Privacy Policy

Who we are

Orca Scanner is operated by OSINTCTI LTD, a private limited company registered in England and Wales under company number 17007699, with its registered office at 167-169 5th Floor, Great Portland Street, London, United Kingdom, W1W 5PF. This policy covers the marketing site at orcascanner.com and the application at app.orcascanner.com.

In this policy "we" means OSINTCTI LTD, and "you" means whoever is reading: a visitor, a customer, or a person who has been searched through the service.

We are the controller of the personal data described here: we decide why and how it is processed, and we are answerable for it under the UK GDPR and the Data Protection Act 2018. If you are in the European Union or the European Economic Area, the EU GDPR may also apply, and the rights below are substantially the same under both regimes.

Write to [email protected] about anything in this policy. The same address is for everyone: if you have been searched through the service and do not have an account with us, write to it directly. No sign-in, no account and no charge.

Who this policy is for

This policy serves three groups of people whose positions are not the same. We keep them separate throughout.

The third group is the one that policies in this industry usually leave out. We have given it its own part, its own legal basis, its own explanation of the balancing we carried out, and its own contact address that works without an account.

What Orca Scanner does

A customer submits one identifier, a username, an email address or a phone number, and spends one credit. We query several upstream sources at that moment and return one normalised report. If the search cannot be carried out because every source fails, the credit is refunded; a search that runs and finds nothing is still charged. Credits are a metering unit rather than money, and are dealt with in our Terms of Service.

The part that matters for privacy, stated plainly: we do not build an index of the people who are searched. Results are fetched at query time and returned, not accumulated into profiles.

We only query sources that are lawfully accessible to us: endpoints that platforms themselves expose to the public, public registers and records, and data that specialist providers licence to us under contract. We do not go behind a login, we do not defeat rate limits or blocks, we do not use stolen or borrowed credentials, and we do not deceive a person or a system in order to obtain information. If a technique requires any of that, we do not use it. These are commitments in our Terms of Service, not statements of intent.

We are not a data broker. We do not collect, compile, sell or rent personal data about the people who are searched, and we hold no store of it to sell. The personal data we do hold is the operational minimum needed to run accounts and bill them, and it is listed item by item in the parts below.

If we add a search that returns a category of information we do not offer today, it will work the same way: the information will come from a provider that supplies it to us under contract, and we will not build a store of our own from it. This policy is kept current with what the service actually does.

Part A: visitors to our website

You can read every page of orcascanner.com, including the blog, without an account and without identifying yourself. We set no tracking, advertising or third party analytics cookies on the marketing site, which is why you are not asked to click through a consent banner.

Our web server keeps ordinary request records so pages can be served and attacks spotted: the IP address, the time, the page requested, the browser user agent string and any referring page. The basis is our legitimate interest in running and defending the site. We do not use them to profile you, and we keep them no longer than we need for security.

If you write to one of our addresses, we process your message and email address to answer you, on the basis of our legitimate interest in responding to correspondence.

Part B: account holders

An account belongs to one named individual and is not transferable, and sharing credentials or API keys is prohibited by the Terms of Service. New accounts start with zero credits: you can sign in and look around, but you cannot run a search until credits are allocated. This is what we hold, why, and on what lawful basis.

Most of this comes from you or from your use of the service, and payment confirmations come from our payment processor. We do not sell personal data, share it for advertising, or profile our customers for marketing.

You can delete your own account from the application. Deletion removes the account and its sessions, search records, credit ledger, queued tasks and API keys. Security audit records are kept, with the link to your account removed, because they are needed for security and fraud investigation and would be worthless if an attacker could erase them by deleting an account. Your subscription and any remaining credits are dealt with in the Terms of Service.

Part C: people who are searched through Orca Scanner

This part is for you if someone has looked you up through Orca Scanner. You are not our customer. You did not agree to anything. You are entitled to a straight account of what happened, and this is it.

What actually happens

A customer types one identifier connected to you: a username, an email address or a phone number. We send it to several upstream sources at that moment, normalise what they return into one report, and show it to the customer.

We do not keep an index of you. No profile of you is stored waiting to be looked up again, and no database of searched people is built. What we keep is a search record: which account ran the search, the type, the time, the outcome, the credits spent, the customer's IP address, and a keyed one way hash of the identifier. Where the identifier or the report has been retained at all, a scheduled job strips both out well before the record itself is removed.

