NullScrub Privacy Policy

Effective Date: November 10, 2026
Last Updated: November 12, 2026

This Privacy Policy describes how NullScrub LLC (“NullScrub,” “we,” “us,” or “our”) collects, uses, and shares information when you use the NullScrub website and services (the “Services”).

We do not sell or share your personal information.

1. Information we collect

Information you provide

• Account information: email address and authentication data when you create an account or sign in.
• Profile information: name, addresses, date of birth, phone numbers, and other details you enter so we can submit removal requests. This information is encrypted at rest.
• Communications: messages you send to support.

Information collected automatically

• Scan data: the email address you enter on the public scan form (used to check known public breaches and for rate limiting).
• Usage data: pages visited, device and browser type, IP address, and approximate location derived from IP.
• Cookies and similar technologies: session cookies for authentication and security (including Cloudflare Turnstile on the scan form).

Information from third parties

• Known public breaches: when you enter an email on the scan or when we display breach information for your signed-in email, we query XposedOrNot’s public breach records. Only the email is sent; we do not control what XposedOrNot returns.
• Payment information: collected and processed by Stripe. We do not store full card numbers.

2. How we use information

We use the information to:

• Provide the Services (scan, dashboard, exposure score, removal request submission and tracking).
• Authenticate you and secure the Services.
• Process payments and manage subscriptions.
• Communicate with you about your account and requests.
• Detect and prevent abuse (including rate limiting on the public scan).
• Comply with law and enforce our Terms.

3. How we share information

We share information with the following categories of service providers (sub-processors), only to provide the Services. We do not sell or share your personal information, including for cross-context behavioral advertising, and we do not use advertising or analytics trackers.

To carry out removal requests you authorize, we also share the profile information needed by the relevant data brokers and people-search sites to identify your records and process your request.

We may also share information if required by law, to protect rights and safety, or in connection with a business transfer.

4. Data retention

• Profile and request data: retained while your subscription is active and deleted 30 days after it ends (after your last paid period), including your removal request history and the screenshots of forms we submitted for you. Your sign-in account and subscription record are kept so you can return or resolve billing questions.
• Emails we send: our email provider (Resend) keeps copies of sent emails, including removal notices, for 30 days, plus up to 7 days in its backups, and then deletes them.
• Replies from data brokers: the text of a broker's reply is deleted 90 days after we receive it; we keep the date and outcome with your request history.
• Scan rate-limit records: hashed email and IP keys are retained for approximately one day.
• Payment records: retained by Stripe according to its policies and as required for accounting and tax.

5. Security

We use encryption in transit (HTTPS) and encrypt profile personal information at rest using envelope encryption with Google Cloud KMS. No method of transmission or storage is 100% secure.

6. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, or to object to or restrict certain processing. To exercise these rights, use the privacy rights request page (linked below and in the site footer) or email privacy@nullscrub.com. We may ask you to confirm the request from the email address on your account. We will respond within the time required by applicable law.

California residents may have additional rights under the CCPA/CPRA. We do not sell or share personal information as those terms are defined by the CCPA.

Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of the sale and sharing of your personal information and show “Opt-Out Request Honored” on the site. Because we do not sell or share personal information, honoring the signal does not change how the Services work for you.

7. Children’s privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13.

8. International transfers

The Services are operated from the United States. If you access them from outside the United States, your information will be transferred to and processed in the United States.

9. Changes to this policy

We may update this Privacy Policy. We will post the updated version and change the effective date. Continued use of the Services after the update constitutes acceptance.

10. Contact

NullScrub LLC
support@nullscrub.com
https://nullscrub.com