Privacy & Cookie Policy

Last updated 16/10/2026

This policy explains what personal data BLKCanary collects, why, how long we keep it and the rights you have under the EU General Data Protection Regulation (GDPR), the UK GDPR and the ePrivacy rules on cookies.

1. Who we are

The data controller is Exovoid Ltd., bul. Cherni Vrah 47A, fl. 5, Sofia, Bulgaria. For any privacy question or request, contact us at [email protected].

2. Data we process

  • Account data: name, email address, password hash, business name and security settings, to provide and secure your account (contract).
  • Monitored email addresses you add, and breach results for them, to deliver the monitoring service (contract).
  • Billing data: subscription and invoice records; card details are handled by our payment provider and never reach our servers (contract, legal obligation).
  • Messages you send through our contact forms, to answer you (legitimate interest).
  • Usage analytics as described in sections 3 and 4.
  • Technical logs such as IP address and errors, to keep the service secure and working (legitimate interest).

3. Analytics on our public pages

On pages you can see without signing in (home page, pricing, contact, sign-in and sign-up pages, this page) we use Google Analytics 4 only if you click "Accept analytics" in the cookie banner. Until then no analytics script is loaded and no analytics cookies are set. The legal basis is your consent (Art. 6(1)(a) GDPR). You can change your mind at any time via Cookie settings in the page footer; withdrawing consent removes the Google Analytics cookies from your browser.

4. Analytics inside the BLKCanary app

Once you sign in, we use Google Analytics 4 to understand how the product is used, so we can find problems and decide what to improve. Product analytics is part of how we run the service, so there is no cookie banner inside the app and it cannot be switched off from your account settings. The legal basis is our legitimate interest in maintaining and improving the service (Art. 6(1)(f) GDPR).

What we record

  • Pages you view and how long you spend on them (engagement time).
  • Clicks on buttons, links and tabs, dialogs you open and forms you submit, identified by their label or element name only. Nothing you type into a form is sent.
  • Device, browser, screen size and approximate location (country/city) as derived by Google.
  • A pseudonymous user identifier, so that visits from different devices can be grouped. It is a one-way hash, not your name, email address or account number.

Safeguards

  • Email addresses are stripped from anything sent to Google Analytics.
  • Google Signals, advertising features and ad personalisation are disabled. Analytics data is not used for advertising.
  • Google Analytics 4 does not log or store IP addresses.
  • Analytics data is retained for 14 months and then deleted automatically.

You have the right to object to this processing (Art. 21 GDPR). Contact us using the details in section 1 and we will review your request and, where your objection is upheld, stop analytics for your account.

5. Cookies we use

Cookie Purpose Type Duration
__Host-token Keeps you signed in Strictly necessary Until sign-out or expiry
blkcanary_session Session state Strictly necessary 120 minutes
XSRF-TOKEN Protects forms against cross-site request forgery Strictly necessary 120 minutes
cookie_consent Remembers your cookie choice Strictly necessary 180 days
_ga, _ga_* Google Analytics: distinguishes visitors and sessions Analytics. Consent-based on public pages, always on inside the app Up to 2 years
_GRECAPTCHA Google reCAPTCHA: protects sign-up and contact forms from bots Strictly necessary (security) 6 months

You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies will stop sign-in and forms from working.

6. Service providers and transfers

We share data only with providers that process it on our behalf under a data processing agreement: Google Ireland Ltd (Analytics, reCAPTCHA), our hosting provider, our email delivery provider, Stripe (payments), Have I Been Pwned (breach lookups for monitored addresses) and our error-monitoring provider. Where data is transferred outside the EU/EEA or UK, the transfer relies on an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses.

7. How long we keep data

Account and monitoring data is kept while your account is active and deleted after the account is closed, except billing records we must keep by law. Analytics data is kept for 14 months. Contact form messages are kept as long as needed to deal with your enquiry.

8. Your rights

You can ask us to access, correct, delete, restrict or export your personal data, object to processing based on legitimate interest, and withdraw consent at any time without affecting earlier processing. We answer within one month. You can also complain to your local data protection authority.

9. Changes to this policy

We will update the date at the top of this page when the policy changes, and tell signed-in users about significant changes.