Privacy Policy

TL;DR: We collect only what's needed to run your scan (name, city, state) and your email for account access. We do not sell your data to anyone. Ever. That's kind of the whole point.

1. Who We Are

Vanish ("we," "us," or "our") is a data broker removal service operated by Polsia Inc. We help individuals discover where their personal data is exposed across the web and remove it from data broker databases.

You can reach us at: privacy@vanish360.com

2. Information We Collect

Scan data (no account required):

First name, last name — used to search data broker databases
City and state — used to narrow search results and reduce false positives

Account data (when you create an account):

Email address — used for authentication and subscription management
Password — stored as a hashed value (bcrypt); we never store plaintext passwords

Payment data:

Payments are processed by Stripe. We do not store your credit card number, CVV, or full payment details. Stripe's privacy policy governs their handling of payment data.

Usage data (automatically collected):

Anonymous visitor ID (stored in a browser cookie as polsia_vid) for session continuity
Page views and feature interactions for product improvement
IP address (not stored long-term; used only for rate limiting and abuse prevention)

3. How We Use Your Information

To perform exposure scans across 210+ data broker databases
To execute removal and opt-out requests on your behalf (subscribers only)
To send transactional emails (scan results, subscription confirmation, renewal receipts)
To monitor for data re-appearances and alert you (subscribers only)
To improve our scan coverage and removal success rates
To detect and prevent fraudulent or abusive activity

We do not use your data for advertising, profiling, or any purpose unrelated to the services above.

4. Data Storage and Security

Your data is stored in encrypted PostgreSQL databases hosted on Neon (SOC 2 Type II certified). Connections use TLS 1.2+ in transit. Sensitive fields (OAuth tokens, passwords) use AES-256-GCM encryption or bcrypt hashing.

Scan data submitted without creating an account is retained for 30 days, then automatically deleted. Account data is retained as long as your account is active, and for up to 90 days after account deletion.

5. We Do Not Sell Your Data

We do not sell, rent, trade, or share your personal information with third parties for their marketing or commercial purposes. We are a privacy company. Selling your data would be antithetical to our entire reason for existing.

6. Third Parties We Work With

We share limited data only with service providers necessary to operate Vanish:

Stripe — payment processing (governed by Stripe's Privacy Policy)
Neon — database hosting (no access to your data beyond storage)
Render — application hosting (no access to your data beyond server operation)
Polsia Inc. — platform infrastructure that powers Vanish

We do not use Google Analytics, Meta Pixel, or any third-party advertising trackers.

7. Cookies

We use a single first-party cookie:

polsia_vid — a random visitor identifier used to stitch together your session across page loads (e.g., connecting your scan to your signup). This is not used for advertising. It expires after 1 year or when you clear cookies.

We do not use third-party tracking cookies.

8. Your Rights (CCPA / GDPR)

Depending on your location, you may have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you
Deletion: Request deletion of your personal data and account
Correction: Request correction of inaccurate data
Portability: Receive your data in a portable format
Opt-out of sale: We don't sell data, so there is nothing to opt out of
Non-discrimination: We will not treat you differently for exercising privacy rights

California residents (CCPA): You have the right to know what personal information we collect, to request deletion, and to opt out of the sale of personal information (we do not sell). Submit requests to privacy@vanish360.com.

EU/UK residents (GDPR): Our lawful basis for processing your data is contract performance (running your scans) and legitimate interest (security, fraud prevention). You may lodge a complaint with your national supervisory authority if you believe we are not handling your data lawfully.

To exercise any of these rights, email privacy@vanish360.com. We will respond within 30 days.

9. Children's Privacy

Vanish is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has submitted data through our service, contact us immediately at privacy@vanish360.com and we will delete it.

10. Data Retention

Anonymous scan data: 30 days, then deleted
Account data: Duration of account + 90 days after deletion
Payment records: 7 years (required for tax/accounting compliance)
Server logs: 30 days, then purged

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top and notify subscribers by email. Continued use of Vanish after changes constitutes acceptance of the updated policy.

12. Contact Us

For privacy-related questions, data requests, or concerns:

Email: privacy@vanish360.com
Website: vanish360.com