Privacy notice

Last updated September 27, 2026

Effective [PRIVACY EFFECTIVE DATE]

This notice explains what URAKIMON collects about the people who use it, why, what the law lets us rely on, how long we keep it, who else receives it, and what you can ask us to do. It covers you if you have an account, visit this website or write to us.

If you are a person whose information appears on a public web page, and so possibly in a record, read People in records. That notice explains where records come from and how to object.

1. Who we are

• Operator: [LEGAL ENTITY NAME], a [ENTITY TYPE] formed in [STATE OF FORMATION] ("URAKIMON", "we", "us").
• Address: [REGISTERED STREET ADDRESS].
• Privacy contact: [PRIVACY EMAIL].
• Representative in the European Union (GDPR Article 27): [EU REPRESENTATIVE NAME, ADDRESS AND EMAIL].
• Representative in the United Kingdom (UK GDPR Article 27): [UK REPRESENTATIVE NAME, ADDRESS AND EMAIL].

For the account, billing and website information this notice describes, URAKIMON is the controller: we decide why and how it is used.

2. What we collect

Your account

• When you sign up: the name or company you enter, your email address, and whether you have confirmed your email address. Your password is stored only as a scrypt hash.
• Each sign-in creates a session that records the IP address and browser it came from, and ends after 24 hours.
• API keys are stored only as a SHA-256 hash, with the name and limits you gave them. The secret is shown to you once and not kept.
• Usage: for each key, the records and spend per day and per month, and a line for each billed record.
• Credit: each purchase, plan payment, trial grant, refund, dispute, expiry and adjustment, with Stripe's payment reference where there is one.
• If you reach the account page from a link on this website, the name of that link travels with your sign-up request and is saved with your account. Nothing else about the visit is saved, and no cookie is set for it.

Trial credit

To give the trial once per mailbox, URAKIMON keeps a hash of your email address with the trial's credit entry. To allow at most 2 trials per network in 30 days, it keeps a hash of your network (your IPv4 address, or the first half of an IPv6 address), never the address itself, and deletes that network hash once the 30 days have passed.

Requests and records

• The inputs you send are kept while the job runs. When it finishes, only maxItems and the webhook address, if you gave one, are kept.
• A finished job and its records are removed 24 hours after the job ends. Removal runs every 15 minutes. A key keeps at most 1,000 finished jobs, and older ones are removed first.
• Webhook deliveries (the address and what was sent) are kept for 7 days after delivery, or 30 days if delivery failed.
• Records hold what the source's public pages show. That can include people's names and public profiles. They reach you and are removed with the job as above.
• If you call URAKIMON through a third-party marketplace that lists it, the marketplace sends us your request and a one-way hash of your user id there, never the id itself. The marketplace's own privacy notice covers what it collects about you.

Logs and limits

Our request log records the method, the path, the status and the time taken. It does not record your IP address or what you sent. Where a limit counts by network (failed key and sign-in attempts), it stores a hash of the network, not the address. When error reporting is on, error reports go to Sentry without your IP address, cookies or account fields, and with secrets removed first; an error message can still include part of a request that caused it.

Cloudflare carries every request to the website and the API before it reaches us, so Cloudflare sees your IP address, your browser's request headers and the address you asked for. Cloudflare keeps its own logs of that traffic under its own retention rules. We do not export or copy those logs.

When you write to us

If you email us, we keep your message, your address and our reply so we can answer you and keep a record of what was asked and decided.

3. Why we use it, and our legal basis

Under the GDPR and the UK GDPR each use of personal data needs a legal basis. "Contract" means we need it to provide the service you signed up for; "legitimate interests" means a reasonable interest of ours that does not override your rights; "legal obligation" means a law requires it.

An account needs an email address and a password: without them we cannot create it. We do not rely on consent for any of the above, and we send no marketing email.

4. Who receives it

• Stripe processes payments and plan subscriptions. URAKIMON sends Stripe your email address and an account reference. Card details go to Stripe, not to URAKIMON. Stripe also uses payment information for its own purposes, such as fraud prevention and meeting its legal duties, as an independent controller under its own privacy policy.
• Cloudflare carries all traffic to the website and the API, as described under Logs and limits. The sign-in, sign-up and password-reset forms can ask Cloudflare Turnstile to check that the visit is a person, and Cloudflare adds its own security script to every page (see Cookies and browser storage). Cloudflare acts for us in all of this, and uses Turnstile signals for its own purposes, such as improving Turnstile, as an independent controller.
• Resend sends the confirmation, password reset and account emails.
• Sentry receives error reports when error reporting is on.
• OVH runs the servers, and Crunchy Bridge manages the database.
• Evomi, a network provider, carries URAKIMON's requests to sources' public pages, so the addresses and search terms in your requests pass through it. It receives no account details.
• Authorities, courts or advisers, when the law requires it or to establish or defend a legal claim.
• A buyer or successor, if URAKIMON's business is sold or merged. They would have to handle your information as this notice describes.

Service providers lists each provider with what it receives, where, and the safeguard for transfers. We do not sell your information to anyone.

5. International transfers

URAKIMON's servers are in the United States (OVH, Virginia), and its database is in [DATABASE REGION]. Several of our providers are based in the United States.

When information about people in the European Economic Area, the United Kingdom or Switzerland goes to one of those providers, we rely on the safeguard shown for it on Service providers: its certification under the EU-U.S. Data Privacy Framework (with the UK Extension and the Swiss-U.S. framework), or the European Commission's Standard Contractual Clauses in its data processing terms. You can ask the privacy contact for a copy of the safeguard that applies.

6. How long we keep it

7. Cookies and browser storage

• The session cookie (its name starts with __Host-urakimon), set when you sign in and valid for 24 hours.
• The website remembers a light or dark theme you choose in your browser's local storage. It is never sent anywhere.
• Cloudflare can set its own security cookies and runs its own security script.

Cookies and browser storage lists each one with its purpose and lifetime. None is used for advertising or to follow you to other websites.

8. Deleting your account

Deleting your account from the account page revokes every key, cancels running jobs and any plan, ends your sessions and removes your sign-in details. The account's billing record stays, with its email address erased, so that payments, refunds and disputes can still be matched (see How long we keep it). Stripe keeps its own customer record, so receipts stay available. Jobs and their records are removed on the usual 24-hour schedule.

9. Your rights

Under the GDPR and the UK GDPR you can ask us to:

• give you a copy of the information we hold about you (access);
• correct information that is wrong. The account page does not offer an email change, so ask the privacy contact to correct an address;
• delete your information. You can also delete your account yourself, as described above;
• restrict how we use it while a question about it is settled;
• send you, or another provider, the information you gave us in a machine-readable form (portability);
• stop using it where we rely on our legitimate interests (objection). We will stop unless we have compelling grounds or need it for a legal claim.

To use a right, email [PRIVACY EMAIL] from the address on your account, or tell us which account the request is about. We ask for more proof of identity only when we have reasonable doubt. We answer within one month; if a request is complex we can take up to two more months and will tell you why within the first month. There is no charge.

Some information has to stay even after a request, such as the billing record described above. When that happens we tell you what we kept and why.

10. Automated decisions

Automated checks decide whether a new account gets trial credit (mail domain, earlier trials from the mailbox or network) and when a limit refuses a request. None of these decisions has a legal or similarly significant effect on you. You can ask the privacy contact for a person to review one.

11. Complaints

If you are unhappy with how we handle your information, please tell us first at [PRIVACY EMAIL]. We acknowledge a complaint within 30 days, look into it without undue delay, and tell you the outcome.

You can also complain to a data protection authority at any time:

• in the United Kingdom, the Information Commissioner's Office (ico.org.uk);
• in the European Economic Area, the authority of the country where you live, work or where the problem happened (the list of authorities).

12. US state privacy rights

If you live in California or another US state with a consumer privacy law (such as Colorado, Connecticut, Oregon, Texas or Virginia), this section applies to you as well.

• What we collected in the last 12 months: identifiers (name, email address, IP address in sign-in sessions, hashed network and account references); commercial information (credit purchases, plans, refunds and usage); internet activity on our service (the requests your keys sent); and account sign-in details (your email address with a password hash), which California treats as sensitive. We use the sign-in details only to let you sign in.
• Sources: you, your browser, Stripe (payment status) and, if you use one, the marketplace you call us through.
• Purposes: those in Why we use it; how long each is kept is in How long we keep it.
• Disclosure: to the service providers in Who receives it, for those purposes.
• Selling and sharing: we do not sell the personal information of account holders or visitors, or share it for cross-context behavioural advertising, and have not done so in the last 12 months. We have no actual knowledge of selling or sharing information about anyone under 16.

Depending on your state, you can ask to know and get a copy of the information we hold about you, to correct it, to delete it, and to opt out of its sale, targeted advertising or profiling. We will not treat you differently for using these rights. Send a request to [PRIVACY EMAIL]. We verify it by matching it to your account's email address; if you have no account (for example you appear in records), People in records says how we confirm a request. An authorised agent can make a request for you with your signed permission; we may ask you to confirm it. We answer within 45 days, or tell you within that time if we need up to 45 more. If we refuse a request, you can appeal by replying with "Appeal" in the subject, and we answer within the time your state's law sets.

13. Children

URAKIMON is a service for businesses and is not meant for anyone under 18. We do not knowingly create accounts for children. If you think a child has given us information, write to [PRIVACY EMAIL] and we will delete it.

14. Changes to this notice

When this page changes, we post the new version here at least 30 days before it applies, and the effective date at the top changes with it. A change that the law, a court or an authority requires can apply sooner, from when we post it.

15. Contact

Privacy questions and requests: [PRIVACY EMAIL]. Post: [REGISTERED STREET ADDRESS].

See also

• Terms of service
• People in records
• Cookies
• Acceptable use
• Copyright
• Service providers