Terms of Service

These terms govern your use of Orca Scanner and take effect on 2 August 2026. Please read them before you register, because by registering you agree to them.

Who we are

"Orca Scanner" is a product and trading name. The company you contract with is OSINTCTI LTD. A United Kingdom company has to tell you who it is, so here are the details.

In this document, "we", "us" and "our" mean OSINTCTI LTD. "You" and "your" mean the person who registers for or uses an account. "The service" means the application at app.orcascanner.com, the REST API, the reports it produces and the site at orcascanner.com.

These terms and the two documents that go with them

This is a contract between you and us. You accept it when you register, and again each time you sign in or call the API. Three documents make up the agreement:

• These Terms of Service, which set out the commercial and legal relationship between us.
• The Acceptable Use Policy, which sets out what you may search for and what you may do with the results. It forms part of this agreement and is incorporated into it by reference.
• The Privacy Policy, which explains what we do with personal data.

If the documents conflict, these terms prevail, with one important exception. Where the Acceptable Use Policy is stricter than these terms about what you may do, or about what you may search for, the Acceptable Use Policy prevails. A general permission here never overrides a specific prohibition there, because a precedence clause written the usual way would quietly cancel the conduct rules.

Who may open an account

You may open an account if all of these are true:

• You are at least 18 and can enter into a contract where you live.
• You register in your own name and give an email address you control.
• No sanction or other legal restriction makes it unlawful for us to supply you.
• We have not previously closed an account of yours for breach of these terms or of the Acceptable Use Policy.

An account belongs to one named individual. It is not a team account, a role account or a shared licence, and it is not transferable. If several people in an organisation need the service, each needs their own account, even where one organisation pays for all of them.

If you register while working for an organisation, you confirm that you are authorised to accept these terms. The account still belongs to you.

New accounts start with zero credits. You can sign in and look around straight away, but you cannot run a search until credits are allocated.

Your account and your duty to keep it secure

You are responsible for everything done through your account. Anything done with your password, your session or your API keys is treated as done by you, unless you can show we were at fault. Choose a strong password you use nowhere else, keep it and your keys secret, and tell us at [email protected] if you think someone else has access.

Sharing your credentials or your API keys with anyone else is prohibited, and doing it is a material breach of this agreement. That includes giving a colleague your password, passing a key to a contractor, and building an internal tool that lets other people search through your single account.

We do not currently offer two factor authentication, so your password is the only thing standing between another person and your account. Session cookies are set as HttpOnly and SameSite=Lax, and sessions are regenerated periodically. You can see your own active sessions in the application and revoke any of them.

Every sign in, administrative action and security event is written to an audit record holding the account, the event, a short detail and the client IP address. We need those records for security and fraud investigation.

Re-issuing an account

Accounts cannot be sold or handed over. If the named individual leaves the organisation that pays for the account, that organisation may write to [email protected] and ask us to re-issue it to a replacement named individual. We may agree, we may ask for evidence, and we may refuse.

Your licence to use the service

While your account is active and you comply with this agreement, we grant you a limited, personal, non-exclusive, non-transferable, non-sublicensable and revocable licence to use the service and its reports for your own work. You are not buying software.

You must not:

• Resell, rent, white label or make the service available to other people as a bureau or inside your own product, unless we agree in writing.
• Open more than one account for yourself, or open accounts for other people to use.
• Work around the rate limit, the credit metering, the expiry date or any other control.
• Copy, scrape or harvest the application itself, or point automated tools at it other than through the documented API.
• Reverse engineer, decompile or disassemble any part of the service, except where the law says you may despite this restriction.
• Test, probe or attack the security of the service without our written consent.
• Remove or obscure any notice of ownership in the service or in a report.

These restrictions sit on top of the Acceptable Use Policy.

What the service does

Orca Scanner runs three kinds of search. Each one costs one credit.

When you run a search, the application queries several upstream sources at the same time and returns one normalised report.

We do not build a database of the people you search for. Results are fetched from upstream sources at the time you run the query and returned to you. They are not indexed and no searchable record of searched people is built.

We do not control those sources. Their coverage changes, they go down, and they sometimes return nothing. That is normal for this kind of service, not a defect.

