Acceptable Use Policy

The rule that governs everything else

One rule sits above every other rule here. You may search a person only where you have a lawful reason to do so and, where the law requires it, that person's authority. Everything below applies that rule rather than adding to it.

Orca Scanner returns information about real people. Running a search is not a neutral act, and paying for a credit does not make it one. Before you spend one, you should be able to answer three questions:

• What is my purpose? Name it in one sentence. If it takes a paragraph, it is probably several purposes, and at least one is likely to be prohibited.
• What is my lawful basis? Searching a person is processing their personal data. You need a basis for it, and consent is only one of several.
• Could I justify this to the person I am searching, and to a regulator? If the honest answer is no, do not run it.

We cannot supply your lawful reason, and you remain responsible for your own compliance. Using Orca Scanner does not make a search lawful, does not move your obligations onto us, and is not a defence to anything.

This policy forms part of our Terms of Service. Breaking it is a material breach of your agreement with us.

Who this policy applies to

It applies to you if you hold an Orca Scanner account, to every search you run in the browser or through the REST API, and to everything you do with the results afterwards.

An account belongs to one named individual and is not transferable. An API key carries your account's full search authority and draws on the same credit balance as the browser, so treat one as you would your password and revoke it in the application if it is exposed.

Every search made with your credentials is treated as yours and you are answerable for it, whether or not you allowed the person who ran it.

What Orca Scanner does, so you know what you are agreeing about

Orca Scanner runs three kinds of search: username, email address and phone number. Each costs a single credit. A search queries several upstream sources at once and returns one normalised report.

Results are fetched from those sources at the moment you run the search, and returned to you. We do not index results and we do not build a searchable database of the people who have been searched. There is no way to ask Orca Scanner who has been looked up, because that record is never assembled. This is why several of the prohibitions below exist.

We only query sources that are lawfully accessible to us: endpoints the platforms themselves expose publicly, public registers, and data licensed to us by specialist providers. We do not go behind a login, defeat a rate limit, use stolen credentials, or deceive a system to get information. That restraint is a term of the Terms of Service, and this policy asks you for the same restraint in how you use what comes back.

Credits are an internal metering unit, not money and not redeemable for cash. How they are bought, spent, returned and expired is set out in the Terms of Service.

What you may use Orca Scanner for

These are the purposes we built the product for. Read the list as a description of legitimate work, not a set of magic words. Naming one does not authorise a search that fails the rule at the top of this policy.

• Fraud prevention. Checking whether an identifier presented in a transaction, an application or a sign-up behaves like a real person's identifier.
• Anti-money laundering and know your customer checks. Onboarding and ongoing monitoring by a regulated firm, or by someone acting for one.
• Sanctions screening. Establishing whether you are dealing with a person you are prohibited from dealing with.
• Security research and threat intelligence. Attributing phishing infrastructure, mapping a fraud network, or enriching an indicator during incident response.
• Corporate due diligence and asset tracing. Counterparty checks before a transaction, investigating a suspected conflict of interest, or tracing assets in a recovery matter.
• Legal proceedings and investigations. Work by or for a party to actual or contemplated proceedings, by a licensed investigator, or by a public authority acting within its powers.
• Journalism in the public interest. Verification and investigation where the public interest is real and identifiable, not merely public curiosity.
• Checking your own exposure. Searching your own username, email address or phone number, or those of an organisation you are authorised to act for.

A use that is not listed is not automatically prohibited. Apply the rule at the top of this policy, and if you are unsure ask us at [email protected] before you run the search rather than afterwards.

What you may not use Orca Scanner for

Each prohibition carries its reason, because a rule that is explained is a rule that gets followed. These are not preferences. Breaking any of them puts your account at risk.

Eligibility decisions about a person

You may not use Orca Scanner, in whole or in part, to decide whether someone gets a job, credit, insurance, housing, a place in education, a licence or a benefit. You may not use it to screen job applicants or tenants, or to support a decision to dismiss someone.

Why. In most countries these decisions are reserved to regulated bodies working under rules that protect the person assessed: accuracy duties, a right to see the file and a route of appeal. In the United Kingdom credit referencing is a regulated activity, and data protection law constrains decisions made about people this way. (In the United States the Fair Credit Reporting Act reserves such decisions to consumer reporting agencies.) We are not a consumer reporting agency, a credit reference agency or a referencing agency of any kind, and an Orca Scanner report is not a consumer report and must never be used as one.

Stalking, harassment, intimidation and doxxing

You may not use Orca Scanner to track, monitor, pursue, frighten or harass anyone, or to locate a person who does not want to be found by you. You may not publish, or threaten to publish, what you find to expose, punish or intimidate someone. You may not use it in connection with domestic abuse, or in breach of a protective order, restraining order, bail conditions or any equivalent measure.

