Notice at Collection
Privca collects personal information to operate accounts, prepare authorized requests, communicate with request targets, maintain request evidence, secure the platform, provide support, process billing, and comply with legal or operational obligations. We do not sell personal information.
The categories below describe the kinds of information Privca may collect as the service is used. Some categories apply only if you provide the information, use a paid plan, submit requests, join a family plan, or interact with support.
Information We Collect
We may collect access and account information such as an email address, name, password credentials, email verification state, role, plan status, session records, login risk signals, and account security events.
We may collect Privacy Passport and request-readiness information such as contact details, state, address or prior address when needed, phone number when needed, signed authorization records, request preferences, selected brokers or companies, request goals, and target-specific locator details.
We may collect request records such as generated request package metadata, submission route, outbound send events, broker or company replies, user action requirements, support notes, timelines, evidence artifacts, completion records, failure reasons, cancellation records, and history.
When a request is done and you open "See what the company wrote back" on it, we draw the company's reply as it arrived into a picture and a PDF, in Cloudflare's browser with the email's scripts off and nothing loaded from the internet, and keep them with that request, encrypted, for as long as we keep the original reply.
We may collect billing and plan information such as plan tier, subscription state, checkout session metadata, billing portal activity, activation codes, family plan membership, and payment provider identifiers. Privca does not store full payment card numbers.
If you run an Exposure scan, we keep the records described in Exposure scans.
If you connect an app such as Claude or ChatGPT to your account, we keep a record of each connection you approve and when it ends.
We may collect technical information such as IP address, user agent, device or browser signals, security logs, rate-limit records, cookie or session identifiers, pages visited, error records, and operational telemetry needed to secure and operate the service.
Separately from the above, Privca counts how its public marketing pages are used. Those counts are not personal information and are not connected to any of the records described above: they carry no identifier, no cookie, and no IP address, so they cannot be traced to a visitor or an account. See Sale, Sharing, and Advertising for what is recorded and for how long.
Sources of Information
We collect information from you when you create an account, complete setup, sign authorization, select targets, submit requests, contact support, use the dashboard, join or manage a family plan, or complete checkout.
We may also receive information from request targets, email systems, payment providers, security tools, infrastructure providers, support workflows, and internal operational systems that process or monitor requests.
How We Use Information
We use information to manage service availability, operate accounts, authenticate users, secure sessions, verify readiness, prepare authorized requests, generate request packages, submit requests through supported routes, communicate with brokers or companies, monitor replies, maintain documented request records, provide support, enforce plan limits, process billing, prevent misuse, investigate incidents, and improve service reliability.
We may also use information for legal compliance, fraud prevention, auditability, dispute handling, business operations, service analytics, and policy enforcement.
Information Sent to Brokers or Companies
When you submit a privacy request, Privca may send selected personal information to the broker, company, portal, or privacy team receiving the request. This may include name, email, state, address, phone number, signed authorization, request goal, and target-specific context when needed for that route.
Privca aims to send enough information for the target to locate and process the request without sending unrelated or unnecessarily sensitive information. High-risk identifiers such as government ID, SSN, payment card details, account credentials, or unrelated sensitive documents are not part of ordinary automated request flows. If a target asks for sensitive evidence, the request may require review or direct user action instead of automatic disclosure.
Information included in a privacy request is provided for the limited purpose of identifying the consumer, verifying authorization, and processing the requested privacy action. A recipient should not use request information for unrelated marketing, profiling, enrichment, resale, lead generation, or other unrelated commercial purposes.
ID photos
Some companies ask for a photo of your government ID, such as a driver's license, state ID or passport, to check that a deletion request really comes from you. When one does, your request's page lets you add a photo for Privca to send, send it to the company yourself, or skip that company. We never ask you to email your ID to us.
If you add a photo, its hidden metadata (such as where it was taken) is wiped. You confirm that it is your own ID and which companies get it. Privca sends it only to those companies and asks them to use it only to verify your identity, then delete it. No one at Privca looks at it.
Your photo is encrypted and deleted right after it is sent. A company that receives your photo handles it under its own privacy policy.
Exposure scans
If you run an Exposure scan, Privca searches a list of people-search sites for you and shows you where your information is listed. A scan runs only when you start it. From your dashboard, it uses the first name, last name, city and state saved in your Privca account, and nothing else from your account. Without an account, on our website's free scan, it uses the first name, last name, state and city you type (the city chosen from the real places in that state), after you tick a box saying you are searching for yourself; we never ask for a phone number or an email address there. Either way you may also add your age. It is optional, used only to set aside records that show a clearly different age, kept encrypted while the scan runs, and deleted when the scan finishes. It is never saved to an account.
Privca runs the searches through Cloudflare's browser service, so each site receives the same search a visitor would make: your name, city and state, in the site's search address. The sites do not receive your age, your email or any other detail, and our browser tells them it is Privca. Cloudflare processes the pages the sites return, which can include other people's information. We search only sites whose published rules allow our searches, and we stop at a site that blocks or challenges us rather than get around it. The scan page lists the sites before you start.
