Privacy Notice

Stalk Yourself LLC is the data controller for personal data processed through the Service. Contact: privacy@stalkyourself.app.

• Provide the Service (run scans, store your reports, authenticate) — performance of a contract.
• Security, fraud prevention, abuse detection — legitimate interests.
• Product improvement and aggregate analytics (no profiling for advertising) — legitimate interests.
• Customer support — performance of a contract / legitimate interests.
• Legal and tax compliance — legal obligation.
• Marketing emails (if you opt in) — consent, withdrawable at any time.

For California residents (CCPA/CPRA), we do not "sell" or "share" personal information for cross-context behavioral advertising.

Most data comes directly from you. Scan findings are retrieved by us from publicly available third-party sources (data-broker indexes, breach databases such as Have I Been Pwned-style services, public social profiles, search engines, web archives) using the identifiers you provide.

• Stripe Payments Europe, Ltd. and Stripe, Inc. ("Stripe") — our payment processor. Stripe processes all payments, subscriptions, taxes, and invoicing on our behalf and is an independent data controller for payment data. See Stripe's Privacy Policy.
• Hosting and infrastructure: Supabase (database, auth, storage) and Cloudflare (edge compute, CDN), acting as processors.
• AI inference: the Lovable AI Gateway routes prompts to model providers (e.g. Google Gemini) to generate dossier summaries. Prompts contain only the scan inputs you provided.
• Public-source providers we query on your behalf (data-broker indexes, breach lookups, search APIs).
• Professional advisers (legal, accounting) where needed.
• Authorities where required by law, court order, or to protect rights and safety.

We do not sell your personal data and we do not share it with advertisers.

Data may be processed outside your country, including in the United States and the European Economic Area. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

Subject to applicable law (GDPR, UK GDPR, CCPA/CPRA, and similar), you have the right to: access your data, rectify inaccuracies, request erasure, restrict or object to processing, request portability, and withdraw consent at any time. California residents have the additional rights to know, delete, correct, and limit use of sensitive personal information, and to be free from retaliation for exercising these rights. To exercise any right, email privacy@stalkyourself.app. We respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority (e.g. the UK ICO, your EU member-state DPA, or a state attorney general).

We implement appropriate technical and organizational measures including TLS in transit, encryption at rest for stored databases and storage buckets, role-based access control, row-level security on every user-facing table, signed-URL access for photos, and audit logging. No system is perfectly secure; please use a strong, unique password.

We use only strictly necessary cookies (authentication session, CSRF). We do not use advertising cookies or cross-site trackers. If we ever add analytics, we will request consent first where required.

The Service is not directed to children under 16 and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.

We may update this Notice from time to time. Material changes will be notified by email or in-app at least 14 days before they take effect.

Privacy questions: privacy@stalkyourself.app. Postal: available on request. You may also contact your local data protection authority.