Privacy Policy
Last updated: 2026-10-17
1. Who is responsible
The controller of your personal data is Tommaso Bertocchi, Trieste, Italy. Contact: support@openosint.tech.
2. Data we process
- Account: your email address.
- Domains: the domains you add and their verification status.
- Scans: scan results and the reports generated from them. These describe public information about your domains.
- Login links: a login link is stored only as a hash, together with the email address and the IP address of the request.
- IP address: used to limit abusive requests (rate limiting).
- Technical logs: our servers keep operational logs needed to run and secure the service.
- Page analytics: on our public pages only, Umami records anonymous page views: the page address (including any query string), the website you came from, browser, operating system, device type, screen size, language, and approximate location such as country. See section 6.
OpenOSINT Diligence
If you use OpenOSINT Diligence, these points apply in addition to the rest of this policy.
- What we process: the company names, registry numbers, LEIs and domains you enter, and the reports we generate from them. Diligence looks up companies and their domains. It does not look up data about individuals, and we ask you not to enter a person’s name as a company.
- Which public sources receive what during a check: Companies House (company name or number); GLEIF (company name, LEI or country); SEC EDGAR (company name, for US registrants); DNS resolvers and domain registries (RDAP) (the company’s domain and similar lookalike domains); crt.sh (the domain); and, only if switched on, GDELT (company name). The OFAC and UK sanctions lists are downloaded and compared on our own servers, so the name is not sent to them. We send no account information, email address or other customer data to these sources.
- Retention: reports are kept while your account is active and deleted within 30 days of account deletion. Copies of public-source answers that we keep to avoid repeating lookups expire after at most 7 days.
3. Why we use it, and the legal basis
- To provide the service you asked for: your account, domain checks, scans, alerts, reports. Legal basis: contract (Art. 6(1)(b) GDPR).
- To keep the service secure and prevent abuse: rate limiting, logs, ownership verification. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
- To handle payments and keep accounting records. Legal basis: contract and legal obligations.
- To understand which public pages are visited and where visitors come from, so we can improve the site. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR). It is not linked to you or to your account, and no cookies are used.
4. Who processes data for us
- Heroku (Salesforce): hosting and database. The database is in the EU. Database backups may be stored in the United States.
- Resend: sending email (login links and alerts), EU region (Ireland).
- Umami (Umami Software, Inc.): anonymous, cookieless page analytics on our public pages (home, Monitor, pricing, contact, terms, privacy, refunds, Diligence, Diligence methodology, Diligence back-test). Umami may process data outside the EU, including in the United States; its data processing agreement incorporates the EU Standard Contractual Clauses.
- Gumroad: payments, as reseller and merchant of record. For payment data Gumroad is an independent controller under its own privacy policy. We receive only the purchase email, the sale and subscription ids, the product, the status and the dates.
5. How long we keep it
- Account data (email, domains): until you delete the account or the domain. Removing a domain deletes its scans and reports.
- Terms acceptance: we keep the date and version of the Terms of Service you accepted, for as long as the account exists.
- Login links and the request IP: a link expires after 15 minutes. The stored record is deleted after 24 hours.
- Scan history: scans are deleted automatically after 400 days. We always keep the latest scan of a domain, and the latest complete one, which the next scan is compared against. The free plan shows only the latest report; paid plans show up to 12 months.
- Subscription records (plan, status, dates, purchase email): for as long as the account exists. Payment notifications from Gumroad (ids only): deleted after 30 days.
- Finished scan jobs (technical records of runs): deleted after 30 days.
- Page analytics (anonymous): kept by Umami for 6 months, then deleted.
- Backups are kept by Heroku on a rolling basis (about 7 daily backups) and age out on their own.
6. Cookies
We set one strictly necessary session cookie to keep you signed in and to protect forms. We use no advertising or tracking cookies, and our page analytics sets no cookies and stores nothing on your device, so there is no cookie banner.
| Name | Purpose | Set by | Duration | Type |
|---|---|---|---|---|
om_session |
Keeps you signed in and protects forms against CSRF | First party, app.openosint.tech | 7 days | Strictly necessary, no consent required |
We do not use advertising or third-party cookies. Fonts, images and video are served from our own domain. Payments happen on Gumroad's checkout page, which sets its own cookies under Gumroad's privacy policy.
Page analytics. Our public pages (home, Monitor, pricing, contact, terms, privacy, refunds, Diligence, Diligence methodology, Diligence back-test) load a small script from Umami. It sends the page address, the website you came from, your browser, operating system, device type, screen size and language. Umami uses your IP address only momentarily to work out an approximate location such as country. It sets no cookies, creates no profile, and does not follow you across websites or link visits to an account.
It is not loaded on pages that require signing in, such as login, dashboard, domain, scan, settings and billing, or on error pages. We never send your email, your domains or scan results to Umami.
If your browser sends Do Not Track, the script does not run. If your browser or an extension blocks it, the site works the same.
7. Your rights
You can ask for access, rectification, erasure, portability, or object to processing, and you can restrict processing in the cases the law provides. You can also complain to the Italian data protection authority (Garante per la protezione dei dati personali, garanteprivacy.it).
8. Deleting your account
For now, email support@openosint.tech from your account address and we will delete your account and its data. You can remove single domains yourself from the dashboard.
9. Contact
Tommaso Bertocchi, Trieste, Italy · support@openosint.tech