1. Information We Collect
We collect information you provide directly:
- Account Information: Email address, name, password (stored as a secure hash, never in plain text)
- Uploaded Data: CSV/XLSX files containing PII submitted for breach validation analysis
- Usage Data: Log data, IP addresses, browser information, pages visited
2. How We Use Your Information
- Validate uploaded PII data against independent breach-data providers selected for each project
- Generate breach validation reports and analysis
- Send service notifications and account communications
- Improve our services and develop new features
- Comply with legal obligations
3. Data Retention
- VPC keeps the personal data in your project, encrypted, until you instruct us to delete it. Finishing a project does not delete it, and completed projects have no automatic deletion timer.
- Your uploaded file is encrypted on arrival. The original file is deleted automatically when processing completes; the imported data is kept, encrypted, as described above.
- VPC keeps the breach records its data providers return for each person, so results can be reproduced and you are not charged again for a search already run for your project.
- On your written instruction, VPC deletes a project by destroying its encryption key. That makes the encrypted personal data unreadable, including in backups. To guard against mistakes, the key can be restored for 14 days; after that the deletion is permanent. Database backups roll off after 35 days.
- Account data is retained until you request deletion
4. Your Rights
Depending on your jurisdiction, you may have the following rights:
- Access: Request a copy of your personal data we hold
- Rectification: Correct inaccurate personal data
- Erasure: Request deletion of your data ("right to be forgotten")
- Portability: Receive your data in a structured, machine-readable format
- Opt-out: Unsubscribe from non-essential communications
- Restriction: Request that we limit processing of your data
To exercise these rights, contact us at privacy@validatepiiclasses.com
5. Data Processing Impact Assessment
We have assessed the privacy impact of our processing activities:
- Encrypted retention: Personal data is kept, encrypted, until the customer instructs us to delete it (see Section 3)
- No profiling: We do not build profiles, score individuals, or make automated decisions based on personal data
- Tenant isolation: Each organization's data is stored in a separate database schema with per-project tables and per-project encryption keys
6. Security Measures
We employ industry-standard security measures to protect your data:
- TLS 1.2+ encryption for all data in transit (HTTPS, database connections, API calls)
- AES-256-GCM authenticated encryption for uploaded files at rest
- Per-project encryption keys for data isolation
- Multi-factor authentication with an authenticator app (TOTP) and one-time recovery codes, on by default for every account and always required for VPC staff, breach reports and exports
- Brute-force login protection with automatic lockout
- Multi-tenant database isolation (separate schemas per organization)
- Structured audit trail for sensitive operations
- Amazon Inspector container scanning with deploy gating
- HSTS preload for all domains
- Argon2 password hashing (memory-hard algorithm)
7. Third-Party Data Processors
We use the following third-party sub-processors:
- Amazon Web Services (AWS): Cloud infrastructure — compute, database, storage, CDN, and caching. All processing in US East regions.
- Breach-data providers: Independent breach-data providers selected for each project, listed on our Sub-Processor List.
- Error monitoring services for platform reliability
For detailed data processing terms, see our Data Processing Agreement.
8. Cookies
We use essential cookies for authentication and session management. We do not currently use advertising or third-party tracking cookies.
9. International Data Transfers
All processing occurs in AWS US East regions (United States). If you access the Service from outside the US, your data will be transferred to and processed in the US. By using the Service, you consent to this transfer.
10. Children's Privacy
The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.
11. Changes to This Policy
We may update this privacy policy from time to time. We will notify you of significant changes via email or through a notice on our website. The 'Last updated' date at the top of this policy indicates the most recent revision.
12. Contact Us
For privacy-related questions or concerns, contact us at: