Ask us to stop making your data available.

1 · What the form does

The form lets you ask us to stop making the records relating to one e-mail address available through our breach and underground-source datasets. It needs that address and nothing else. A name and a reason are optional, you can write in any language, and replies are in English.

We do not ask for identity documents, photographs or a fee. Instead we send a link to the address you entered, and the request starts only once you use it. That is how we know the request comes from the person who controls the address.

Each request covers one e-mail address. The form does not search by name, phone number or username, so if you have more than one address, make one request for each.

2 · What happens after you submit

1. 01

   You submit the form.

   Enter your e-mail address and complete a short automated check. The page then asks you to look for an e-mail. It gives the same answer whatever address was entered, so it cannot be used to find out whether an address appears in our datasets.

2. 02

   You confirm by e-mail.

   We send a confirmation link to that address. It works for 72 hours. Nothing happens until you press the button on the confirmation page; opening the link alone changes nothing. A request that is never confirmed starts nothing, and it is marked as lapsed after 7 days.

3. 03

   The 30-day period starts.

   Confirming starts a 30-day period for our reply. A receipt e-mail follows with the due date and a link to a status page. That page shows the stage of your request and its due date, and nothing else.

4. 04

   We look at the request.

   We search our datasets for records relating to the address. If we find none, the request closes and we tell you so; if we find records, a member of our staff decides the request.

5. 05

   You get an outcome by e-mail.

   The outcome is sent to the address you gave, by the due date. If a request needs more time, we tell you in writing before the 30 days end, and we say why.

3 · The possible outcomes

Approved

The records relating to the address are no longer accessible through our breach and underground-source datasets. The outcome e-mail says what this covered, such as how many records, from which dates and of what kinds, and gives some practical advice for your accounts.

No records found

We tell you that we found no records relating to this address today. If data relating to it is collected in the future, you can submit a new request.

Exemption or refusal

If we cannot do all or part of what you asked, the e-mail gives the reason in writing, together with your right to complain and the way to appeal.

4 · If you disagree

Reply to the outcome e-mail, or write to privacy@generalintels.com, and say why you disagree. A member of our staff looks at the decision again and answers you in writing.

You also have the right to complain to a supervisory authority. In the European Union and the United Kingdom, that is the data protection authority where you live or work. If you live in a US state with a consumer privacy law, you may also contact your state attorney general.

5 · When to write to us instead

Some situations need a person rather than the form. Write to privacy@generalintels.com if:

• You no longer have access to the mailbox. Tell us what happened, and we will agree another way for you to show that the address is yours, for example control of a second address that appears in the same records. A member of our staff decides whether that is enough.
• You are acting for someone else, as their agent, or as a parent or guardian writing for a child. Send a plain written statement that you are authorized to act. Please do not send copies of identity documents; we do not ask for them.
• You have a question about the form, about a request you made, or about this page.

A member of our staff answers messages to this address within 30 days. Messages are accepted in any language, and replies are in English.

Brazil: privacy@generalintels.com is also our contact for data-protection matters from Brazil, including requests under the LGPD (Lei Geral de Proteção de Dados).

6 · What a request does not cover

A request applies to our breach and underground-source datasets. It does not reach:

• Information in public sources that we merely read.
• Attachments and screenshots.

If the same credentials appear again in a later data set, they stay inaccessible. A genuinely new incident involving your address is a new event, and it can appear.

One consequence to weigh before you ask: once the records relating to your address are no longer accessible, they are also no longer available to the security teams that use them to detect accounts like yours being misused. The choice is yours.

7 · What happens to the request itself

This is about the record of your request, not about the datasets. The same schedule applies to every request.

After 7 days

A request that was never confirmed is marked as lapsed, and the internal key we use to limit repeated submissions is cleared.

After 1 year

The IP address the request came from is truncated, and the browser's user agent is cleared.

After 3 years

Counted from the day the request was closed, or, if it was never confirmed, from the day it was submitted. Your e-mail address, name, reason and every free-text note about the case are cleared. What remains is an anonymous record of dates, channel and outcome.

If your request was approved, the address stays on the list we use to keep those records unavailable for as long as that applies, because the list is what does it; clearing the request record does not reverse an approved request.