Where the information comes from, and how we get it

Orca Scanner only queries sources that are lawfully accessible to us. In practice that means three things: endpoints that the platforms themselves expose to the public, public registers and records, and data that specialist providers licence to us under contract.

Just as important is what we do not do, and we hold ourselves to this as a term of the agreement:

• We do not bypass a login. If a page requires an account to see it, we do not go behind that account.
• We do not defeat technical controls. No breaking rate limits, no evading blocks, no pretending to be a browser we are not in order to get past a restriction.
• We do not use stolen or borrowed credentials, and we do not impersonate anyone to obtain access.
• We do not scrape data we have no right to receive, and we do not buy data from a supplier who cannot show us where it came from.
• We do not deceive a person or a system in order to obtain information. The moment a technique requires that, it stops being open source research and we do not use it.

We are not a data broker

We do not collect, compile or hold the information the sources return. There is no corpus, no profile store, and no index of the people who are searched. A query goes out, an answer comes back, and it is shown to you. If you run the identical search a month later, we go and ask again.

The personal data we do hold is the minimum needed to run your account and bill you correctly. The Privacy Policy lists it, item by item, and explains how long each item stays.

If we add new kinds of search

The service may grow. If we add a search that returns a category of information we do not offer today, it will work on the same footing: the information will come from a provider that supplies it to us under a contract, we will pass on the query and pass back the answer, and we will not build a store of our own from it.

What a report is, and what it is not

A report is a set of investigative leads. It is not a conclusion and it is not proof. You must verify anything in it independently before you rely on it.

Identifiers are shared, recycled, reassigned and spoofed. Two people can hold the same username. An email address turns up in a record that belongs to someone else entirely. A match is a hypothesis to test, and nothing more. So:

• Nothing in a report is a statement by us that a particular person did a particular thing or holds a particular account.
• An empty result is not evidence that something does not exist. It usually means the sources we queried had nothing to say.
• You must not treat a report as the only basis for a decision that affects a person.
• We are not a credit reference agency, and a report is not a credit reference, a background check or an employment screening product. The Acceptable Use Policy sets out the decisions you must not use the service for.
• We do not give legal advice, investigative advice or advice on what to do with a result.

Credits

Credits are the metering unit of the service. One search costs one credit.

Credits are not money. They are not stored value, not a payment instrument, not electronic money and not redeemable for cash. They have no value outside the service.

How the balance works:

• Your plan allocates credits automatically each time it renews. We can also add credits to an account by hand, for example on a negotiated plan or to put something right. New accounts start at zero.
• The balance can never go negative. If it is zero, the request is refused and nothing is charged.
• If a search cannot be carried out, because every source fails or no source is available, the credit is refunded automatically. That is a credit going back, not money. A search that runs and finds nothing has still been carried out, so it is charged.
• On a monthly plan, credits do not carry over. Each renewal replaces your balance with that month's allowance, and anything left unspent from the previous month expires at that moment. The same happens when a monthly subscription ends for any reason, whether you cancel it or a payment fails: any credit left over from that final month expires with it, the same way it does at every renewal. The expiry is recorded in your credit history, so you can always see what was reset and when.
• On a yearly plan, credits do carry over within the paid year. A yearly subscription is paid for a full year in advance and the allowance is released month by month; whatever you do not spend in a given month stays in your balance and remains available for the rest of that yearly term. When the paid year ends, whatever is left in your balance expires: at renewal, when a renewal payment fails, or when the subscription ends. A renewed year starts with its first monthly allowance, which is only released once the renewal payment has been taken.
• Credits can only be spent while your subscription is active. On a yearly plan, if it is cancelled, lapses or is suspended before the year is up, the balance you have already earned stays on the account but cannot be spent until you resubscribe. If you resubscribe on a monthly plan, it is added to your first month's allowance and, like any monthly balance, expires at the first renewal.

Access to search depends on three things at once: the status of your account, the expiry date on your access, and your credit balance.

Dormant balances

If no credits are spent on an account for 12 consecutive months, we may expire the balance. This is an anti-abuse measure: credits that never expire can be bought cheaply, parked and then resold or drained years later, which damages the service and the sources it depends on.