When a site shows a record that matches your name, we keep what the record shows about the match (its address on the site, the name, city and state on it, the age it shows, if any, and how many addresses, phone numbers, email addresses, relatives and associates it lists, never what they are) and a screenshot of the record with everything but the name, city and state blacked out, each blacked-out part labeled with the kind of detail it hides. They are encrypted in private Cloudflare storage and deleted about an hour after the scan finishes, or for a scan from your dashboard sooner, once your browser confirms it received the scan's private PDF, unless a legal obligation requires us to keep a dashboard scan's. A Cloudflare Workflow runs each scan and holds only identifiers and status codes, for an hour after the scan finishes (two for a scan without an account), or a day if it ends in an error.
A scan without an account keeps nothing past one hour after it finishes: what you typed and what we found are encrypted while it runs and deleted then, and the page says when. Your browser holds a random key in a cookie so that only it can see the scan, and we keep only a scrambled form of that key. If you create a free Privca account in that browser within the hour, the account can bring the scan in: what you typed starts your account setup (you check it and save it yourself), the companies behind the sites that found you are picked for you to review, and the scan's results stay with your account as below. To keep the free scan fair and affordable, we count scans from each network for a day, using your IP address in our rate limiter, which keeps it no longer than that day.
We keep a short record of each scan: when it was authorized, which sites were checked and whether each one found you, did not, or could not be checked, and your answers below, with no name, place or address in it. For a scan from your dashboard (or one your account brought in), that record lets us remove you from the sites that found you and show your past scans, and we keep it as we keep your other request records, as described in Retention. For a scan without an account it holds nothing that points to you. When a dashboard scan's private PDF is ready, we email you a link to your dashboard; the email holds no results.
Your results show each site as found, a possible match, not you, not found, or not checked, and a site we could not check never counts as clean. Without an account they show which sites list that name in that city, the screenshots and what each site shows about you as kinds with counts, but never a record's age, its address on the site, or a link to it. In your account, while a scan's details are shown, you also see the age each record shows and can tell us whether each record is you ("This is me" or "Not me"): a possible match you confirm counts as found, and a site where you said every record is someone else shows that, and gets no removal request. Once your account setup is done (your details saved and the authorization signed), each record also links to its page on the site. Some people-search companies hide their results behind a paywall, so we do not search them; when Privca can send them an opt-out, the results list them and the removal includes them. Privca removes you from every site where we found you: one button creates removal requests to the companies that run those sites, under the same signed authorization, checks and plan limits as any other request, and they receive what is described in Information Sent to Brokers or Companies. A scan itself sends no request to those companies.
Connecting an AI assistant
You can connect your Privca account to an AI assistant such as Claude, made by Anthropic, or ChatGPT, made by OpenAI. You approve each connection on the Privca website while signed in. Connecting is optional, and it does not change how Privca handles your requests.
A connected assistant can only read, and only your own account. It can see whether your account is set up and the names of any setup steps still missing, when your signed authorization expires, and, for each privacy request, the company it went to, its status, why it closed if it did, its dates and the names of the steps on its timeline. It cannot see your identity details, your account email, your signature, what any company wrote back, or any evidence file, and it cannot send, change or cancel anything.
What an assistant reads through the connection goes to the company that makes it, such as Anthropic for Claude or OpenAI for ChatGPT, and that company handles it under your agreement with it and its privacy policy, not this one.
Privca keeps a record of each connection you approve: the app's name, where it sends you back to, the access you gave it, and when the connection started and ended. We keep these records as evidence of your consent, including after a connection ends or your account is deleted, as we do for your signed authorizations, and they are part of your data export. The sign-in details for a connection are held by our hosting provider, Cloudflare, and contain none of your personal details. You can end a connection at any time on your Settings page, and removing Privca from the assistant also stops it from using Privca.
Service Providers and Subprocessors
We may disclose information to service providers that help operate Privca, including hosting, storage, email delivery, queue processing, payments, security, monitoring, analytics, support, document generation, and infrastructure providers.
These providers may process information only as needed to provide services to Privca or as otherwise permitted by their contracts and applicable law. Provider categories are published on the Subprocessors page and will be expanded as the platform matures.
Sale, Sharing, and Advertising
Privca does not sell personal information. Privca also does not share personal information for cross-context behavioral advertising, and uses no advertising, retargeting, or marketing technology.
Privca measures how its public marketing pages are used, without identifying anyone. What is recorded is a count of page views and of a fixed list of on-page actions, with the day and time. No cookie, account or session identifier, IP address, name, email, or form content is stored, and referrers are reduced to a category such as search or social before storage. Because nothing identifying is kept, there is no key that links one recorded action to another or to a person. This measurement does not run in the customer dashboard, and it does not run for visitors whose browser sends a Global Privacy Control or Do Not Track signal. Records are deleted after 90 days. The Cookie Policy describes it in full.