There is one exception and we would rather state it plainly than bury it. A customer can set up a scheduled scan: they give one identifier and an interval, and we re-run that search on that schedule so they are told when an account turns up that was not there before. That cannot work without keeping the identifier, because otherwise there would be nothing to search next time. So for a scheduled scan we keep the identifier in readable form, together with the list of accounts found for it, for as long as the customer keeps the schedule running.

This is still not an index of people. Nothing is written unless a customer deliberately sets a schedule up, the entry belongs to that one customer and is not pooled, searchable or shared, and it is deleted in full the moment they delete the schedule or close their account. It is also the only part of the service that keeps a searched identifier at all; every ordinary search still throws it away. If you want to know whether an identifier connected to you is on such a schedule, or you want it stopped, see the section on what you can ask us to do.

We will not pretend a hash is anonymity. A hash of an email address or a phone number is still personal data and we treat it as such. We keep that form because it lets us bill correctly, spot one account hammering the same identifier, and answer requests like yours, without a readable list of the people who have been searched.

What comes back

What a search returns varies by identifier and by source. It can include whether an account exists at a given platform, information the platform itself publishes openly, an indication that the identifier has appeared in a known data breach, and technical validity or line type signals for a phone number.

We do not verify what a source tells us. A report is a set of signals from third parties, gathered at one moment. It is not a finding of fact about you, and parts of it may be wrong, stale or about somebody else entirely. If what we return about you is inaccurate, tell us and we will act, though correcting it at our end does not correct it at the source.

We do not ask sources for special category data, such as data about health, beliefs or sexual orientation, and the service is not designed to compile it. Anything of that kind appearing in a response is subject to the same retention rules as any other result.

Our lawful basis, and the balancing behind it

We rely on legitimate interests under Article 6(1)(f) of the UK GDPR. The law requires us to weigh those interests against your interests, rights and freedoms. Here is that assessment in plain terms.

The interests being served. Customers use identifier searches to check who they are dealing with before money or access changes hands, to investigate fraud and impersonation, to trace people who have caused harm, to support safeguarding and due diligence, and to test their own exposure. Third parties who would otherwise be defrauded benefit too, and we have a commercial interest in operating the service.

The risk to you. You are looked up without being told. The result may be wrong or out of date. A correct result may be used for a purpose you would object to. These risks are real and we do not dismiss them.

The safeguards that reduce that risk.

• We do not build or keep an index of searched people, so there is no store of profiles to leak, sell or repurpose.
• The identifier is kept as a keyed hash rather than a readable list.
• The identifier is stripped from the metering record long before the record itself is removed, and both are handled by an automated job.
• Every account belongs to one named individual, so every search is attributable to a real person who agreed to our terms.
• A per account rate limit of 120 requests per hour caps the volume any one customer can run.
• Customers are bound by our Acceptable Use Policy, and we suspend or delete accounts that misuse the service.
• We suppress an identifier from future results on request, and we answer your requests whether or not you are a customer, at no charge.

Where that leaves us. The identifiers we handle are limited to usernames, email addresses and phone numbers, they are supplied by the customer rather than harvested by us, and we do not retain the results as a profile. On that basis we consider the processing proportionate. That is our view of the general case, not a ruling about yours. If your particular situation makes it disproportionate, the next section is for you.

Who is responsible for what

We are a controller for the processing we carry out: choosing which categories of source to query, sending the identifier, normalising the response and keeping the search record. The customer decides which identifier to search and what to do with the report, and is a controller for that, with their own duties under data protection law that our terms require them to meet.

Your right to object

Because the processing described in Part C runs on legitimate interests, you have a specific right under Article 21 of the UK GDPR: you can object to it at any time, on grounds relating to your particular situation. We set this out separately from the general rights list below because it is the right that matters most here, and it should not be buried.

If you object, we must stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing is needed to establish, exercise or defend legal claims.

In practice, when we receive an objection we will:

• add your identifier to a suppression list so that future searches through Orca Scanner do not return results for it;
• remove or anonymise what we hold that relates to that identifier, apart from security audit records;
• tell you the categories of source we queried, so you can take the matter to them;
• write back either way, and if we cannot honour the objection, tell you why and that you can complain to the Information Commissioner's Office.