We also reserve the right to suspend or delete accounts that misuse the service.

Subscriptions, payment and automatic renewal

The price, the currency, the billing period and what the plan includes are shown before you pay, with tax as stated at the checkout.

Payment is taken by card through our payment provider, a specialist processor that handles card payments for us. Your card details go to the provider, not to us: OSINTCTI LTD never sees or stores your card number. The provider sends you the purchase confirmation on a durable medium.

Your subscription renews automatically at the end of each billing period, at the price then in force, using the payment method you gave. This continues until you cancel.

We do not send a reminder before a renewal. There is no pre-renewal notice, no warning email and no prompt: renewal is automatic and silent. The account area shows the date your current access period runs to. Note that date and diarise it yourself.

If a payment fails, the renewal does not happen and your access can stop at the end of the period you have paid for.

How to cancel

You cancel the subscription yourself, from the account area. Cancelling stops the next billing period, not the current one. The current period is not refunded and your access continues until it ends. After that, your access stops and any balance left over expires, as described under Credits.

Your cancellation right, and refunds

The service is digital content and a digital service. Supply begins immediately once your payment is taken: the account is enabled at once.

At the point of purchase you expressly request that supply begins straight away, before the statutory cancellation period ends, and you acknowledge that you therefore lose the statutory right to cancel. We confirm this on a durable medium. Under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 this is regulation 28(1)(b) for digital content and regulation 37(1) for services (for consumers in the European Union the equivalent is Article 16(m) of the Consumer Rights Directive).

Because of that, subscription fees are not refunded, except in these cases:

1. No credits were ever allocated to the account, or none of the allocated credits were used, and you ask within 14 days of purchase.
2. Where the service fails to have the qualities we promised, to the extent the law requires. If you are a consumer, your rights under the Consumer Rights Act 2015 apply and nothing here removes them.
3. Where we decide, at our sole discretion, to make a goodwill refund. We decide case by case, and one case sets no rule for the next.

Credits that have been used are never refundable, in any circumstance. A search that ran has been supplied, whether or not it found anything. If a search could not be carried out at all, the credit comes back automatically.

To ask for a refund, email [email protected] from the account address with the date of purchase.

The API

The service has a REST API. It uses bearer key authentication.

• You may hold up to 10 keys at a time.
• A key is shown once, when you create it. We store only a hash, so we cannot show it again or recover it. If you lose it, revoke it and create a new one.
• Keys carry your account's full search authority. They have no scopes and no expiry date: a key can do what you can do.
• Keys spend the same single credit balance as the browser. There is no separate API allowance.
• Revocation takes effect immediately.

Treat a key as you treat a password. Do not commit one to a repository, do not put one in client side code, and do not share one. Sharing a key is a material breach: it turns a single named account into a shared one.

We may add, change or withdraw endpoints as the service develops. Because keys never expire, an integration can run for years unattended, so check yours when we publish a change.

Rate limits and fair use

The service is rate limited to 120 requests per hour per account. That limit is shared between the API and the browser, which draw on the same allowance. Holding more keys does not raise it. Requests above the limit are refused.

Registration is also throttled per network, to stop bulk account creation.

Trying to get around these limits is a material breach. That includes opening more than one account, rotating source addresses, and splitting a workload across accounts held by other people. We may change the limits to protect the service, its sources or other users.

Data protection

This article is short on purpose. It is not deferred to any separate agreement, and the detail is in the Privacy Policy.

We are the controller for the searches you run through the service, and for the account data we hold about you. We decide how a search is carried out, so we take that responsibility rather than pushing it onto you.

You are responsible for the searches you choose to run. You must have a lawful basis for each one, under the UK GDPR or whatever data protection law applies to you, and you must meet your own obligations to the people you search, including any duty to be transparent with them. Once we return a report, what you do with it is your decision and you act as a controller in your own right. We cannot know why you searched, and we do not carry the consequences of a search you had no right to run.

The Privacy Policy sets out the categories of data we handle, the categories of recipients, and how to exercise your rights. We describe recipients by category rather than by name. A named list of our sub-processors is available to customers on request from [email protected].

