Privacy Policy

1. Who We Are (Data Controller)

iErase (“we”, “our”, “us”) operates the data removal service available at ierase.ai and associated domains. We act as the data controller for the personal data you provide to us, and as a data processor when we handle your data solely to submit removal requests to third-party data brokers on your behalf.

2. Personal Data We Collect

We collect only the minimum data necessary to provide the Service (data minimisation principle):

We do not collect: racial or ethnic origin, political opinions, religious beliefs, genetic or biometric data, health data, sexual orientation, or financial account details.

3. Legal Basis for Processing (GDPR Art. 6)

For users in the European Economic Area (EEA), United Kingdom, and Switzerland:

• Consent (Art. 6(1)(a))You explicitly consent before we scan for or process your personal data. You may withdraw consent at any time.
• Contract (Art. 6(1)(b))Processing is necessary to perform the data removal service you requested.
• Legal Obligation (Art. 6(1)(c))We may retain certain records as required by applicable law.
• Legitimate Interests (Art. 6(1)(f))Security, fraud prevention, and service improvement, where not overridden by your rights.

For special category data (e.g. government ID), the basis is explicit consent per Art. 9(2)(a).

4. How We Use Your Data

• Scan 500+ data broker websites to identify where your information appears
• Draft and submit legally-compliant opt-out and removal requests to data brokers
• Generate AI privacy reports summarising your exposure
• Send transactional emails (scan results, removal status updates, account notices)
• Process subscription payments and manage your account
• Verify compliance with data broker removal confirmations
• Improve service accuracy and coverage (using anonymised aggregate data only)

We never use your data for advertising, profiling, or sale to any third party.

5. Data Sharing & Sub-processors

We share your data only as strictly necessary. We do not sell, rent, or share your data for marketing. All sub-processors are bound by data processing agreements (DPAs).

SCCs = EU Standard Contractual Clauses, providing GDPR-compliant cross-border transfer safeguards.

6. International Data Transfers

If you are located in the EEA, UK, Switzerland, or other regions with data transfer restrictions, your data may be transferred to countries that may not have equivalent data protection laws. We rely on EU Standard Contractual Clauses (SCCs) and other approved transfer mechanisms to ensure adequate protection of your data. You may request a copy of applicable SCCs by contacting us at privacy@ierase.ai.

7. Data Retention

• Active accounts: Data retained for the lifetime of your account
• Account deletion: Personal data deleted within 30 days of account closure
• Billing records: Retained for 7 years as required by financial regulations
• Identity documents: Deleted within 90 days of upload or immediately upon account deletion
• Inactive accounts: Accounts inactive for 24+ months will receive a deletion notice and be deleted after 30 days if no response

8. Your Privacy Rights

To exercise any of these rights, email privacy@ierase.ai or use the tools in your Account Settings. We will respond within 30 days (GDPR: within 1 month, extendable by 2 months for complex requests).

9. Security

We implement technical and organisational security measures including: TLS/SSL encryption in transit, AES-256 encryption at rest (Supabase), role-based access controls, secure authentication (Clerk), and regular security reviews. We never store payment card numbers. In the event of a data breach affecting your rights and freedoms, we will notify affected users and relevant authorities within 72 hours as required by GDPR.

10. Cookies

We use only strictly necessary cookies for authentication and session management. We do not use advertising or tracking cookies. See our Cookie Policy for full details.

11. Children's Privacy

iErase is not directed to children under the age of 16 (or 13 in the United States). We do not knowingly collect personal data from children. If you believe we have collected data from a child under these ages, please contact us immediately and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be notified via email to registered users at least 30 days before taking effect. The “Last updated” date at the top indicates when changes were last made. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

13. Contact & Complaints

EU/EEA users who are not satisfied with our response have the right to lodge a complaint with their local supervisory authority. A list of EU DPAs is available at edpb.europa.eu.