visitor identifiers, request times, feature categories, plan usage, IP addresses, browser/device information, errors, and security or abuse-prevention records.
• Approximate account geography: IP-derived country, region, city, network/ISP, timezone, and approximate coordinates may be associated with an account at registration or subsequent access. These are used for account administration, geographic reporting, and service operation and are processed independently of the optional website-analytics choice.
• Optional website analytics: Visit, referral or campaign, and pricing-interaction information handled according to Section 7.

We use this information to carry out requested searches and connected features; administer accounts, subscriptions, payments, and saved work; support users; evaluate service usage and geographic distribution; maintain and improve the Service; investigate errors, fraud, and abuse; handle privacy requests and legal claims; send promotional communications where permitted by applicable law and your communication preferences; and satisfy applicable legal requirements. Uses requiring consent are subject to that requirement.

For privacy questions, requests, or reports concerning information in the Service, contact:

Section 2 describes request procedures and response timing. You do not need an account or paid plan to contact us.