Privacy Policy

Effective date: [EFFECTIVE DATE]

This policy explains what personal information Umbrella Net LLC ("FullReveal", "we", "us") collects, why, who we share it with, how long we keep it, and the rights you have. It covers two groups of people:

• Customers and visitors: people who use fullreveal.ai.
• People who appear in results: people whose information shows up in our search results, reports and public phone number pages.

Umbrella Net LLC, a [JURISDICTION] limited liability company at [REGISTERED ADDRESS], is responsible for your personal information (the "controller" under EU and UK law).

1. Summary

• We collect what you give us, what your device sends us, and what our payment processor tells us about your payments.
• We get information about people who appear in results from licensed third-party data providers and from public sources.
• We do not sell our customers' search history.
• We do share some customer data with advertising partners to measure our ads. You can opt out on our Do Not Sell or Share page.
• The person you search for is not told that you searched.
• If you appear in our results, you can ask us to stop showing your details on our opt-out page.

2. Information about customers and visitors

What you give us

• Account details. Your email address, and your name and profile picture if you sign in with Google. Your language and region settings.
• Searches. The phone numbers, email addresses, VINs, names, locations and images you enter, and the items you choose to monitor.
• Comments. Comments you post on public phone number pages, with the category you choose.
• Messages to us. What you send to support, including opt-out and privacy requests.
• Purchase records. The price, billing terms and charge note shown to you at checkout, and the date and time you completed the purchase.

What we collect automatically

• Device and usage data. IP address, browser and device type, pages you view, buttons you click, the referring page, and errors your browser reports. We store this in our own database. We also measure site use with Google Analytics, loaded through Google Tag Manager. We do not use any other third-party analytics service or any error monitoring service.
• Approximate location. Country, region and city, worked out from your IP address. We use it to show prices in your currency and to apply the right rules for your region. We do not collect precise location.
• Advertising data. If you arrive from an ad, the ad click identifier (for example Google's gclid) and the campaign details in the link.
• Cookies and similar technologies. See Section 11.

What our payment processor tells us

Stripe processes your payments. We do not see or store your full card number. Stripe tells us your card brand, the last four digits, the expiry date, your billing country and postal code, and whether each payment succeeded, failed, was refunded or was disputed.

What we create

• Your plan, payments, credits and refunds.
• The reports you unlock, your search history and your monitoring alerts.
• Records of opt-out and privacy requests and how we handled them.

3. Information about people who appear in results

What we show

Depending on the search and what our sources hold, a report may include:

• names and other names used;
• phone numbers and email addresses;
• current and past city or address;
• age range;
• employer and job title;
• public social media and online profiles and usernames;
• whether an email address appears in known data breaches (we show the name and date of the breach, not passwords or other breached contents);
• carrier, line type and location area for a phone number;
• for an image search, public web pages where a matching image appears;
• information we generate: how likely each record is to match the search, a risk rating and an automated summary.

VIN lookups return information about vehicles, not about people. [CONFIRM: no owner name or address in VIN reports.]

Where it comes from

• Licensed third-party data providers. Companies that license identity, contact, phone, email, breach and vehicle data to us.
• Public sources. Public websites and online platforms, and government vehicle databases.
• Our own processing. We combine and compare records from these sources to estimate which records belong to the same person.
• Our users. Comments posted on public phone number pages.

What we do not show

• We do not show Social Security numbers, financial account numbers, health information, or precise real-time location. [VERIFY: provider fields that could contain sensitive data are filtered before display or storage.]
• We do not show reports about people we believe are under 18.
• For phone numbers and email addresses in the European Union, the United Kingdom and Switzerland, we do not show the owner's name, address or other personal details. Results are limited to checks such as validity, carrier, line type and country and, for email addresses, known data breaches and public platform registrations.

How we handle it

We fetch most information from our sources when a customer searches. We keep the resulting reports in the account of the customer who unlocked them. We keep a list of phone numbers with basic number information (carrier, line type, area, spam reports and comment counts) for our public phone number pages.

