Privacy Policy & Data Standards

1. Organizational Scope & Core Principles

This Privacy Policy ("Policy") governs the collection, processing, use, and disclosure of data by LeakReport, an operating commercial brand of Generative Intellectual LLC ("Company", "LeakReport", "we", "us", or "our"). This Policy applies to all visitors, commercial users, domain administrators, and clients who access our website at leakreport.io, query our public surface inspection utilities, request preview dossiers, interact with our liability consoles, or purchase digital security packages.

LeakReport operates primarily in a business-to-business (B2B) capacity, assisting commercial website operators, IT engineers, and corporate executives in identifying perimeter security vulnerabilities, data leakage vectors, and statutory compliance exposures. We are committed to strict data minimization, technical confidentiality, and full transparency.

2. Legal & Technical Classification of Public Surface Telemetry

A critical distinction governs the technical operations of LeakReport: our inspection engines analyze exclusively publicly reachable, broadcasted network metadata.

When a domain name is submitted to LeakReport, our automated systems query public internet endpoints in the exact same manner as a standard web browser (such as Google Chrome, Mozilla Firefox, or Apple Safari). The technical attributes evaluated include:

• +
  Public Domain Name System (DNS) Records: Publicly published zone data including MX records, SPF records, DMARC configurations, DKIM selector responses, CAA policies, and nameserver allocations.
• +
  Public SSL/TLS Handshake Configurations: Certificate authority chains, expiration dates, cipher suite negotiation parameters, and protocol support (TLS 1.2, TLS 1.3).
• +
  Public HTTP/HTTPS Response Headers: Server banners, Content-Security-Policy directives, Strict-Transport-Security (HSTS) headers, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy parameters sent by the web server to any visiting user agent.
• +
  Public Client-Side Scripts & Tracking Pixels: Public JavaScript libraries (such as Meta Pixel, Google Tag Manager, TikTok Pixel, FullStory, Hotjar), tracking beacons, form endpoints, and cookie transmission attributes served directly to the client browser.

These elements constitute public internet telemetry intentionally published and broadcasted by the domain operator to the global internet. Our surface inspection scans do not constitute:

• + Unauthorized access to a protected computer under the Computer Fraud and Abuse Act (CFAA, 18 U.S.C. § 1030);
• + The interception, eavesdropping, or recording of private electronic communications under the Federal Wiretap Act (18 U.S.C. § 2511) or the California Invasion of Privacy Act (CIPA, Cal. Penal Code § 631);
• + Breach of proprietary computer networks, credential stuffing, password cracking, or denial-of-service stress testing;
• + Inspection, decryption, or exfiltration of confidential internal databases, employee records, or consumer transaction records.

3. Categories of Information We Collect

LeakReport collects only the minimal categories of data necessary to perform technical risk assessments, deliver deliverables, verify identity and authorization, and prevent fraudulent abuse:

• +
  Authorized Contact Information: Full name, corporate email address, business telephone number, and business entity name provided when initiating an exterior scan, downloading a brief, or requesting a liability walkthrough.
• +
  Target Domain Identification: The Fully Qualified Domain Name (FQDN), website hostname, and publicly mapped web server IP addresses submitted for evaluation.
• +
  Transactional & Commercial Records: For paid commercial audit packages (Tiers 1, 2, and 3), we collect billing name, business address, purchase tier, timestamp, transaction ID, and payment status. All credit card processing is conducted directly by our PCI-DSS Level 1 compliant payment processor (Stripe). LeakReport never receives, processes, or stores raw payment card numbers or CVV codes.
• +
  Technical Access & Verification Logs: Remote IP address, browser user-agent, operating system, referrer URL, intake consent timestamp, and audit trail records generated when interacting with our search consoles or verifying report tokens.

4. Specific Purposes of Data Processing

We process the collected data strictly under lawful, legitimate commercial bases:

• +
  Service Delivery & Dossier Assembly: Conducting automated exterior surface scans, compiling 32-point statutory compliance scorecards, generating risk letter grades, and assembling turnkey AI fix prompts.
• +
  Order Fulfillment & Licensing: Provisioning access tokens, generating encrypted download links, and maintaining verification records for purchased commercial packages.
• +
  Direct Communication Under Express Consent: Delivering scan completion alerts, executive vulnerability briefs, liability walkthrough schedules, and re-scan verification updates via telephone, SMS text messaging, or email pursuant to your prior express written consent.
• +
  Fraud Deterrence & Infrastructure Security: Detecting and mitigating automated bot traffic, unauthorized multi-target scraping, distributed denial-of-service attacks, and fraudulent submissions.
• +
  Legal Compliance & Dispute Defense: Maintaining verifiable records of consent, fulfilling statutory data subject requests, complying with valid legal process, and defending against civil claims or regulatory inquiries.

5. Affirmative Non-Sale & Non-Sharing Pledge

LeakReport operates under an absolute prohibition against data monetization:

We do not maintain secondary data brokering businesses, we do not lease lead lists to marketing agencies, and we do not install third-party tracking beacons that track your browsing behavior across unrelated third-party websites.

6. 14-Day Automated Purge Policy & Retention Standards

To guarantee data minimization and eliminate unneeded technical records, LeakReport enforces an automated data lifecycle policy:

• +
  Unclaimed Scan Previews (14-Day Purge): Scan preview dossiers, temporary preview tokens, and heuristic vulnerability snapshots for domains that have not been converted into a paid commercial report are automatically and permanently purged from active production databases after fourteen (14) calendar days.
• +
  Paid Commercial Deliverables: Customers who purchase commercial packages (Tiers 1, 2, or 3) receive continuous, secure access to their unlocked report dossiers, AI remediation prompts, and verification certificates for the active duration of their licensing tier, or until a verified deletion request is received.
• +
  Financial & Legal Audit Logs: Transaction records, invoices, consent verification timestamps, and compliance audit records are retained for the duration required by applicable commercial, tax, and corporate accounting laws (typically up to seven years), after which they are securely destroyed.

7. Third-Party Service Providers & Sub-Processors

We disclose personal information exclusively to trusted third-party service providers who process data strictly on our behalf under written confidentiality and data processing agreements:

• +
  Cloud Infrastructure & Hosting: Managed cloud providers operating high-security United States facilities that adhere to SOC 2 Type II and ISO 27001 data center physical security standards.
• +
  Payment Gateway: Stripe, Inc., for secure, tokenized, PCI-DSS Level 1 payment processing.
• +
  Transactional Communications: Email transmission gateways (such as Twilio SendGrid) for automated delivery of report tokens, receipts, and security alerts.
• +
  Aggregated Performance Analytics: Google Analytics, configured to capture aggregate, non-identifying website traffic patterns without commercial cross-context data sharing.
• +
  Legal & Regulatory Disclosures: We may disclose information if required by law, subpoena, court order, or warrant, or when we believe in good faith that disclosure is necessary to investigate fraud, protect our rights or property, or respond to an emergency threatening human safety.

8. Statutory Privacy Rights (CCPA, CPRA & State Privacy Laws)

Under the California Consumer Privacy Act of 2018 (CCPA), the California Privacy Rights Act of 2020 (CPRA), and comprehensive data privacy statutes enacted in Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), and other applicable jurisdictions, consumers and commercial representatives possess specific statutory rights regarding their personal data:

Submitting a Verified Consumer Request: To exercise any of these statutory rights, please submit a written request to our Data Protection Desk at reports@leakreport.io or use our automated Opt-Out Console. To protect your privacy and security, we verify requests by matching identifying details (such as corporate email address or domain authorization credentials) against records maintained in our systems. We will acknowledge receipt within ten (10) business days and provide a substantive response within forty-five (45) calendar days.

California "Shine the Light" Law (Cal. Civ. Code § 1798.83): California residents may request a notice disclosing the categories of personal information shared with third parties for their direct marketing purposes. LeakReport does not share personal information with third parties for their direct marketing purposes.

9. Universal Opt-Out & Do-Not-Contact Registry

LeakReport maintains a centralized, automated suppression console accessible at leakreport.io/unsubscribe.

