Find your exposure.
We match public listings and check breach sources. AI services analyze relevant identity details and page content.
Security & trust.
Protecting your personal data is our purpose. That includes the information you share with us. Here’s how we use it, protect it, and manage access.
Read our Privacy Policy
Questions about your data? Contact us
Personal data helps us find the right listings.
We use the data you provide to find exposure, prepare your report, and process removals you authorize.
Pursue removal.
Supported removal targets receive the information needed to identify your record and process an authorized request.
Track the work.
We keep findings and workflow records to show progress and check for listings that return.
We don’t sell personal data or use advertising trackers.
We use our own product analytics to find where people get stuck. Selected events use a random browser-session identifier and can link to your account after a scan or sign-in. Service providers still receive data needed for their work.
How we protect and access your data.
Encryption and access controls protect different parts of the service. Delist is not end-to-end encrypted.
Your core profile is encrypted.
Your core profile uses AES-256-GCM with a scrypt-derived key before database storage.
Findings, email records, listing URLs, workflow records, and evidence can contain personal data. They rely on infrastructure and application access controls, rather than this profile encryption.
Scanning requires access to your profile.
The service decrypts your profile to run a scan. A permission-restricted temporary job file may be used and is cleaned up after job expiry or startup recovery.
The public web connection accepts TLS 1.2 and TLS 1.3.
Authorized people can access records.
Operators may view customer data to run, support, secure, or troubleshoot Delist. Providers process data for their specific roles.
See who receives dataWho helps us run the service.
We use service providers for the tasks below. Each receives data needed for its role.
Cloud hosting and storage
- Purpose
- Host the service and store private removal evidence.
- Data involved
- Service data and private removal evidence.
Payments and email
- Purpose
- Process payments and deliver account, support, removal, and follow-up email.
- Data involved
- Payment data and email content. Customer email links may be tracked to measure clicks.
Search and page retrieval providers
- Purpose
- Help us search for exposed personal data and retrieve public pages.
- Data involved
- Search queries can include your name and other identifying details. Page content and URLs may contain personal data.
Breach lookup and AI
- Purpose
- Breach-data aggregators check known breach records. AI models analyze findings and potential threats where those features are used.
- Data involved
- Your email for breach lookups; relevant identity details, search results, and page content for AI analysis. We choose and configure the models, hosted by our cloud providers.
Address lookup and staff notifications
- Purpose
- Suggest addresses as you type. Notify authorized staff and support service reviews.
- Data involved
- Address information you enter; contact details and relevant service-message excerpts for operational messages.
Removal targets
- Purpose
- Data brokers, people-search sites, and other supported targets process authorized removal requests.
- Data involved
- The details needed to identify your record and process the request.
What happens when you delete your account.
We remove your profile and linked application records and attempt to cancel active billing. Some records remain for limited purposes.
Read the retention details- Private evidence files
- Up to 365 daysUntil their storage lifecycle deletes them.
- Backups
- Up to 14 daysDeleted data can remain until a backup expires.
- Limited records
- Payment, audit, security, and records that prevent re-import may remain when necessary. We also keep an anonymous summary and event totals.
Our current assurance status.
Delist is in beta. Internal reviews and automated tests do not replace independent assurance.
No scan can establish that all personal data has been found or removed. Results and timing vary by source. Read our service limits.
- Internal security reviews
- Conducted internally
- Automated security tests
- Part of development
- SOC 2 report
- Not published
- Independent penetration-test report
- Not published
Questions about your data.
Who can access my personal information?
Delist uses automated systems for scanning and removal work, but authorized operators may access customer information when needed to run, support, secure, or troubleshoot the service. Service providers receive the data needed for their role, and removal targets receive the information needed to identify and suppress a record.
What is encrypted at rest?
The canonical customer profile record is encrypted with AES-256-GCM using a scrypt-derived key before it is stored. Scan findings, workflow records, email records, and evidence may be stored separately and are protected by infrastructure and application access controls; Delist does not claim that every database field is application-layer encrypted.
What analytics does Delist collect?
Delist uses its own cookie-free event collection. It records a session-scoped random identifier, page path, attribution parameters when present, and allowlisted product events. Once you run a scan or sign in, those session events are associated with your account. The public event endpoint is designed not to collect scan answers or profile fields.
What happens when I delete my account?
Account deletion removes the profile and linked application records and cancels an active subscription when possible. Evidence files can remain in private storage until their lifecycle deletion, currently up to 365 days. Limited payment, audit, security, and anti-reingestion records may remain where legally or operationally necessary. An anonymous summary with no name or contact details, and daily totals that count events rather than people, are kept. Deleted data can remain in a backup for up to 14 days.
What happens if there is a security incident?
Encryption reduces the impact of some compromise scenarios but does not make a breach harmless. Delist investigates incidents and will provide legally required notices. The effect depends on which systems and records are involved.
Does Delist use third-party service providers?
Yes. Delist uses providers for hosting and storage, payments, email, search, breach lookup, page retrieval, and automated analysis. It also sends identifying information to removal targets when needed to process an opt-out. Delist does not sell personal information or share it for third-party advertising.
Is Delist SOC 2 certified?
No SOC 2 report or independent penetration-test report is currently published for Delist. The service has internal security reviews and automated security tests, but those are not substitutes for independent assurance.
Start with your own exposure.
See where your personal data appears with a free scan. Removal work requires a paid plan and your authorization.