1. Who we are and what we do
TAYNOPIS operates a threat intelligence platform that helps individuals and organizations understand when their data has been exposed by infostealer malware and other compromised-data sources, so they can respond and protect themselves. We enable verified domain owners to see exposures affecting their own assets, and individuals to check whether their email address appears in indexed compromise data.
We are the controller of the limited personal data described in this policy. Contact: [email protected].
2. The principle: minimal collection
We limit personal data collection to what is strictly necessary to provide the service:
- We do not collect or store your search queries. A search performed on the website retrieves data from storage and returns it in the response; the query itself is not persisted as a personal-data record.
- We do not run third-party advertising or tracking pixels and we do not sell, rent or trade personal data.
- Payments are processed by regulated third-party processors; we never see or store full card numbers.
3. Categories of data we process and why
3.1 Breach and stealer data (data about exposures)
We process data sets originating from third-party sources — including infostealer logs that are already circulating among criminals — to verify and index exposures. Our legitimate interests (Art. 6(1)(f) GDPR) and, where applicable, your consent or contract (Art. 6(1)(b)) form the legal bases. Purposes:
- enabling individuals to check whether their email address appears in indexed exposures;
- enabling verified domain owners to monitor and remediate exposures affecting their own domains;
- producing aggregate, de-identified statistics about threat trends.
Important: because indexed data originates from criminal activity, we cannot guarantee accuracy, completeness or currency. Absence from our index does not mean absence of compromise.
3.2 Account data (customers)
When you register a corporate account we process: username, first and last name, business email, company name, company address, contact number, VAT ID, industry, company website and legal representative — for account creation, identity and company verification, billing, and service delivery (contract, Art. 6(1)(b), and legal obligation for billing/tax records, Art. 6(1)(c)).
Security credentials. For two-factor authentication we store either FIDO2 public-key credential data or a TOTP shared secret, plus hashed (SHA-256) one-time backup codes — never backup codes in plain text. This data is used solely to authenticate you and protect your account (contract / legitimate interests in securing the Service). We also keep security-event logs (sign-in attempts, 2FA failures) to detect and prevent unauthorized access.
3.3 Domain verification data
To unlock domain-scoped monitoring you must prove control of the domain (DNS TXT record or similar). The domain name, verification result and requester's IP address are retained as an anti-abuse measure (legitimate interests).
3.4 Technical and log data
We keep only the bare-minimum server logs required to operate the service and combat malicious activity: timestamps, browser user-agent, IP address (where necessary), and security-relevant events (login attempts, failed verifications, rate-limit hits). Retention is limited to what is operationally necessary (legitimate interests / legal obligation).
3.5 Correspondence and support
If you contact us we process your message and contact details to respond and keep records of communication (legitimate interests, contract).
3.6 Cookies
We use a strictly limited set of cookies: session/authentication cookies required for the console to function, and a "remember me" persistent cookie set only if you opt in. We do not use third-party cookies, tracking pixels or advertising identifiers. You can refuse cookies in your browser settings; essential cookies cannot be disabled without breaking sign-in.
4. Sensitive data
We do not deliberately collect sensitive categories of personal data (health, political opinions, religious beliefs, etc.). Some third-party breach data may incidentally contain such information; we do not use it for any purpose other than the defensive purposes described above, and we do not make it searchable beyond the mechanisms described in this policy.
5. How we protect data
Security is handled by a "defence in depth" approach with multiple independent layers:
- all traffic is encrypted in transit over HTTPS/TLS;
- Cloudflare is used to block potentially malicious requests and mitigate DDoS attacks;
- rate limits and anti-automation measures (including CAPTCHA) protect search endpoints from bulk abuse;
- data at rest is encrypted; storage is access-controlled and segregated;
- strict role-based access control — indexed data is reachable only through authenticated, authorization-checked application paths, never by direct storage access;
- FIDO2 hardware-key two-factor authentication is available and strongly recommended for all console accounts;
- regular security reviews and prompt patching of infrastructure components;
- comprehensive audit logging of user actions in the console;
- archived source data sets are stored encrypted with restricted access for verification purposes.
6. Data sharing and disclosure
We do not sell your personal data. We share it only with:
- Service providers (hosting, email delivery, payment processing) acting as processors under contract, only as necessary to deliver the service;
- Law enforcement or authorities, where we are required by law or valid legal process, or to assist legitimate investigations of cybercrime affecting our data;
- Affiliates and successors in corporate transactions (merger, acquisition, restructuring), under confidentiality protections.
We may disclose de-identified, aggregate statistics publicly (e.g., threat trends) — such statistics do not identify individuals.
7. International transfers
Our infrastructure and providers may be located in multiple jurisdictions. Where personal data is transferred out of your region, we use appropriate safeguards such as standard contractual clauses or equivalent mechanisms.
8. Retention
- Account data: for the life of the account plus any statutory limitation period (e.g., for billing/tax records);
- Indexed exposure data: retained while it serves the protective purpose of the service, subject to verification, archival and, in some cases, deletion practices described above;
- Logs: transient operational and security logs are retained only as long as operationally necessary;
- Search queries: not retained.
9. Your rights
Depending on your jurisdiction (including the EU/EEA and the UK under GDPR), you may have the right to:
- access personal data we hold about you;
- correct inaccurate personal data you have provided to us;
- erase your account data ("right to be forgotten") where no overriding legal or retention grounds apply;
- restrict or object to processing based on legitimate interests;
- data portability of data you provided to us in a machine-readable format;
- withdraw consent at any time where processing is based on consent;
- lodge a complaint with your local supervisory authority.
To exercise any right, contact [email protected]. We respond within the statutory timeframe.
Limitation inherent to breach data: data indexed from third-party compromise sources documents historical facts that cannot be retroactively altered; we cannot "correct" the content of a historical leak. We can, however, remove the association of an email address from public searchability upon verified request (opt-out), in line with our data-minimization approach.
10. Automated decision-making
We do not carry out automated decision-making with legal or similarly significant effects about you. The service returns factual search results and aggregate statistics; interpretation and action remain with you.
11. Children
The Service is not directed at children under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.
12. Changes to this policy
We may update this policy from time to time; the current version is always published on this page with its "Last updated" date. Material changes will be highlighted on the website or notified by other reasonable means. Continued use after changes constitutes acceptance.
13. Contact
Questions, requests or complaints: [email protected]. We endeavor to reply within a reasonable time and to resolve concerns in good faith.