Privacy Policy

1. Introduction & Data Controller

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how SEQ SIA (“we”, “us”, “our”) processes personal data in relation to the Breach cybersecurity platform (“Service”). It applies to all users, including visitors, customers, and Free plan users.

Controller: SEQ SIA, reg. No. 40203410806, Lastadijas 12 k-3, Riga LV-1050, Latvia. Email: breach@offseq.com

If you are within the EU/EEA, SEQ SIA is the data controller of your personal data under the General Data Protection Regulation (GDPR).

2. Data We Collect

We process the following categories of personal data:

2.1. Account and Identity Data

• Full name, business email, organization name
• One-time sign-in codes, stored only as keyed hashes and deleted after 10 minutes; we hold no passwords
• Billing information and payment history

2.2. Usage and Platform Data

• Search queries submitted by authorized users
• Search results presented to users
• Alert configurations and audit logs

2.3. Technical and Device Data

• IP address (for security, rate limiting)
• Browser, device metadata
• Session and authentication tokens

2.4. Cookies and Similar Technologies

We use only essential cookies, for authentication, session management and remembering your language. See section 11.

3. Breach Intelligence Data

SEQ SIA does not store, host, or maintain any leaked or breached databases on its own infrastructure.

All breach intelligence data (compromised credentials, exposed passwords, leak records) is retrieved in real-time from third-party intelligence providers via secure, encrypted API connections. The data is queried on-demand and presented to authorized users for the sole purpose of cybersecurity risk assessment and organizational protection.

Search results may be temporarily cached in our database to improve performance and reduce redundant API calls. Cached data is subject to automatic expiration (TTL) and does not constitute permanent storage of breach data.

4. Purposes of Processing & Legal Bases

We process personal data for the following purposes and legal bases:

• Contract performance — Art. 6(1)(b) GDPR: Providing, maintaining, and improving the Service; processing payments and billing.
• Legal obligation — Art. 6(1)(c) GDPR: Tax and financial record-keeping; compliance with legal obligations.
• Legitimate interest — Art. 6(1)(f) GDPR: Security monitoring, fraud prevention, abuse detection, improving the Service, audit logging.
• Consent — Art. 6(1)(a) GDPR: Product tips and offers by email for accounts that opted in.
• Legitimate interest — Art. 6(1)(f) GDPR, soft opt-in: Occasional product emails about similar services to existing paying customers.

Product emails: We send product tips and offers only if you consent, either with the opt-in box at signup (unticked by default) or when the app asks you once. Existing paying customers receive occasional product emails about similar services under the soft opt-in (Art. 6(1)(f) GDPR) unless they opt out. Product emails may be personalised using your monitoring results, such as how many exposures were found, never the content of any credential. You can opt out at any time under Settings › Notifications or with the unsubscribe link in every such email. Breach alerts and billing or security notices are not marketing and are not affected.

Legitimate interest details: Security monitoring and abuse prevention are critical to protect customer accounts and platform integrity. We balance this with data minimization and retention limits.

5. Third-Party Data Sharing

We share personal data only as necessary for the Service:

• Payment processor (Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, the Netherlands): Processes your payment details for billing; card data never touches our servers. We store only the card's brand, last four digits and expiry, and a Mollie customer and mandate reference for renewals and the one-click purchases you confirm. You can remove a saved card, and with it the mandate, at any time in Billing
• Intelligence providers: For real-time breach data retrieval (no account information is shared)
• Hosting providers: On secure EU data centers
• Cookieless page-view counter (in.ainalytic.net): Receives the path of each page you view, never its query string, and the referring page, to count page views; nothing is stored on your device
• Cloudflare Web Analytics: Cloudflare, which delivers the site, adds a cookieless measurement script to every page that reports visits and page load performance; nothing is stored on your device
• Legal authorities: When required by law

Personal data may be processed by subprocessors subject to contractual safeguards.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

6. Cross-Border Transfers

If personal data is transferred outside the EU/EEA, we ensure appropriate safeguards such as:

• EU Standard Contractual Clauses (SCCs)
• Adequacy decisions by the European Commission

7. Data Retention

We retain personal data only as long as needed for the purposes noted above:

• Account and billing information: until account closure + 30 days
• Audit logs: 24 months
• Search cache: TTL expiry (typically 60 minutes)
• Payment records: 7 years (Latvian tax law)
• Unlocked records: Retained while your account is active
• A keyed one-way hash of your mailbox address, with its domain and the date your free starter unlock was granted: kept after closure, so the offer applies once per mailbox

Once data is no longer needed, it is deleted or irreversibly anonymized.

8. Your Data Protection Rights

Under GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data (“right to be forgotten”)
• Restrict or object to processing
• Data portability
• Withdraw consent where given

To exercise rights, contact breach@offseq.com. We respond within 1 month in most cases.

You may lodge a complaint with the Latvian DPA (Datu valsts inspekcija) at www.dvi.gov.lv.

9. Automated Decision-Making / Profiling

We do not use automated decision-making that produces legal or similarly significant effects on individuals outside normal Service functions.

10. Security

We implement appropriate technical and organizational measures, including:

• TLS/SSL encryption in transit
• Encrypted storage and passwordless sign-in with single-use, hashed email codes
• Access controls and rate limiting
• JWT-based session management with expiration
• IP-based abuse prevention
• Audit logging and monitoring
• Incident response procedures

11. Cookies

Essential cookies enable core platform functionality (authentication, session management and your language preference, NEXT_LOCALE). Pages check whether you are signed in, so visitors who are not signed in also receive two session cookies from our sign-in service: a security token against cross-site request forgery and the address to return to after signing in. These cookies are strictly necessary for the Service to function and cannot be disabled.

We count page views with a cookieless counter (in.ainalytic.net) that receives only the page path, never the query string, and Cloudflare Web Analytics measures visits and page load performance on every page without cookies. Neither stores anything on your device. We do not use analytics, advertising or tracking cookies, or tracking pixels.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through the platform. The “Last updated” date at the top of this page indicates the most recent revision.

13. Contact

For privacy-related inquiries, contact us at breach@offseq.com or visit our contact page.