LEGAL / PRIVACY
PRIVACY
BY DESIGN.
LAST UPDATED 10 SEPTEMBER 2026
Who controls your data
Black Bot is operated by NSOLR Ltd, company number 15950192, of 101 Alverthorpe Road, Wakefield, West Yorkshire, United Kingdom, WF2 9PQ. NSOLR Ltd is registered with the Information Commissioner's Office under reference ZC215663. For privacy questions or rights requests, contact hello@blackbot.co.uk.
Website analytics and cookies
On blackbot.co.uk, Google Analytics 4 is optional. It is not loaded unless you select “Accept analytics”. If you consent, Google may process page views, approximate location, device and browser information, referral or campaign details, and interactions such as App Store, privacy guide, pricing, support and contact clicks. We use this information to understand which campaigns and guides bring useful visits and whether the website helps people reach the App Store. Your choice is stored in your browser and can be changed using the Cookie settings link in the website footer. We do not send the email addresses or mobile numbers you enter in the Black Bot app to Google Analytics.
What Black Bot processes
We process the account identifier and profile details supplied by your chosen Apple, Google or Firebase email sign-in method. We process only email addresses and mobile numbers that you verify or are authorised to manage. A scan can return breach-source names, data-category summaries, public-result URLs and snippets. Removal requests can include progress dates and notes you choose to record.
Why we process it
We use this information to create and secure your account, verify ownership, perform scans you request, show results, maintain your encrypted on-device history, assist removal requests, administer subscriptions, prevent misuse and meet legal obligations. Account and subscription processing is necessary to provide the service. Each scan also requires your specific confirmation before the verified detail is shared with the named providers. Security and abuse-prevention processing is based on our legitimate interests.
Providers and what they receive
Firebase Authentication and your selected Apple or Google sign-in service process account and session identifiers. Resend receives an email address when you request an email verification code. Twilio receives a mobile number when you request SMS verification. Brave Search receives the exact verified detail as part of public-website and selected data-broker searches. LeakCheck receives only the first 24 characters of the SHA-256 hash of a normalised email address, not the full address. If you connect Private Email, SimpleLogin receives the API key you provide, requested alias labels and your requests to list, create or pause aliases. Current app versions send those requests directly from your device to SimpleLogin; Black Bot's API does not receive the key. RevenueCat and the relevant app store process subscription identifiers and purchase status. Expo provides application hosting and release infrastructure.
Storage and retention
Your verified emails and numbers are protected using device-secure storage. A SimpleLogin key you choose to connect is encrypted in device-secure storage and removed when you disconnect Private Email or delete your Black Bot account. Results, website links, removal requests, notes and protection-step state are encrypted on your device using AES-256-GCM with a key held in secure device storage. Black Bot's scan API processes the verified detail temporarily and does not keep a Black Bot database of scan targets or report history. Verification, authentication, search, hosting and payment providers retain operational records under their own policies. You can remove a verified detail, its results and removal history, or delete the account through the app, subject to operational, security and legal retention requirements.
International processing
Some providers may process information outside the United Kingdom. Where NSOLR Ltd is responsible for such a transfer, we use the safeguards required by UK data-protection law. Provider privacy notices explain their locations and transfer mechanisms.
Your rights
UK data-protection law may give you rights to access, correct, erase, restrict or object to processing, and to request portability. Where processing is based on consent, you can withdraw it without affecting earlier lawful processing. We may need proportionate information to confirm your identity before completing a rights request.
Complaints
Please contact us first so we can try to resolve your concern. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.
Children
Black Bot is not intended for children under 16.
Changes
We review this notice when the service, its providers or the law materially changes. The updated date above shows the current version.