Privacy Policy

Last updated 2026-11-14

This Privacy Policy explains how CheckMate.bio (the "Service", "we", "us") processes personal data in connection with our reverse email lookup and digital-footprint reports. By using the Service you confirm that you have read and understood this policy.

1. Who we are

CheckMate.bio is operated by IASolutions. For any privacy-related request, contact us at privacy@checkmate.bio. For general support, write to support@checkmate.bio.

2. Geographic scope: EU, EEA, and UK

The Service is not offered to, and is not intended for, residents of the European Union, the European Economic Area, or the United Kingdom.

We do not knowingly provide the Service to individuals located in the EU/EEA/UK. If you are located in one of these regions, you must not use the Service.

3. What data we process

To operate the Service we process the following data:

  • The email address you search. We send it to our search provider to produce the report and, when you pay, to PayPal as the order reference. We keep it with the search results for the periods in Section 7.
  • The contents of a report: the accounts and profile details our sources find for that email address and for the username in front of the @. A report can include names, usernames, photos, locations, contact details, dates of birth, and details from data-breach records such as breach dates, IP addresses, and password hashes. Passwords from breach records are always masked. Because the sites checked include dating, adult, LGBT, health, and political sites, and profiles can state orientation or ethnicity, a report can reveal sensitive information about the person searched.
  • Your IP address, used for rate limits, the free-search limit, preventing fraud and abuse, and meeting legal obligations.
  • Payment data. PayPal gives us the order ID, capture ID, payer ID, and amount of your payment. For a card payment, including Apple Pay and Google Pay, it also tells us the card's brand, its type (credit, debit or prepaid) and the country of the bank that issued it; we write these to our server logs with the order ID to see why payments get declined. With Apple Pay or Google Pay, your billing name and address are passed to PayPal to process the payment. If PayPal declines a card because it wants a phone number, Apple Pay asks you for a phone number and email on your next try. They go to PayPal, and we do not store them. If PayPal reports a payment that our site did not record, we keep the payer's PayPal email address, the transaction ID, and the amount in a recovery record so that we can deliver what was paid for or refund it. We never see your card number or your PayPal credentials.
  • Bundle data: the bundle code, its remaining searches, the order ID, and the email address the bundle was bought for.
  • Short-lived technical records: a signed unlock token (valid for 15 minutes) and rate-limit counters.
  • Product analytics events that record which actions happened (page view, search submitted, unlock click, payment, error). They carry the domain of the searched email (for example, "gmail.com"), result counts, the plan bought and the payment method used (for example, PayPal or Apple Pay), error messages, and approximate country, never the full email address or the contents of a report. Page addresses are sent without their query string, so the email address in a search link is not included. Analytics providers also receive standard request data such as your IP address, user agent, and referring site.

4. What we do not do

We do not keep a database of searches and do not build profiles of the people searched. Free results are deleted after 10 minutes and paid reports after 24 hours.

We never ask for your passwords and never sign in to anyone's account. We do not obtain private messages, location history, browsing history, or any data that would require bypassing authentication on a third-party service.

5. Third parties we rely on

  • Our search provider, which checks the email address, and the username in front of the @, against online services and data-breach indexes. It receives the email address and, for a paid report, your PayPal payer ID.
  • PayPal: processes payments for the $0.99 report and the $2.99 and $4.99 bundles, including debit or credit card, Venmo, Apple Pay and Google Pay payments. It receives the searched email address as the order reference. PayPal's own privacy policy applies to the transaction.
  • Apple: when you pay with Apple Pay, Apple's own terms and privacy policy apply.
  • Google: when you pay with Google Pay, Google's own terms and privacy policy apply.
  • Google: serves the fonts on every page and the website icons in reports. Like any web server it receives standard request data from your browser; its icon service also receives the domain of each listed site.
  • The sites listed in a report: profile photos load directly from the sites that host them when you view a report or export it as a PDF, so those sites receive standard request data from your browser.
  • LaunchPact (launchpact.io): serves the directory badge in the footer of the home page. Like any web server it receives standard request data from your browser when the badge loads.
  • Vercel: our hosting and edge network provider. It keeps request logs and receives our server-side product events with your IP address and user agent; Vercel Analytics receives the browser events described in Section 3.
  • Umami Cloud (umami.is): a privacy-focused product analytics provider that receives the browser events described in Section 3. Umami does not use cookies and does not build cross-site profiles.
  • Upstash: a managed Redis provider that holds search results, reports, bundles, order and recovery records, and rate-limit counters for the periods in Section 7.

For users outside the EU/EEA/UK, we process personal data on the basis of the legitimate interest of operating a reverse email lookup service, and on the basis of your consent and the contract for providing the paid report or bundle. The Service must be used only where you have a genuine legitimate interest, such as personal safety checks, due diligence on people you already interact with, or verifying information about yourself.

7. Retention

  • Free search results: 10 minutes, then deleted automatically.
  • Paid reports, including reports run with a bundle: 24 hours, then deleted automatically.
  • Bundles (code, remaining searches, order ID, and the email address the bundle was bought for): 90 days.
  • Order records that let us check a payment against the order we created (order ID, amount, and a hash of the searched email): 24 hours.
  • Links between a PayPal transaction and what it bought: 24 hours for a report, 90 days for a bundle.
  • Transaction and order IDs marking refunded, reversed or disputed purchases, to prevent restoring cancelled access: 14 days.
  • Recovery records (the PayPal transaction ID, the payer's PayPal email address, and the amount): 14 days.
  • Rate-limit counters: 1 minute. The free-search limit: 7 days. The count of failed bundle-code attempts: 1 hour.
  • Unlock tokens: valid for 15 minutes from issuance.
  • In your browser: see Section 8.
  • Payment records stored by PayPal: governed by PayPal's retention policy.
  • Server logs (request-level): retained by our hosting provider per their default policy.
  • Product analytics events stored by Vercel Analytics and Umami Cloud: governed by those providers' retention policies. We do not maintain a separate copy.

8. Cookies and browser storage

We do not set cookies of our own, and our analytics tools do not use cookies. Your browser keeps a bundle's code and remaining searches in local storage until the bundle is used up or expires, and the order being unlocked in session storage until you close the tab, so that reloading the page does not lose your purchase. You can remove both by clearing this site's data in your browser. The payment services described in Section 5 may set their own cookies under their own policies.

9. Children

The Service is not intended for anyone under 18, and we do not knowingly collect data from children who use it. Searching for information about minors is prohibited by our Terms of Service.

10. Your rights

Subject to applicable law, you may have the right to access, rectify, or erase personal data we process about you, to object to or restrict processing, and to data portability. Because the Service is not offered in the EU/EEA/UK, we treat equivalent requests from all users on a best-effort basis.

To exercise these rights, send a request to privacy@checkmate.bio with enough information for us to identify the relevant data (for example, the email address you searched or your PayPal transaction ID).

If someone else searched your email address, you can contact us too. Search results are deleted within 24 hours, so after that we usually hold nothing about a search, except the email address a bundle was bought for, which is kept with the bundle for 90 days.

11. Security

We use HTTPS between your browser and our site, HMAC-signed unlock tokens, signed webhook verification for payment events, server-side checks that each payment matches an order we created at its price, and rate limiting to reduce abuse. No system is perfectly secure; use the Service with that understanding.

12. Changes to this policy

We may update this Privacy Policy from time to time. The effective date is shown at the top of the page. Continued use of the Service after changes indicates acceptance of the updated policy.

13. Contact

Privacy or data-subject requests: privacy@checkmate.bio. General support: support@checkmate.bio.