Privacy Policy

1. Who is responsible

1.1 The controller of the personal data processed through https://www.weleaks.com is Weeleaks Technology Limited (C 116871), .

1.2 Any question about this policy, and any request to exercise a right, can be sent to [email protected].

2. Two kinds of people are concerned

2.1 Weleaks processes the data of its customers, as any service does — and the data of the people its customers search for, who never contacted it. This policy addresses both. Section 12 is written for the second group.

2.2 This policy applies under Regulation (EU) 2016/679 (GDPR) and the Maltese Data Protection Act, together with the local law of the person's country of residence where that law affords additional protection.

3. Data about customers

Account data

Email address, name where one is given, a hashed password or the identifier of the social account used to sign in, and language.

Search data

The identifiers searched for, the date of each search, and the reports produced, kept in the account's history.

Billing data

Subscription and payment records, amounts, dates and status, and the invoices issued, which carry the buyer's name and address. Card details are entered directly with the payment provider and are never received by Weleaks.

Support data

The content of messages sent through the contact form or by email.

Technical data

IP address, user agent, timestamps, application logs and error reports, and the cookie identifying an anonymous visitor's free preview.

4. Data about the people searched for

4.1 When a customer runs a search, Weleaks queries public sources — search engines, encyclopaedic references, public profiles on open platforms — and assembles what they return into a report.

4.2 The data concerned is therefore data the subject, or someone else, has already made public: names, public profiles and handles, stated occupation and employer, education, publications, press mentions, and the links to the pages carrying them.

4.3 Weleaks holds no pre-built database of individuals, buys no file of personal data, and has no access to private, administrative, banking, medical, judicial or telecommunications records. A report is produced on request, from pages that were already public, and every element of it links to the source it came from.

4.4 The legal basis for this processing is the legitimate interest of Weleaks and of its customers in finding and consolidating information a person has published or that has been published about them, balanced against the rights of the subject. That balance is what Articles 5 and 12 implement: the sources are always disclosed, the reports may not be used for eligibility decisions, retention is short, and any subject may have themselves excluded entirely and free of charge.

4.5 Weleaks does not seek out special-category data — health, beliefs, political opinions, sexual orientation, biometric or genetic data — and does not build profiles of criminal offences or convictions.

5. Why data is processed, and on what basis

5.1 No decision producing legal effects for anyone is taken solely by automated means. A report is material for a person to read, and the Terms forbid using it as a factor in a decision about the subject's eligibility for employment, housing, credit, insurance or education.

6. Who else processes the data

6.1 Personal data is never sold or rented. It is shared only with the providers below, each bound by a data-processing agreement, and with a public authority where the law requires it.

7. Transfers outside the EEA

7.1 The application and the database are hosted in the European Union.

7.2 Some providers listed above process data outside the European Economic Area. Those transfers are covered by the European Commission's Standard Contractual Clauses, together with the technical and organisational measures needed to make them effective, and — where the provider is certified — by the EU–US Data Privacy Framework.

8. How long data is kept

8.1 Weleaks keeps no standing record of the people searched for beyond the reports held in the accounts that ordered them and the short-lived cache. When those are deleted, nothing about the subject remains.

9. Security

9.1 Traffic is encrypted in transit. Passwords are stored hashed, never in clear. A report is readable only by the account that ordered it, checked on every read.

9.2 Access to production systems is restricted to the staff who need it, over a private network, and is logged.

9.3 Where a breach is likely to result in a high risk to the rights of the people concerned, they and the supervisory authority are notified within the periods the GDPR prescribes.

10. Cookies and similar technologies

10.1 The Site uses:

• strictly necessary cookies — the session, the language, the anti-bot check, the security protections, and the cookie that attributes an anonymous free preview to the visitor who ran it;
• audience-measurement cookies (Google Analytics, deployed through Google Tag Manager) that measure how the Site is used, in aggregate;
• an attribution cookie recording how a visitor reached the Site, used to measure advertising.

10.2 Measurement and attribution cookies can be refused through the browser's settings, or through Google's own opt-out add-on. Refusing strictly necessary cookies prevents the service from working.

11. Rights of customers

11.1 Every customer has the right of access, rectification, erasure, restriction, objection, and portability, and the right to withdraw a consent already given.

11.2 Searches can be deleted individually from the account's history, and the account itself can be deleted from the account settings.

11.3 Any other request can be sent to [email protected], and is answered within one month, extendable by two months where the request is complex.

12. Rights of the people searched for

12.1 If information about you can be returned by Weleaks, you may have yourself excluded. Write to [email protected], or use the removal page on the Site. It is free, and no account is needed.

12.2 An exclusion is entered on a suppression list that is consulted before any source is queried, for every customer and every future search. From that point Weleaks returns nothing about you. The list stores only what is needed to recognise the exclusion, and nothing about you is retained for any other purpose.

12.3 You also have the right of access — to be told whether information about you has been gathered and what it is — the right to have it rectified, the right to object to the processing on grounds relating to your situation, and the right to erasure.

12.4 An exclusion removes the information from Weleaks. It does not remove it from the source that published it: the underlying page remains online, and continues to be found by search engines. To have it taken down, the publisher of that page must be approached.

12.5 A customer who bought a report before the exclusion holds a copy Weleaks cannot reach. The Terms require them to destroy it on request, and it is available on request to help you make that request.

12.6 Anyone who considers their rights have not been respected may complain to the Office of the Information and Data Protection Commissioner in Malta, or to the supervisory authority of their own country of residence.

13. Minors

13.1 The Services are not intended for persons under eighteen (18), and no account may be created by one.

13.2 A search that appears to concern a minor is treated as a removal request and the person is excluded, without a request being needed.

14. Changes to this policy

14.1 This policy may be updated. The version that applies is the one published on the Site at the time of consultation; a material change is notified by email or in the account.