Privacy Policy

Last updated: 15 October 2026

Blackout Intelligence ("we", "us") is the data controller for personal data processed through Blackout Intelligence OS. This policy explains what we collect, why, and your rights under the UK GDPR and Data Protection Act 2018.

1. Data we collect

Account data: name, email address, and authentication details.
Billing data: subscription status and customer identifiers held by Stripe; we do not store full card details.
Usage data: investigations, activity logs, and preferences you create in the platform.
Credentials you add: third-party API keys, stored encrypted at rest.
Technical data: IP address, device and browser information, and cookies necessary to operate the Service.
Security audit data: unsuccessful attempts to access protected features, including time, feature requested, refusal reason, technical IP address, approximate country and limited browser information where available. We do not collect passwords, full request bodies or authentication tokens in these logs.

2. How we use your data

To provide, secure, and improve the Service (lawful basis: contract and legitimate interests).
To process payments and manage subscriptions (lawful basis: contract).
To communicate service and security notices (lawful basis: legitimate interests / legal obligation).

3. OSINT data

The Service helps you retrieve information from publicly available and third-party sources. You are the controller of any personal data you collect through your investigations and are responsible for having a lawful basis to process it. We process it on your behalf as a processor under our agreement with you.

4. Sharing & processors

We use trusted sub-processors to run the Service, including Supabase (database and authentication), Stripe (payments), and Vercel (hosting). We do not sell your personal data.

5. Retention

Security-denial records are normally deleted after 30 days by our authorised daily maintenance process. Other hosting-provider and investigation logs can follow separate published retention schedules. We limit access to the platform administrator and use these records to detect unauthorised access, investigate suspicious activity and protect subscribers; this is based on assessed legitimate interests in network and information security. We do not infer anyone’s identity solely from an IP address. We keep account data for as long as your account is active and as required to meet legal and accounting obligations. You can delete investigations at any time; deleting your account removes your associated personal data subject to lawful retention periods.

6. Your rights

You have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. To exercise these rights, contact us. You also have the right to complain to the UK Information Commissioner's Office (ICO).

7. Security

We apply appropriate technical and organisational measures, including encryption in transit and at rest for sensitive credentials, row-level access controls, and server-verified authorisation.

8. Contact

Data protection enquiries: privacy@blackoutintelligence.co.uk.

This document is a template and does not constitute legal advice. Have it reviewed by a qualified data-protection professional before commercial use.