Why. A phone number or an email address is often the last barrier between someone and a person they took careful steps to escape. This is the gravest harm the product can cause, and the one case where we suspend first and ask questions afterwards.

Searches that target children

You may not run a search where you know or suspect that the person is under 18. The one exception is a competent authority, or someone acting under its direction, working to protect that child.

Why. Children cannot weigh what happens when their identifiers are gathered and passed on, and data protection law gives their personal data additional protection. If you are unsure of someone's age and have reason to think they may be a child, treat that as suspicion and do not search.

Surveillance of journalists, human rights defenders, lawyers, activists and trade union organisers

You may not use Orca Scanner to research or monitor a journalist, human rights defender, lawyer, political or civil society activist, or trade union organiser because of the work they do. This applies whoever you act for, including where you act for a government.

Why. These roles depend on being able to work without being watched: a journalist who cannot protect a source stops receiving information, a lawyer under surveillance cannot advise in confidence, and an organiser who is identified can be dismissed. The prohibition attaches to the reason for the search, not the occupation, so a journalist suspected of fraud can be investigated for the fraud like anyone else.

Bulk searching and building your own database

You may not run searches in bulk or at random, work through lists of identifiers to see what comes back, or enumerate identifiers systematically. You may not store or combine results to build your own searchable collection of information about people, whatever you call it.

Why. A search should answer a question you already have about a person you already have reason to look at, and bulk searching inverts that by collecting first and finding a reason later. It also recreates on your side the standing store of personal data we deliberately do not keep.

Reselling, republishing and model training

You may not resell, redistribute, syndicate or publish Orca Scanner results, or present them as your own data product. You may not use results to train, fine tune, evaluate or otherwise develop a machine learning model.

Why. Every onward copy is one nobody can withdraw, correct or delete, and personal data absorbed into a model's weights cannot be located afterwards, which makes erasure impossible in practice. Sharing a report inside your organisation, with your professional advisers, or with a court, regulator or law enforcement body as part of the matter you obtained it for is not caught by this paragraph.

Unmasking anonymous speakers in order to retaliate

You may not use Orca Scanner to identify the person behind an anonymous or pseudonymous account in order to punish, expose, silence, threaten or take reprisals against them. This covers whistleblowers, critics, reviewers, complainants and people posting about an employer.

Why. Anonymity is often the only thing that makes certain speech possible, and once broken it cannot be restored. Identifying an anonymous account can be legitimate, for example to attribute a fraud or to comply with a court order: what separates those cases from this one is purpose.

Circumventing our limits and controls

You may not work around the rate limit, hold more than one account to obtain more capacity, share credentials or API keys, use an account that is not yours, or drive the browser interface automatically so that it behaves as an unmetered API. You may not attempt to route around a suppression or removal we have applied at a person's request.

Why. The limit is 120 requests per hour per account, shared between the API and the browser, and holding more keys does not raise it. It is not a pricing lever but a structural control that stops the product being used at a scale where nobody could be checking whether each search was justified, and a suppression is worth nothing if a second account defeats it.

Probing or attacking our systems

You may not scan, probe or test Orca Scanner for security vulnerabilities, attempt SQL injection, cross-site scripting or any other exploit against our website or API, or otherwise try to gain unauthorised access to our systems or to another user's account. This applies whether or not the attempt succeeds.

Why. A product that holds personal data and payment details has to treat an unsolicited attempt to break it as an attack, not as a favour. Our systems detect this kind of attempt automatically and record it against the account. A deliberate or repeated attempt results in the account being terminated and access to Orca Scanner permanently refused, without the warning or restriction steps described below, and no fee or credit already paid is refunded. If you believe you have found a genuine security weakness, report it to [email protected] before doing anything else. A good faith report made that way, with no further probing once you have found the issue, will not be treated as a breach of this policy.

Credential stuffing and account takeover

You may not use anything returned by Orca Scanner to attempt access to an account that is not yours. Where a result indicates that an identifier has appeared in a data breach, you may not use any associated credential to sign in anywhere, to test whether it still works, or to attempt recovery.

Why. Breach exposure information exists so that people, and those protecting them, can respond to a compromise that has already happened. Using it to complete the compromise is an offence under the Computer Misuse Act 1990 and a serious crime in most other jurisdictions, and there is no research exemption here for testing recovered credentials against live systems.

Anything unlawful where you or the person you search are located

You may not use Orca Scanner for any purpose that is unlawful in the country you are in, in the country the person you are searching is in, or under any other law that applies to you. You may not use it in breach of sanctions, export controls or trade restrictions.

Why. Our being established in England does not place you outside your own law, and a search that is routine in one jurisdiction can be an offence in another.

