Privacy Policy

This policy applies to information we collect when you visit find-red-flags.com, create an account, run a search, buy a membership or an add-on, or contact us. It also applies to information about a Subject — the person a search is run on — because a Subject’s details pass through the Service on your instruction and are stored with your Report.

Where this policy says “you”, it means the person using the Service. Section 10 speaks to Subjects directly. Questions about this policy go to hello@find-red-flags.com.

Account

Your email address, which is your sign-in. There is no password: we send a link or a code to that address. We record when you sign in and the browser you signed in from. An account created through the funnel is also linked to the answers described next.

What you type

The quiz answers (for example, whom you are searching and why), and the identifiers you search — a name, a phone number, an email address, or a photograph. Until a search runs, this draft lives in your browser’s session storage, with one exception: when you ask for the sign-in email on the signup page, a copy of the draft — your answers, the identifiers you entered including any photograph, the ad click identifier and analytics identifiers already in your browser, the time the email was sent, and the email address you typed — is held on our servers for up to 24 hours so that the link in that email can reopen your case file in whichever browser opens it, and so that the page can tell you whether our email provider reported that email as delivered, delayed or bounced. The copy is deleted after 24 hours whether or not the link was used. Once you run the search, the identifiers are stored with your Report. Your answer to the relationship question is also attached to your account and to your analytics profile so we can understand how the Service is used.

Payments

Payments are processed by Stripe. Your card number and security code go directly to Stripe and never reach our systems. Stripe gives us a customer identifier, your subscription status, your search-credit balance and invoice records, and the billing details you enter — your name, country and, where a card form asks for one, postal code — which we use for receipts and, in hashed form, for the advertising measurement described in Section 6. We also record which introductory price you were offered, because we test prices.

Technical data

Like every website, we receive your IP address, browser and device type, operating system, language, the pages you open, the links you arrive from, timestamps, and an approximate location derived from your IP address. Our API uses your IP address to limit abuse. If you arrive from an ad, we keep the click identifier the ad platform appends to the address.

Correspondence

Anything you send us by email, including a privacy request, a misuse report, or a billing question.

When you run a search, the identifiers you provide are sent to our search-data providers, and what they return — public profiles and usernames, photographs and where they appear, locations and timelines a source reported, records of data breaches that included an email address or phone number, and, if you order a registry check, possible matches in public sex-offender registries — is assembled into your Report and stored with it, together with the photograph you uploaded (as a reduced-size copy).

This information is used to run and display your search, to let you reopen the Report from your archive, to produce a case-file document if you buy one, and to investigate misuse. We do not combine Reports into a searchable database of people, we do not sell or license information about Subjects to data brokers, advertisers or anyone else, and a Report is delivered only to the account that ran it. We do not notify a Subject that a search was run.

A photograph is used for a face search only: it is transmitted to a face-matching provider, which derives a representation of the face shown and compares it against publicly available images. Neither we nor, according to its terms, the provider keeps a database of faces built from those uploads; the provider states that the extracted face data and cached results are deleted shortly after the search completes. The photograph itself stays with your Report as described in Section 8.

Search results are what third-party sources reported. They may be inaccurate, outdated or about a different person, and the Terms of Service restrict how they may be used.

• Providing the Service — creating and signing in to your account, running searches, assembling and storing Reports, and sending the emails the Service needs, such as sign-in links and receipts.
• Billing — charging memberships and add-ons, managing search credits, renewals, cancellations, refunds and disputes.
• Security and enforcement — limiting abuse, detecting fraud, investigating reports of misuse, and enforcing the Terms, including the rules against stalking, harassment and searching for minors.
• Understanding and improving the Service — analytics about how the pages are used, error monitoring, and tests of alternative designs and prices.
• Advertising measurement — telling the platforms on which we advertise that a visit or a purchase happened, so we can measure and adjust our advertising (Section 6).
• Legal obligations — keeping tax and accounting records, responding to lawful requests, and protecting our rights and the safety of others.

We do not use information about Subjects for any purpose other than running and displaying the search you asked for and investigating misuse.

The Service stores the following in your browser:

• Your sign-in session — kept in local storage so you stay signed in; removed when you sign out.
• Your unfinished case file — the quiz answers and identifiers you have entered, kept in session storage until the search runs or the tab closes.
• Your signup email request — after you ask for the sign-in email on the signup page, the address you typed, the time it was sent, a reference to the server copy described in Section 2 and, once our email provider reports it, whether that email was delivered, delayed or bounced, kept in session storage so the page can return to the right screen after a reload; removed when you sign in or out, or when the browser session ends.
• Ad click identifiers — the identifier appended to the address when you arrive from a Meta or TikTok ad, kept in local storage for up to 90 days so a later purchase can be matched to the ad.
• Small markers — for example, that a notice has already been shown to you, so it is not shown again.
• PostHog — a cookie and local storage that identify your browser to our analytics and error monitoring.
• Meta and TikTok — cookies set by their pixels (such as Meta’s _fbp and _fbc and TikTok’s _ttp) that identify your browser to those platforms for advertising measurement.
• Stripe — cookies set inside the payment form for fraud prevention.

You can clear or block storage and cookies in your browser settings. Blocking the sign-in session or the case-file draft will stop the Service from working; blocking the analytics and advertising cookies will not. Section 9 explains how to opt out of advertising measurement with us directly.

We advertise on Meta’s platforms and on TikTok. To measure whether those ads work, their pixels run on our pages and our servers send those platforms conversion events — that a page was viewed, a quiz was started or completed, an account was created, a payment form was opened, or a purchase was made — together with the information they use to match the event to an ad: a hashed version of your email address, a hashed account identifier, the ad click identifier, your IP address and browser type, the page address, and, for a purchase, its amount and a hashed version of the billing name, postal code and country that Stripe holds.

We never send those platforms anything about a Subject — not a name, a number, an address, a photograph, a quiz answer or a result — and we never send them the words that describe what a search is about. The platforms use what they receive under their own privacy policies, which may include improving the delivery of our ads and their own services.

Under some laws, including California’s, this is a “sale” or “sharing” of personal information for cross-context behavioral advertising. You can opt out at any time: email hello@find-red-flags.com from the address on your account, and we will stop sending events tied to you. You can also limit ad tracking in your browser, and in the ad settings of your Meta and TikTok accounts.

• Service providers — the companies that host our website and API, run our database and sign-in service, process payments (Stripe), deliver our emails, and provide analytics and error monitoring (PostHog). They process information on our behalf under contracts that restrict its use.
• Search-data providers — an open-source intelligence provider (which also supplies data-breach records), a face-matching provider, and a sex-offender-registry search provider. They receive the identifiers a search names, and only those, in order to answer it, and they process them under their own terms. Some are located outside your country.
• Advertising platforms — Meta and TikTok, as described in Section 6.
• Legal, safety and enforcement — law enforcement, courts, regulators, or a person we believe in good faith is being harmed, where we believe the law requires or permits it; and anyone we need to involve to enforce the Terms or protect our rights.
• Business transfers — a successor in a merger, acquisition, financing or sale of assets, who will be bound by this policy for the information transferred.
• At your direction — for example, anyone you give a downloaded case-file document to.

We do not sell your personal information or a Subject’s for money, and we do not share it with data brokers.

• Your account and Reports — for as long as your account exists. Ask us to delete them at any time (Section 9). When an account is closed, its Reports, including the identifiers and photographs they hold, are deleted with it, except where we must keep a record for the reasons below.
• The case-file draft — in your browser until the search runs or the browser session ends; and, once you ask for the signup email, a copy on our servers for 24 hours so the emailed link can reopen it, deleted after that whether or not the link was used.
• Sign-in links and codes — valid for one hour and for a single use.
• Payment and billing records — for as long as tax, accounting and dispute-handling rules require, in our systems and Stripe’s.
• Analytics and error data — for a limited period set in our analytics tool, after which it is deleted or aggregated.
• Misuse records — where an account was closed for misuse, we may keep what is needed to prevent the account from being reopened and to respond to authorities.
• Backups — deleted information may persist in backups for a limited time before it is overwritten.

Whatever the law where you live provides, you can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct information that is wrong;
• delete your account, your Reports, or particular information, except what we must keep for legal or dispute-handling reasons;
• stop advertising measurement tied to you (Section 6);
• export your Reports — a case-file document can be downloaded from any Report you own, and we can provide your information in a portable form on request.

To make a request, email hello@find-red-flags.com from the email address on your account, or tell us which address that is; we verify requests through that address and may ask for more detail before acting. An authorized agent may act for you if you confirm the authorization to us. We answer within 45 days, and sooner where the law requires; if we need longer, we will say so. We will not treat you differently for exercising a right.

You can cancel your membership at any time from the Settings page, and you can close your account by emailing us.

If you believe someone has run a search on you, you have the same rights as an account holder over the information we hold about you, and you can exercise them by emailing hello@find-red-flags.com. We will ask you to confirm the identifier that would appear in a search — for example, by replying from the email address concerned or verifying the phone number — and nothing more than we need to find and act on the information.

On a verified request we will tell you whether your identifiers appear in any stored Report, delete the information about you from our systems, and suppress those identifiers so that a later search of them by the same account returns nothing from us. We do not disclose who ran a search except where the law requires it.

A Report shows what public and third-party sources reported. We cannot remove information from those sources; the site or registry that published it is the place to correct it, and every registry match links to its official source. If you believe you are being stalked or harassed with the help of the Service, tell us at hello@find-red-flags.com — we investigate every report and cooperate with law enforcement.

This section adds the disclosures the California Consumer Privacy Act requires. In the past 12 months we have collected these categories of personal information: identifiers (email address, account identifier, IP address, browser identifiers, and the identifiers you search); commercial information (memberships, add-ons, invoices); internet activity (pages viewed and interactions); approximate geolocation (from IP address); audio or visual information (a photograph you upload); sensitive personal information (the facial representation a face search derives from that photograph, processed by our provider); and, for Subjects, the professional, social and public-record information a search returns. Sources: you, your browser, Stripe, our search-data providers and public sources. Purposes: those in Section 4.

We disclose identifiers and internet activity to our service providers, and the identifiers you search to our search-data providers, for business purposes. We “share” identifiers and internet activity with Meta and TikTok for cross-context behavioral advertising (Section 6); we do not otherwise sell personal information, and we do not knowingly sell or share the personal information of anyone under 16. We use sensitive personal information only to perform the search you request, and not to infer characteristics about anyone.

You have the right to know, to delete, to correct, to opt out of sale or sharing, to limit the use of sensitive personal information, and not to be discriminated against for exercising those rights. Exercise them through Section 9; the email there is also how to opt out of sharing. We do not offer financial incentives in exchange for personal information.

If you live in Canada, the European Economic Area, the United Kingdom or another place whose privacy law gives you rights of access, correction, deletion, portability or objection, those rights are available to you through Section 9, and you may complain to the privacy regulator where you live. Where a law requires a legal basis for processing, ours are: the contract with you (providing and billing the Service), our legitimate interests (security, enforcement, improving the Service, and measuring our advertising), your consent where the law requires it, and our legal obligations. You may withdraw consent at any time; doing so does not affect processing that already happened.

The Service is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If we learn that we have, we delete it. The Terms prohibit searching for a person you know or believe to be a minor; our face-matching provider rejects images that appear to show a child, and we close accounts that try. If you believe a minor’s information has reached us, email hello@find-red-flags.com.

Every connection to the Service is encrypted. Sign-in uses a link or code sent to your email address rather than a password, so there is no password to leak. Card details are entered directly into Stripe’s payment form and handled under the payment-card industry’s security standards. Access to stored information is limited to what operating the Service requires, and neither our analytics nor our logs carry the identifiers a search names.

No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. Keep the mailbox on your account secure: anyone who can open your sign-in link or code can open your account, and a signup email’s link can also reopen the case-file copy it refers to. If a breach affects your information, we will notify you and the authorities as the law requires.

Our service providers and search-data providers process information in the United States and in other countries where they operate, and the privacy laws of those countries may differ from those where you live. Wherever the information goes, we require our providers to protect it appropriately, and it remains subject to lawful access requests in the country where it is processed. By using the Service, you understand that your information — and a Subject’s — may be transferred to and processed in those countries.

We may revise this policy as the Service, our providers or the law change. If a change is material, we will give notice before it takes effect — by email to the address on your account or by a notice in the Service — and the effective date at the top of this page will change. Your continued use of the Service after a change takes effect means the updated policy applies.

Questions about this policy, requests under Sections 9 and 10, and reports of misuse go to hello@find-red-flags.com. Put “Privacy request”, “Subject request” or “Misuse report” in the subject line so it reaches the right place quickly.