You can delete your own account from the application. Deletion removes the account and its sessions, search records, credit ledger, queued tasks and API keys, and ends your access. Security audit records are kept, with the link to your account removed, because we need them for security and fraud investigation. If you are the subject of a search, write to [email protected].

Acceptable use

The Acceptable Use Policy is part of this agreement. It sets out what the service may and may not be used for, and the duties you take on when you search for information about a person.

Breaching the Acceptable Use Policy is a material breach of this agreement. If you breach it, we may suspend or terminate your account immediately, and no refund is due for the period you have paid for. If you see someone misusing the service, tell us at [email protected].

What you promise us when you search

The Acceptable Use Policy sets out what we forbid. This section is the other side of it: what you tell us is true. These are contractual warranties. If one of them turns out to be false you are in breach of this agreement, whether or not we could have discovered it at the time.

You give these warranties every time you run a search, not once at sign-up. Each search is a fresh statement that all of them are true at that moment. If any of them is not true, do not run the search.

Your authority to search

• You have a genuine and lawful reason to search the person or identifier you are searching.
• You have a valid legal basis for processing that person's personal data, and you can tell us what it is if we ask.
• The search is lawful in your own country and in the country where you believe the person to be.
• Where the law, your regulator, your employer or a contract requires you to have someone's authority before searching them, you have it.

What you are using it for

• You are searching for one of the permitted purposes set out in the Acceptable Use Policy. Those include preventing and investigating crime and fraud, anti-money laundering and sanctions work, security research, corporate due diligence, legal proceedings, journalism in the public interest, and checking your own exposure.
• You are not searching out of curiosity, over a personal grievance, or on behalf of someone who has one.
• You are not using the service to decide whether a person gets a job, credit, insurance, housing, education, a licence or a benefit.
• You are not searching a person you know or suspect to be under 18, unless you are a competent authority acting to protect that child.
• You are not searching a journalist, a human rights defender, a lawyer, an activist or a trade union organiser because of the work they do.

How you will behave towards the person

• You will not harass, bully, intimidate, threaten, stalk, blackmail or endanger anyone using this service or anything you learn from it, and you will not help anyone else to do so.
• You will not publish or otherwise expose a person's information in order to harm, shame or pressure them.
• You will not use the service in connection with domestic abuse, or in breach of a restraining, protective or non-molestation order.
• You will not contact a person, or have them contacted, in a way that would amount to harassment under the law that applies to them.

How you will treat the results

• You understand that a report is a set of leads and not proof, and you will verify a finding independently before you rely on it.
• You will not take a step that materially affects a person on the basis of a report alone.
• You will hold, use and dispose of what you learn in line with the data protection law that applies to you, including any duty you owe to tell that person you hold information about them.
• You will not resell, redistribute or publish results, build your own database from them, or use them to train machine learning models.

About you

• Everything you told us when you opened the account is true, and you will keep it up to date.
• If you opened the account for an organisation, you have authority to commit that organisation to this agreement.
• You are the only person using your account, and you have not shared your password or an API key with anyone.

What we may ask, and what happens if a promise proves false

We may ask you at any time to tell us the purpose of a search and the legal basis you relied on, and you must answer within a reasonable time. Refusing to answer, or giving an answer you know to be untrue, is itself a breach of this agreement.

If you break one of these promises we may suspend or close your account immediately and without notice, keep any fees already paid, refuse to serve you again, and where the conduct warrants it report the matter to the police or to a regulator. What you owe us in that situation is set out under Your responsibility to us below, and it is not capped.

How responsibility is divided between us

This section exists so that nobody can later say they did not understand where the line falls.

You decide who gets searched, and why

We build and run the tool. You choose the person, you choose the moment and you choose the reason. That decision is yours alone, and it is the decision that determines whether a search is lawful. We are not in the room when you make it.

We do not check your reasons, and we are not required to

• We do not review, approve, screen or vet individual searches. There is no queue where a person at Orca Scanner looks at what you typed and decides whether you should be allowed.
• We cannot know why you searched. The service is not told your purpose, your case reference, your client or your legal basis, and it does not ask.
• We rely entirely on the warranties you gave in the section above. We take them as given. We are under no duty to verify them, to investigate you, or to satisfy ourselves that a particular search is justified.
• If we do check something, that is not a promise to keep checking. Looking into one report, asking you one question, or declining one request does not make us responsible for the next search, and does not waive anything in this agreement.
• We have no duty to monitor. We may look at how the service is being used in order to protect it, but we are not obliged to, and not spotting a misuse does not make us answerable for it.

So the consequences of your search sit with you

If you run a search you had no right to run, or you use a report in a way you had no right to use it, then as between you and us that is your responsibility and not ours. That holds whatever the source of the trouble: a complaint from the person you searched, an investigation or fine from a data protection authority or another regulator, a claim from a platform whose terms you broke, a professional disciplinary matter, or a court order.

You cover us for those consequences under Your responsibility to us below. That cover is not capped by the limit that applies to our own liability, and it survives the end of this agreement.

Two things this section does not do

We would rather tell you the limits of this than have you discover them later.

• It does not make you the controller for what we do. Data protection law decides who is a controller by looking at who decides the purpose and the means, not by looking at a contract. We choose which categories of source to query and how to handle the answer, so we are the controller for that part and we do not try to sign it away. You are the controller for your decision to search and for everything you do afterwards.
• It does not apply if you are a consumer. If you use the service outside a business or profession, your statutory rights stand and nothing here reduces them.

Intellectual property

We own the service: the software, the interfaces, the way we normalise and present results, the documentation, and the Orca Scanner and OSINTCTI names, logos and branding. Nothing here transfers any of that to you.

You may use the reports you generate in your own work: read them, quote them in your notes and work product, and share them where your work requires it. That permission depends on you complying with the Acceptable Use Policy and with the law.

A report may contain names, marks and material in which other people hold rights. We do not claim to own it and we do not grant you rights over it. How you use it is your responsibility. If you send us feedback or ideas, we may use them freely, with no obligation to you and no payment.

Availability and changes to the service

We work to keep the service running, but we do not promise it will be available without interruption or free of faults. It depends on upstream sources we do not control, and it needs maintenance.

We may change the service: add features, change how something works, or withdraw a feature. We do that to improve the product, to keep it secure, or because an upstream source changes. If we withdraw the service entirely, we will publish that decision in the application, and any refund is dealt with under the refund section.

Disclaimers

To the extent the law allows, the service is provided "as is" and "as available".

We do not warrant that results are complete, accurate, current or fit for any particular purpose. Upstream data was created by other people for other reasons, and it can be wrong, stale, incomplete or about someone else. We also do not warrant that the service will meet a requirement you have not told us about, or that it will return a result for any particular identifier.

Nothing here excludes or limits rights you have as a consumer that cannot be excluded or limited by law, including your rights under the Consumer Rights Act 2015.

Limits of our liability

Nothing in this agreement limits our liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, or for anything else that the law does not allow us to limit.

Subject to that, we are not liable for:

• Any decision you take on the basis of a report, or any failure by you to verify a result before acting on it.
• Any consequence of a search you had no lawful basis to run, or of a use that breaches the Acceptable Use Policy.
• Loss of profit, revenue, business, contracts, goodwill or anticipated savings.
• Loss or corruption of data, or the cost of recreating it.
• Indirect or consequential loss of any kind.
• Unavailability, error or change at an upstream source.

Again subject to the first paragraph of this section, our total liability for all claims arising in any 12 month period is limited to what you paid us in the 12 months before the event that gave rise to the claim. If you have paid us nothing, that limit is 100 GBP.

If you are a consumer, we are responsible for foreseeable loss caused by our breaking this contract or failing to use reasonable care and skill, and not for loss that is not foreseeable. If you use the service for a business purpose, the exclusions above apply in full.