You do not need an account, you do not need to give a reason beyond your particular situation, and there is no fee.

One honest trade off: to enforce a suppression we have to keep your identifier in hashed form, because that is the only way to recognise it if it is searched again. That record is the minimum needed to honour your own request, and we keep it while the suppression is in force. If you would rather we did not, tell us and we will explain what that means first.

How to make a request without an account

Write to [email protected]. No login, no account and no charge. Include the identifier you are asking about, what you want us to do, and any context that helps. We will:

• search our records for that identifier and tell you whether we hold anything connected to it;
• carry out your request where the law requires it, including suppression on objection;
• identify the categories of source we queried for that type of identifier;
• reply within one month, or tell you inside that month if a complex request needs up to two further months.

We may need to be satisfied that the request is really yours, because acting on a false request would itself harm you. We ask for the least information that makes us confident: for an email address, sending the request from that address is usually enough, and for a phone number or username we may ask for something that shows you control it. We will not ask for more identification than we need.

What we cannot do. We do not control the upstream sources. We cannot delete data held by a platform, a breach exposure dataset or a data provider, and suppressing an identifier at our end changes nothing at theirs. Any policy that tells you otherwise is overselling. What we can do is stop our own service returning results for you, and tell you which categories of source we queried so you can exercise your rights against the organisations that hold the data.

Who receives personal data

We describe recipients by category. Article 13(1)(e) of the UK GDPR requires recipients "or categories of recipient", and naming every source we query would hand our supplier list to competitors and tell anyone determined to evade detection where to go. A named list of our sub-processors is available on request from [email protected]. If you have been searched, you can ask the same address which categories of source were queried for your identifier.

The categories are:

• Payment processing. Payment is taken by card through a specialist payment provider, which receives your card details directly and processes them under its own privacy notice. We never see or store your card number. If you want to know which provider handled a payment, ask us and we will tell you; the name also appears on your card statement and on the receipt the provider sends you.
• Cloud hosting and infrastructure, which host the application and store its data.
• Identity and fraud signal providers, breach exposure data providers, and public profile endpoints operated by the platforms themselves. All queried at the moment of a search.
• Professional advisers, where they need the data to advise us.
• Law enforcement, regulators and courts, where the law requires or permits disclosure.
• A buyer or successor, if the business is merged, acquired or sold, with the same protections continuing.

One consequence, stated plainly: when a customer runs a search, we send the identifier to the sources we query. That transmission is itself a disclosure of your data to those organisations, which then process it under their own policies and legal bases. We do not sell personal data, share it for advertising, or permit recipients to use it for their own marketing.

International transfers

Where a recipient, a hosting provider or a source we query sits outside the United Kingdom, the transfer only happens if one of these applies:

• the country is covered by UK adequacy regulations;
• the transfer is made under the UK International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses, with additional measures where the circumstances call for them;
• an exception in the UK GDPR applies, such as a transfer necessary for a contract with you or for legal claims.

For customers in the EU or the EEA we rely on the equivalent mechanisms under the EU GDPR. To find out which mechanism applies to a category of recipient, ask [email protected].

How long we keep data

We keep personal data only for as long as it serves the purpose it was collected for, and no longer. Below are the criteria we apply rather than a fixed number of days for each category, because a published number goes out of date the moment anything changes and we would rather not tell you something that has stopped being true. If you want to know how long a particular category is currently held, ask us at [email protected] and we will tell you.

An automated maintenance job carries this out, rather than relying on someone remembering to.

Where the law requires us to keep something for longer, we keep only that, and only for as long as the requirement lasts.

Security

We describe our security in general terms. We do not claim certifications we do not hold, and we do not publish an inventory that would help anyone attacking us.