If advertising, retargeting, or marketing technologies are added later, this policy and the Cookie Policy will be updated with the relevant choices and disclosures before they are used.
Sensitive Information
Privacy request workflows can involve sensitive information, including identity details, signed authorization, contact information, request evidence, and broker replies. Privca uses sensitive information to provide the service requested, secure the platform, maintain request records, and support request handling.
Privca does not use sensitive information to infer unrelated characteristics or for unrelated advertising purposes.
Security
We use technical, organizational, and access-control measures intended to protect service data, including server-side authorization boundaries, role-based access, mandatory internal two-factor authentication, append-only audit trails, encryption of stored identity details, secure headers, rate limits, validation, and production safety gates that keep risky capabilities off by default.
No system can be guaranteed completely secure. If you believe you found a security issue, contact support@privca.com. The Responsible Disclosure page explains scope and what to expect.
Retention
We retain information for as long as needed to operate the service, provide documented request history, support users, maintain security, prevent fraud or abuse, process billing, resolve disputes, comply with legal obligations, and protect the platform.
Some records may be retained after account closure when needed for security, auditability, legal compliance, billing, dispute resolution, backup integrity, or preservation of request evidence. Where appropriate, records may be deleted, minimized, or anonymized.
Your Choices and Rights
Depending on your location and the information involved, you may have rights to request access, deletion, correction, portability, opt-out, limitation of sensitive information use, or non-discrimination for exercising privacy rights.
To make a privacy request to Privca, contact support@privca.com. We may need to verify your identity before acting on a request. Some information may be retained where an exception applies, including for security, billing, dispute, legal, or request-record reasons.
For general educational information about consumer rights, see Consumer Rights.
U.S. State Privacy Disclosures
This section supplements the rest of this policy for residents of states with comprehensive privacy laws, including California. In the last 12 months, Privca has collected the categories of personal information described in "Information We Collect": identifiers and account details, Privacy Passport and locator details, signed authorization records, request and evidence records, billing and plan state, and technical and security information. Each category is collected for the purposes described in "How We Use Information" and retained under the criteria described in "Retention" — for as long as the account, its request records, security, billing, dispute, or legal obligations require it.
Privca does not sell personal information, does not share it for cross-context behavioral advertising, and has not done either in the last 12 months. Personal information is disclosed only to the service providers described in "Service Providers and Subprocessors" for business purposes, to brokers or companies when you direct Privca to submit a privacy request, as described in "Information Sent to Brokers or Companies," to the people-search sites an Exposure scan you start searches, as described in "Exposure scans," and to an app such as Claude or ChatGPT when you connect it, as described in "Connecting an AI assistant." Privca does not use or disclose sensitive personal information for purposes other than providing the service you request, securing the platform, and meeting legal obligations.
To exercise access, deletion, correction, or portability rights over the information Privca holds about you, email support@privca.com, or use the tools in your dashboard: account data export and account deletion are available there directly. We verify requests against your account (normally by confirming control of your account email) and respond within the time your state's law allows, generally 45 days. You may use your own authorized agent to submit a request to Privca; we will ask for proof of the agent's written permission and may still verify your identity directly. If we deny a request, we explain why, and you may appeal by replying to our response — the appeal gets a fresh review, and we respond within the window your state's law requires. You will not be penalized for exercising privacy rights.
Where Information Is Processed
Privca is operated from the United States, and the service is designed around United States privacy rights and request routes. Information is stored and processed in the United States. Where a provider processes data outside the region it was collected in, Privca relies on that provider's recognized transfer safeguards, as described on the Subprocessors page.
Children and Minors
Privca does not operate on children's information. Account creation asks you to declare your age eligibility and offers no path in for anyone 13 or younger; Privca does not knowingly collect personal information from children, including children under 13 as defined by the Children's Online Privacy Protection Act (COPPA). Ages 14 to 17 can hold an account only through a family plan invitation from a parent or legal guardian, who consents to and is responsible for the minor's use of the service; requests are always prepared from the account holder's own verified identity. The eligibility declaration is checked once and is not stored. Privca does not collect birth dates. If you choose to add your age when you start an Exposure scan, it is used only for that scan and deleted when the scan finishes.
If we learn that an account belongs to someone 13 or younger, or to a 14-to-17-year-old who joined outside a family invitation, we close the account and delete its information, keeping only what security, legal, or audit obligations require. If you believe a child has provided information to Privca, contact support@privca.com and we will act on it promptly.
Family Plan Privacy
Family plan access may allow multiple users to receive paid plan coverage. Family plan participation does not automatically make one member's Privacy Passport, request history, or evidence records visible to another member or to the payer, unless a feature clearly provides that sharing and the user authorizes or configures it.
Changes to This Policy
We may update this policy as Privca changes, as supported workflows expand, or as legal requirements evolve. Updates will be posted with a new effective date.
Contact
For privacy questions and general support, contact support@privca.com.