Your responsibility to us

If you use the service for business or professional purposes, you agree to indemnify us, and our officers and staff, against any claim, demand, investigation, loss, damage, fine, penalty, award or reasonable legal cost we suffer that arises out of:

• Your breach of these terms, of the Acceptable Use Policy, or of any warranty you gave under What you promise us when you search.
• A search you ran without a lawful basis or without the authority you said you had.
• Your failure to meet your own obligations to a person you searched, including any duty to tell them you hold information about them.
• What you did with a report after we returned it, including any decision you took on the strength of one.
• A complaint, claim or action brought by a person you searched, or by someone acting for them.
• An investigation, enforcement notice or penalty from a data protection authority, a regulator or a professional body, where it follows from a search you ran or from your use of a report.
• A claim by a platform, source or third party that your use of the service breached their terms or their rights.
• Sharing your credentials or an API key, or allowing another person to use your account.

This indemnity is not subject to the cap in the previous section. The cap protects us from you; it does not protect you from the consequences of your own conduct. The indemnity continues to apply after your account closes and after this agreement ends, for as long as a claim can still be brought.

If such a claim is made, we will tell you promptly, we will not settle it without your consent (which you will not withhold unreasonably), and we will give you reasonable help with defending it at your cost. We may, if we prefer, take over the defence ourselves and recover what it costs us from you.

This section does not apply if you are a consumer, that is, if you use the service outside a business or profession. It also does not extend to anything we are not allowed to be indemnified for by law, or to loss caused by our own deliberate wrongdoing.

Suspension and termination

You may end this agreement at any time: cancel the subscription to stop the next billing period, or delete your account to end everything at once.

We may suspend or terminate your account, in whole or in part, if:

• You breach these terms or the Acceptable Use Policy in a material way, including by sharing credentials or keys or by working around limits.
• A payment fails or is reversed.
• We reasonably suspect fraud, misuse, or activity that puts another person at risk.
• We have to, for a legal reason or because an upstream source requires it.

Where the breach is serious or someone is at risk, we may act immediately and without warning. We may also suspend an account while we investigate, and lift the suspension if the investigation clears you.

When your access ends, for any reason: you can no longer sign in or run searches, your API keys stop working, and your credit balance cannot be spent. No refund is due for the current period except under the refund section. The sections on intellectual property, disclaimers, limits of liability, your responsibility to us, data protection and governing law survive.

Changes to these terms

We may change these terms. When we do, we publish the new version at /terms with a new date at the top of the page.

A material change that affects an existing subscription takes effect from the start of your next billing period. If you keep using the service after that, you accept it; if not, cancel before your next renewal. A change we have to make for a legal reason, or to protect the security of the service or the safety of other people, takes effect immediately.

Notices

To give us notice under this agreement, email [email protected] or write to OSINTCTI LTD at the registered office above. Notice is effective when we receive it.

We give you notice by publishing it in the application or on our site. We do not currently send routine notifications by email, which is one reason there is no pre-renewal reminder. Where the law requires us to confirm something on a durable medium, we do that, and the purchase confirmation is sent by our payment provider.

There is one address for everything: [email protected]. Put the subject in the subject line so it reaches the right person.

Assignment and other general terms

You may not assign, transfer or subcontract this agreement, or any right under it, without our written consent. That restriction follows from the rule that an account belongs to one named individual. We may assign or transfer it on a merger, an acquisition, or a sale of the business or the relevant part of it. Your rights are not reduced by that.

These three documents are the whole agreement between us about the service, and they replace anything said or written beforehand. Neither of us relies on any statement that is not in them, though nothing here limits liability for fraud.

If a court finds any part of this agreement unenforceable, the rest continues to apply. If we do not enforce a term straight away, we do not lose the right to enforce it later. Nobody who is not a party may enforce it under the Contracts (Rights of Third Parties) Act 1999. Neither of us is liable for a failure to perform caused by something genuinely outside our reasonable control, for as long as it lasts.

Complaints, governing law and jurisdiction

If something has gone wrong, tell us first at [email protected]. We would rather fix a thing than argue about it.

This agreement, and any dispute or claim arising out of it or its subject matter, including non-contractual ones, is governed by the law of England and Wales.

The courts of England and Wales have exclusive jurisdiction over any dispute or claim arising out of this agreement.

If you are a consumer, this does not take away the protection given to you by rules of the country where you live that cannot be set aside by agreement.