4. How we use personal information

We use personal information to:

• provide searches, reports, monitoring, PDFs and public phone number pages;
• create and manage accounts, take payments, add credits and process refunds;
• send emails about your account and purchases (receipts, trial details, cancellation confirmations and monitoring alerts);
• answer support, opt-out and privacy requests;
• block searches about minors and prevent misuse, fraud and payment disputes;
• moderate comments;
• measure and improve our ads and our website;
• meet legal, tax and accounting duties, and defend legal claims.

We do not use your searches or the reports you unlock to train AI models.

5. Automated processing

We use automated systems to:

• estimate how likely each record is to match a search;
• decide whether a search is likely to return full, limited or no results, before you pay;
• detect searches that may involve a person under 18, and block them;
• produce the risk rating and the short written summary in a report;
• review comments for spam and abuse.

These systems can be wrong. We do not use them to make decisions that have a legal or similarly significant effect on the people who appear in results. Our Terms forbid customers from using reports for decisions about employment, housing, credit, insurance and similar matters.

6. Who we share personal information with

We share personal information only with these categories of recipients:

[COUNSEL/ENGINEERING: lookup data is also sent to a decision API (Jev) and a text model (via OpenRouter) to produce match probabilities and the written summary. Either add an "AI processing providers" row or confirm no personal data reaches them.]

Our service providers may use the information only to provide services to us, under contracts that require them to protect it.

7. How long we keep personal information

When we no longer need personal information, we delete it or make it anonymous.

8. Security

We protect personal information with encryption in transit, access controls and limited staff access. Payment card details are handled by Stripe and never stored on our systems. No system is perfectly secure. If a breach affects your personal information, we will tell you and the authorities when the law requires it.

9. Your searches are private

• We do not tell the person you search for, or anyone else, that you searched. [VERIFY: no data provider or public-source check notifies the subject, for example through account-recovery emails.]
• We may count how often a phone number is searched and show the total on its public page. We never show who searched.
• We may disclose search records if the law requires it, as described in Section 6.

10. Your choices

• Marketing emails. We only send marketing emails if you agree. Every marketing email has an unsubscribe link. Account emails, such as receipts, are not marketing.
• Advertising measurement. Use our Do Not Sell or Share page, the cookie settings link in the footer, or a browser signal such as Global Privacy Control.
• Your account. You can see your searches and reports in your account and close your account from Settings.

11. Cookies and similar technologies

You can also block cookies in your browser settings, but parts of the site may then stop working.

12. EU and UK privacy rights (GDPR and UK GDPR)

This section applies if you are in the European Economic Area (EEA), the United Kingdom or Switzerland, or if we process your personal information in a way covered by those laws.

Our legal reasons for using personal information

You can ask us for more detail about how we balanced our legitimate interests against your rights.

Your rights

You have the right to:

• access the personal information we hold about you and get a copy;
• correct information that is wrong or incomplete;
• delete your information;
• restrict how we use it;
• object to our use of it based on legitimate interests, including to the display of your information in results;
• data portability, to get information you gave us in a machine-readable format;
• withdraw consent at any time, where we rely on consent (this does not affect what we did before);
• not be subject to decisions based only on automated processing that have legal or similarly significant effects on you.

To use these rights, email [PRIVACY EMAIL] or use our opt-out page. We reply within one month. We may ask you to confirm your identity. We will not charge you.

Data protection officer and representatives

• Data protection contact: [DPO NAME OR ROLE], [DPO EMAIL]
• EU representative (Article 27 GDPR): [EU REPRESENTATIVE NAME AND ADDRESS]
• UK representative (Article 27 UK GDPR): [UK REPRESENTATIVE NAME AND ADDRESS]

Complaints

You can complain to the data protection authority in the country where you live or work, or where you think the problem happened. In the UK, that is the Information Commissioner's Office (ico.org.uk). In Switzerland, it is the Federal Data Protection and Information Commissioner (FDPIC). We would like the chance to fix the problem first, so please contact us at [PRIVACY EMAIL].