What we monitor, and what we do not

We would rather tell you what we can see than leave you to guess.

What we hold. Every sign-in, administrative action and security event is written to an audit record with the account, the event, a short detail and the client IP address. We keep a metering record for billing: how many credits were spent or returned, and when. We hold your account details and your active sessions, which you can see and revoke yourself.

What we do not do. We do not read the content of your reports as a matter of course. No team reviews what your searches return, and there is no index of it.

What that means in practice. Our monitoring is mostly about patterns: volume, timing, repeated failures, and signs that one account is being used by several people or driven automatically. When we receive a report of abuse, or a pattern suggests one, we will investigate, and we will look at what that investigation needs and no further. What we collect and why is described in the Privacy Policy.

Draw the right conclusion from this. The absence of routine content monitoring is not a promise that misuse goes unnoticed, and it is not an invitation to find out.

Reporting abuse

If you believe Orca Scanner is being used against you, or against someone else, tell us at [email protected].

You do not need to be a customer. The reports that matter most often come from people who have never held an account.

To help us act quickly, include as much of the following as you can:

• What you believe happened, and when.
• The identifier involved: the username, email address or phone number you believe was searched.
• Anything indicating that Orca Scanner was the source, such as a screenshot or a message you received.
• Whether anyone is at immediate risk. If so, say that in the first line.
• How we can reach you. You may report anonymously, but we may then be unable to ask the questions that would let us act.

If you are in immediate danger, contact your local emergency services first. We cannot intervene in a situation as it unfolds.

To have your own information suppressed or removed, or to use any other data protection right, write to [email protected]. Those rights are described in the Privacy Policy.

We will not tell an account holder who reported them.

How we enforce this policy

Enforcement is graduated. Where a problem can be fixed by explaining it, that is what we will do. Where there is a risk of harm to a person, we act first and explain afterwards.

We may take these steps in any order, and where a breach is serious enough the first step may be the last one.

Suspension without notice. Where a report or a pattern of use suggests someone may be at risk, we will suspend the account immediately. We would rather interrupt legitimate work and be shown to be wrong than leave a person exposed while we deliberate.

Fees and credits. Suspension or termination for breach does not entitle you to a refund of fees already paid or credits already bought, and credits cannot be spent while an account is suspended, cancelled or lapsed. Refunds are dealt with in the Terms of Service.

Law enforcement. We may report a matter to the police or another competent authority and respond to lawful requests from them, in particular where we believe a person is at risk of harm.

Appeals

If we warn, restrict, suspend or terminate your account and you believe we have got it wrong, write to [email protected] within 30 days of the decision. Tell us what you were doing, why you believe it was permitted, and include anything that supports it.

We will read your appeal and we will answer it. Wherever possible, someone other than the person who made the original decision will review it. We may uphold the decision, reverse it, or replace it with a lesser step. Where the decision involved a credible risk of harm, the account stays suspended while we review.

Appealing does not prevent us from reporting a matter to a competent authority. Our answer is final as far as our internal process goes, which does not affect your right to take a matter to a court or a regulator, and nothing here affects your statutory rights.

Changes to this policy

We will update this policy from time to time, because the law changes and so do the ways people try to misuse a tool like this one. The current version is always at this address, and if you keep using Orca Scanner after a change you accept the updated policy.

What we will not build

A policy that only constrains customers is half a policy. These are commitments about the product itself.

We will not build bulk export of personal data about people who are not our customers. No endpoint returning many people at once, no downloadable file of results, no interface for working through a list of identifiers. The single search, metered one at a time, is a deliberate design decision and not a limitation waiting to be lifted once demand justifies it.

We will not build a searchable index of the people who have been searched. Choosing not to accumulate that record is the strongest privacy protection a product of this kind can offer, and we would rather keep it than sell it.

We will not build a feature whose only purpose is to defeat someone's privacy choices. Where a person has taken a step to make themselves harder to find, engineering around that step is not something we will ship, whatever it might be worth.

If we ever change one of these commitments, this section is where the change will appear.

How to contact us

Orca Scanner is operated by OSINTCTI LTD, a private limited company registered in England and Wales under company number 17007699, with its registered office at 167-169 5th Floor, Great Portland Street, London, United Kingdom, W1W 5PF.

Write to [email protected] for all of the following. You do not need an account, and there is no charge.

• Reporting abuse or misuse of the service.
• Asking us to suppress or remove your own information.
• Exercising a data protection right.
• Appealing a decision we have made about your account.
• Any question about this policy, and formal legal notices.

Tell us in the subject line which of these it is, so it reaches the right person quickly.

This policy is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute arising out of it. Read it alongside our Terms of Service and our Privacy Policy.