Privacy Policy

Am I Being Pwned? is operated by Bay Area Labs Inc, a Delaware corporation, file number 10635754, of 192 Bear Christiana Road, Bear, DE 19701, USA. References to "we", "us", or "our" in this policy refer to Bay Area Labs Inc.

For your account and our website, we are the controller. For the fleet data your organization sends us (its devices, browsers, extensions and users), your organization is the controller and we process that data on its behalf.

If you have any questions about this policy or how we handle your data, get in touch via our contact form.

We collect only the data necessary to provide our service.

Free extension scan

When you run a free scan, your browser extension IDs are sent to our server and matched against our threat intelligence database. We do not store the list, or your name, email address or IP address.

Free Google Workspace scan

When a Google Workspace admin runs our free organization scan, we store:

• The Google account email that granted access
• The Workspace tenant ID
• Encrypted Google access tokens, kept until access is revoked
• The tenant's extensions, with install counts
• An admin's email address, if you ask us to send the scan to them

We use these to show the results, re-run the scan, and send the results and setup emails you asked for. Each email has an unsubscribe link.

Account registration

If you create an account, we collect your work email address and name. You sign in with an emailed link, with Google, or with a passkey. We never see your Google password, and a passkey never leaves your device. For each signed-in session we keep the IP address and browser it came from, so you can see and revoke your sessions.

Forms, newsletters and notifications

• Contact and interest forms: your name, email, company and message
• Blog email subscriptions: your email address
• Blog push notifications: the push endpoint your browser gives us
• Feedback sent from the dashboard: your message, name and email
• Shared report links: when a link is opened, a hashed IP address and the browser's user agent

Organization fleet monitoring

Our browser extension reports the following for each enrolled browser:

• A random device identifier the extension creates on install
• Browser, operating system and CPU architecture
• Each installed extension's ID, name, version, install type and enabled status
• The email address of the signed-in browser profile, if there is one and the browser shares it (not Firefox)

If your administrator connects other sources, we also receive:

• Google Workspace: your tenant's managed browsers and devices, their extensions, and directory users' work email addresses
• SentinelOne: each agent's computer name, serial number, operating system, last logged-in user, external IP address, MAC addresses and installed browser extensions. With File Fetch, the agent uploads each browser's settings files; we read the extension list out of them and never store the files themselves
• Our endpoint collector script: a machine identifier, hostname and operating system, and for each browser profile the OS username and installed extensions

Each of these is switched on by your administrator and can be disconnected at any time.

We do not collect browsing history, form data, keystrokes, credentials, or any content from web pages your employees visit.

• To match extension IDs against our risk intelligence database and generate security reports.
• To operate, maintain, and improve the service.
• To send transactional communications such as alert notifications and security findings.
• To comply with legal obligations.

We do not sell your data, use it for advertising, or share it with third parties except as described in section 5.

If you are located in the European Economic Area or United Kingdom, we rely on the following legal bases:

• Contract - processing your data to provide the service you have requested.
• Legitimate interests - improving service security and reliability, where those interests are not overridden by your rights.
• Legal obligation - where we are required to process data by applicable law.
• Consent - analytics cookies on this website, which load only if you accept them. You can withdraw consent at any time by declining cookies.

We do not sell, rent, or trade your personal data. We do not share it with advertisers, data brokers, or any third party for their own purposes. The only circumstances in which data is ever disclosed are:

• Service providers - Cloudflare (hosting, compute, database and email delivery) and PostHog (product analytics, see section 8). These are our only subprocessors, listed with what each receives on our subprocessors page. They process data on our behalf to operate the service.
• Legal requirements - if we receive a valid legal order requiring disclosure, we will comply. Where permitted by law, we will notify affected users before responding.
• Continuity of service - if the business is acquired or restructured and the service continues to operate, data may transfer to the new operator solely to keep the service running. Any new operator would be required to honor the commitments in this policy. We will give users advance notice and the option to delete their data before any such transfer takes effect.

We retain personal data only as long as necessary to provide the service or as required by law.

• Free extension scans are not stored.
• Free Google Workspace scans are kept until access is revoked or you ask us to delete them.
• Account data is kept until you ask us to delete it, via our contact form.
• When your subscription ends, or whenever you ask, we delete your organization's fleet data within 30 days of the request.
• Deleted data remains in our database backups for up to 30 days, then is gone.

Our databases are stored in the European Union. Requests are served by Cloudflare's global network, so a request may be handled at the data center nearest you on its way there. Where personal data is accessed from outside the EEA, we rely on an adequacy decision or Standard Contractual Clauses. We use industry-standard encryption in transit (TLS 1.2+) and at rest, and integration credentials are separately encrypted with AES-256-GCM before they are stored. Access to production systems is restricted to authorized personnel only.

If your data is involved in a security incident, we notify affected customers within 24 hours of confirming it, inside the 72-hour window GDPR Article 33 allows you as controller. See our security page for what that notice contains.

If you believe you have found a security vulnerability in our service, please disclose it responsibly to security@amibeingpwned.com.

We use a session cookie to keep you signed in when you have an account. We do not use advertising cookies or third-party tracking pixels, and we do not use Google Analytics.

We use PostHog, hosted in the EU, for product analytics. On this website it only loads if you accept cookies. In our app and extension it records usage and session recordings, with sensitive fields masked.

Data is not shared with advertising networks. To opt out on this website, decline cookies. For anything else, contact us via our contact form.

Depending on your location you may have the following rights regarding your personal data:

• Access the data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict certain processing
• Data portability (where applicable)

To exercise any of these rights, use our contact form. We will respond within 30 days.

If you are in the EEA or UK and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

Our service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, contact us and we will delete it promptly.

Am I Being Pwned?'s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use and transfer of raw or derived user data received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google Workspace API data only to provide and improve the user-facing features of the Service, namely enumerating the browser extensions installed across your fleet, attributing them to the devices and users in your directory, and applying the extension policies your administrator configures.
• We do not transfer this data to others except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with the notice and consent described in section 5.
• We do not use this data for serving advertisements, including retargeting, personalized, or interest-based advertising, and we never sell it.
• We do not allow humans to read this data unless we have your explicit consent for specific messages, it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and anonymised for internal operations.

We may update this policy from time to time. Before a material change takes effect, we will update the "Last updated" date at the top and email account owners at least 30 days in advance. Continued use of the service after the effective date constitutes acceptance of the updated policy.