International transfers

We are based in the United States, and our service providers process data in the United States and other countries. When we transfer personal information out of the EEA, UK or Switzerland, we use [TRANSFER MECHANISM: e.g. EU Standard Contractual Clauses, UK International Data Transfer Addendum, EU-US Data Privacy Framework certification of the recipient]. You can ask for a copy at [PRIVACY EMAIL].

13. California privacy rights (CCPA and CPRA)

This section applies to California residents. It adds to the rest of this policy.

Personal information we collected in the last 12 months

About customers and visitors

About people who appear in results

We do not knowingly collect, sell or share the personal information of consumers under 16.

Sensitive personal information. We do not intend to collect sensitive personal information as defined by the CCPA, and we do not use or disclose it to infer characteristics about anyone. [VERIFY against provider fields.]

Retention. See Section 7.

Purposes. See Section 4.

Your rights

You have the right to:

• know what personal information we have collected about you, where it came from, why we use it, and who we disclosed, sold or shared it to;
• access a copy of the specific pieces of personal information we hold about you;
• delete personal information we collected;
• correct inaccurate personal information;
• opt out of the sale and sharing of your personal information;
• limit the use of sensitive personal information (we do not use sensitive personal information for purposes that give rise to this right);
• not be discriminated against for using these rights.

Do Not Sell or Share My Personal Information

Use our Do Not Sell or Share My Personal Information page. We also treat a Global Privacy Control signal from your browser as a valid request to opt out of sharing for that browser. If you appear in our results, the page explains how to stop us selling your information to our customers.

How to make a request

• Online: our Do Not Sell or Share page or our opt-out page
• Email: [PRIVACY EMAIL]
• Toll-free phone: [PRIVACY PHONE]

For requests to know, access, delete or correct, we confirm your identity by matching information you give us with information we hold. For customers, this usually means confirming access to the email address on your account. We do not need to verify your identity to opt you out of sale or sharing, but we may ask for the details we need to find your information. We respond to requests to know, access, delete and correct within 45 days, and to opt-out requests within 15 business days.

Authorized agents

You can use an authorized agent to make a request for you. We will ask the agent for your signed permission, and we may ask you to confirm your identity with us directly, unless the agent has a valid power of attorney.

Non-discrimination

We will not deny you the Service, charge you a different price or give you a different level of service because you used your privacy rights.

Request metrics

[DATA BROKER REQUEST METRICS: number of requests to delete, know and opt out received, complied with and denied in the previous calendar year, and median response time. Required for registered data brokers; publish by 1 July each year.]

14. Other US state privacy rights

Residents of other US states with privacy laws, including Colorado, Connecticut, Oregon, Texas and Virginia, have similar rights to access, correct, delete and get a copy of their personal information, and to opt out of the sale of personal information and targeted advertising. You can use the same methods described in Section 13. If we deny your request, you can appeal by replying to our decision or emailing [PRIVACY EMAIL] with "Appeal" in the subject line. If we deny your appeal, you can contact your state attorney general. [COUNSEL: confirm state list against current thresholds.]

15. Data broker registration

[DATA BROKER REGISTRATION: list registrations, for example the California Privacy Protection Agency data broker registry, Vermont, Texas and Oregon, with registration numbers, once filed.]

California residents can also ask all registered data brokers to delete their personal information at once through the California Delete Request and Opt-out Platform (DROP) run by the California Privacy Protection Agency. [VERIFY current DROP name, URL and our processing duties before publishing.]

16. Children

FullReveal is for adults. You must be 18 or over to use it. We do not knowingly collect personal information from children, and we do not provide reports about people under 18. If you believe we hold information about a child, email [PRIVACY EMAIL] and we will delete it.

17. Changes to this policy

We may update this policy. We will show the new effective date at the top. If a change materially affects how we use your personal information, we will email customers before it takes effect.

18. Contact

Umbrella Net LLC [REGISTERED ADDRESS]

• Privacy email: [PRIVACY EMAIL]
• Privacy phone (toll-free): [PRIVACY PHONE]
• Data protection contact: [DPO EMAIL]
• General support: [SUPPORT EMAIL]