• Passwords are stored as a hash, never in readable form. We cannot tell you your password because we do not know it.
• Session tokens are stored only as a hash. The session cookie is HttpOnly, restricted with SameSite=Lax, and regenerated periodically. You can view and revoke your own active sessions.
• API keys are shown once when created and stored only as a hash, and revocation is immediate. A key carries your account's full search authority, has no scopes and no expiry, and spends the same credit balance as the browser, so treat it as you would your password.
• A rate limit of 120 requests per hour applies per account, shared between the API and the browser, and holding more keys does not raise it. Registration is throttled per network to blunt automated sign-up.
• Sign-ins, administrative actions and security events are written to an audit record with the account, the event, a short detail and the client IP address.
• We restrict administrative access to the people who need it to do their work, and we require an encrypted connection for the website and the application.
• If a notifiable personal data breach occurs, we will report it to the ICO within 72 hours of becoming aware of it, and tell affected people where the risk to them is high.

No service can promise perfect security and we will not pretend otherwise. Choose a strong and unique password, revoke keys and sessions you no longer use, and tell [email protected] if you think an account has been compromised.

Automated decision making

We make no decisions about you by automated means that produce legal effects or similarly significantly affect you, within the meaning of Article 22 of the UK GDPR.

A search result is not a decision: it is information returned by third party sources and passed on. We do not score, rank, rate or classify you.

If a customer uses a report to make a decision about you, that decision is theirs and they are responsible for it. We can tell you the categories of source we queried. We cannot tell you what a customer concluded, so ask them.

Children

Orca Scanner is not intended for people under 18. Accounts are for adults using the service in a professional or business capacity, and we do not knowingly hold accounts for anyone under 18. If we learn that an account belongs to someone under 18, we will close it and delete the data as described here. If you believe we hold data connected to a child, write to [email protected] and we will treat it as a priority.

Cookies

The marketing site at orcascanner.com sets no tracking, advertising or third party analytics cookies. The application sets one cookie, and it is strictly necessary.

Under regulation 6(4) of the Privacy and Electronic Communications Regulations 2003, a cookie strictly necessary to provide a service you asked for does not require consent. That is the only kind we use. We do not use cookies or similar technologies to track you across other websites.

Your rights

Under the UK GDPR you have the following rights, whether or not you are a customer:

• Access. To be told whether we process data about you and to receive a copy.
• Rectification. To have inaccurate data corrected and incomplete data completed.
• Erasure. To have data deleted where one of the grounds in the law applies.
• Restriction. To have processing paused while a dispute about accuracy or legitimate interests is resolved.
• Portability. To receive data you gave us in a structured, commonly used, machine readable format, where the processing is automated and based on contract or consent.
• Objection. Set out in its own section above, because it is the right that matters most to search subjects.
• Withdrawal of consent. Where we rely on consent you can withdraw it at any time. We do not rely on consent to run the core service, so this will rarely apply.
• Complaint. To complain to the Information Commissioner's Office, as described below.

To use any of these rights, write to [email protected]. You do not need an account. We answer within one month, free of charge, and may extend by up to two further months for genuinely complex requests. We may ask for information to satisfy ourselves that the request is yours.

These rights are not unlimited. Erasure gives way where we must keep something for accounting, legal or security reasons, such as billing and security audit records. Where we cannot do what you asked, we tell you which exception applies and why.

Complaints and the ICO

If you are unhappy with how we have handled your data, tell us first at [email protected]. We would rather fix a problem than defend one.

You can also complain to the Information Commissioner's Office, the United Kingdom's independent supervisory authority for data protection. The ICO investigates complaints, can require an organisation to change what it does, and can take enforcement action including fines. Reach it at ico.org.uk, or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You do not have to come to us first, and complaining does not affect your right to a remedy through the courts.

If you are in the EU or the EEA, you may instead complain to the supervisory authority in your country of residence or work.

Changes to this policy

We publish the current version at orcascanner.com/privacy with the date it took effect, and changes take effect when they are published.

Where a change materially affects account holders, we will make it visible in the application. We do not operate outbound notification email, so please do not rely on receiving a message about it. If you want to know what this policy said on a particular date, ask [email protected].

Contact and related documents

OSINTCTI LTD, company number 17007699, 167-169 5th Floor, Great Portland Street, London, United Kingdom, W1W 5PF.

One address covers everything: [email protected]. Use it for data protection questions and customer requests, for requests from people who have been searched (no account needed), to report misuse of the service, and for formal legal correspondence. Say in the subject line which it is.

This policy sits alongside our Terms of Service and our Acceptable Use Policy. It is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over disputes arising from it.