Any domain owner, corporate officer, or individual may submit their domain hostname, corporate email address, or telephone number to our universal suppression registry. Once registered:

• + The designated email address and telephone number are permanently suppressed across all marketing, alert, and notification pipelines;
• + The specified domain is flagged in our exclusion index, barring the generation of automated notification communications;
• + Suppression records are permanently maintained across all internal databases to prevent inadvertent re-contact.

10. Technical Security Safeguards & Absolute Disclaimer

LeakReport implements rigorous administrative, technical, and physical security measures calibrated to NIST SP 800-53 standards to safeguard information under our control. These measures include:

• + End-to-end Transport Layer Security (TLS 1.3 / HTTPS) encryption for all web traffic and data transmissions;
• + Cryptographic hashing of sensitive lookup tokens and verification credentials;
• + Restricted role-based access control (RBAC), multi-factor authentication, and containerized service isolation;
• + Continuous automated log auditing, rate limiting, and web application firewall (WAF) filtering.

Absolute Security Disclaimer: While we implement advanced industry-standard safeguards, NO METHOD OF TRANSMISSION OVER THE INTERNET OR METHOD OF ELECTRONIC DATA STORAGE IS 100% SECURE. LEAKREPORT CANNOT AND DOES NOT WARRANT OR GUARANTEE THE ABSOLUTE SECURITY OF ANY INFORMATION TRANSMITTED TO US OR STORED ON OUR SERVERS. YOU ACKNOWLEDGE THAT ALL SUBMISSIONS OF DATA AND INTERACTIONS WITH OUR SERVICES ARE CONDUCTED AT YOUR OWN SOLE RISK.

11. Children's Online Privacy Protection (COPPA / Age Limit)

LeakReport, its tools, search consoles, and deliverables are strictly designed for commercial businesses, enterprise operators, and individuals aged eighteen (18) and older. We do not knowingly solicit, target, collect, or maintain personal information from children under eighteen (18) years of age, or under thirteen (13) years of age under the Children's Online Privacy Protection Act (COPPA).

If we discover that personal information has been inadvertently collected from a minor under eighteen (18), we will immediately delete and permanently expunge such data from our systems. If you suspect that a minor has provided information to us, please contact our compliance desk immediately.

12. Cookies, Tracking Signals & Global Privacy Control (GPC)

Our website utilizes minimal first-party cookies and local storage tokens solely to maintain essential session state, enforce Cross-Site Request Forgery (CSRF) defenses, and authenticate access to purchased report dossiers. We do not employ third-party advertising cookies or cross-site tracking pixels.

Do-Not-Track & Global Privacy Control Signals: Because we do not track our users over time and across third-party websites to provide targeted advertising, our systems operate without modification when detecting generic "Do Not Track" (DNT) header signals. We honor recognized Global Privacy Control (GPC) signals in accordance with applicable state privacy regulations.

13. Dispute Resolution, Arbitration & Class Action Integration

Any dispute, claim, or controversy arising out of or relating to this Privacy Policy, our data governance practices, telemetry handling, or statutory data subject requests shall be resolved exclusively through the mandatory binding individual arbitration procedures, jury trial waiver, class action waiver, governing law standards (State of Wyoming), and limitation of liability provisions set forth in Section 8 and Section 13 of our Terms of Service.

You agree that any claim relating to data privacy or information security must be brought in an individual capacity and not as a plaintiff or class member in any class, collective, or representative proceeding.

14. Modifications to this Privacy Policy

We reserve the right to revise, update, or amend this Privacy Policy at our sole discretion at any time to reflect enhancements in our scanning engines, changes in statutory requirements, or operational adjustments.

When changes are made, we will update the "Effective Date" and version designation at the top of this document. Any modifications shall become effective immediately upon publication on this website. Your continued access to our site, submission of domains, or utilization of deliverables following the posting of an updated Policy constitutes your affirmative acceptance of the revised terms.

15. Data Protection Officer & Contact Coordinates

For questions regarding this Privacy Policy, statutory compliance inquiries, or to submit a verified data subject request, please contact our Data Privacy & Governance Desk: