Privacy Policy

Last updated: 28 July 2026

1. Who we are

Smudge's Cyber Security Club ("we", "us", "our") operates smudgescybersecurityclub.com, a consumer data-protection service that helps people find out what the internet knows about them and, where possible, get it removed. We are the data controller for the personal data described in this policy.

If you have any questions about this policy or how we handle your data, contact us at support@smudgescybersecurityclub.com.

2. What data we collect

We collect the minimum amount of data needed to run a breach check, deliver a report, or provide the service you've asked for. Depending on which part of the site you use, this can include:

• Contact details: your first name and email address, so we can send you your free breach check result or a paid report.
• The email address you submit for scanning: this is looked up against breach and exposure databases to tell you what's been found. We do not store the password you may be checking; password strength checks are performed and the password itself is not retained.
• Payment information: handled directly by Stripe, our payment processor. We never see or store your full card details.
• Technical data: IP address and basic browser information, collected automatically as part of normal website operation and fraud prevention.
• Membership and case data: for Tier 2 (data clean-up), Tier 3 (membership) and Tier 4 (Shield/Vault) customers, we may collect additional information needed to carry out removal requests, assessments, or monitoring, such as details of your online accounts and public-facing profiles that are the subject of the work.
• Enquiry details: if you contact us through a form (for example the Cover waitlist or the Smudge Black enquiry form), we collect what you choose to tell us, such as your name, email, and any message.

3. Third-party tools we use

To check whether your data has been exposed, we query specialist breach-intelligence and OSINT providers, including Have I Been Pwned (HIBP), EmailRep, DeHashed, BreachDirectory, Intelligence X (Intelx.io), and Epieos. When you submit an email address for a free or paid check, that address is sent to the relevant provider(s) to be checked; we do not control what those providers do with a lookup request beyond returning a result to us, and we choose reputable providers with their own privacy commitments.

We also use the following processors to run the business:

• Google Sheets: to log leads and report/order details internally.
• Stripe: to process payments securely.
• Netlify: to host the website and run backend functions.
• Resend: to send transactional emails, such as report delivery or lead notifications.

4. Why we process your data

We rely on the following legal bases:

• Contract: to provide the report, clean-up, membership, or assessment you've purchased.
• Consent: for the free breach check and marketing communications, which you can withdraw at any time.
• Legitimate interests: to keep the service secure, prevent fraud, and improve what we offer.
• Legal obligation: for example, keeping records required for tax and accounting purposes.

5. How long we keep it

We keep personal data only for as long as we need it for the purpose it was collected. Lead and order records are generally kept for as long as your account or membership is active, plus a reasonable period afterwards to meet our legal and accounting obligations. You can ask us to delete your data sooner, subject to the exceptions in section 9.

6. Who we share it with

We share personal data with the processors listed in section 3, each of whom is only given the data they need to do their job. We do not sell your personal data. We may disclose data where required by law, to protect our rights, or in connection with a business transfer.

7. International transfers

Some of the providers we use (including Stripe, Netlify, Google, and Resend) are based outside the UK, primarily in the United States. Where we transfer personal data internationally, we rely on the providers' standard contractual clauses or equivalent safeguards recognised as providing an adequate level of protection.

8. How we protect it

We use technical and organisational measures appropriate to the sensitivity of the data we handle, including encrypted connections, restricted access to lead and case data, and working only with reputable third-party processors. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Your rights

If you are in the UK or EU, you have the right to:

• Access the personal data we hold about you.
• Ask us to correct inaccurate data.
• Ask us to delete your data ("right to be forgotten").
• Object to or restrict certain processing.
• Withdraw consent at any time where we rely on consent.
• Complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you think we've mishandled your data.

To exercise any of these rights, email support@smudgescybersecurityclub.com.

10. Children's data

Our services are intended for adults. Our education content is designed to be useful to families and, in places, aimed at helping parents teach children about online safety, but our reports, clean-up, and membership services are not directed at children, and we do not knowingly collect personal data from children under 13.

11. Cookies

We use only the minimal cookies and local storage needed to make the site work, for example, remembering where you are in the free scan flow. We do not use third-party advertising or tracking cookies.

12. Changes to this policy

We may update this policy from time to time. If we make material changes, we'll update the date at the top of this page.

13. Contact us

Smudge's Cyber Security Club
Email: support@smudgescybersecurityclub.com