CLIENT-FACING

Privacy Policy

How Dark Scrub handles, protects, and deletes your data.

Effective: February 2026 — Last updated: February 20, 2026

The Short Version

  We collect only what we need. We encrypt everything. We delete it when we’re done.
  
  We are a privacy company. We hold ourselves to the same standard we set for the companies we remove your data from. If they shouldn’t have your data, neither should we — any longer than absolutely necessary.

1. What We Collect

To perform data broker removal, facial recognition audits, and privacy consulting services, we may need the following information from you:

Data Type	Why We Need It	How Long We Keep It
Full name, aliases	To search for and remove your records from data broker sites.	Deleted within 30 days of service completion.
Current and previous addresses	Data brokers index records by address. We need this to find your listings.	Deleted within 30 days of service completion.
Phone numbers	Some opt-out processes require phone verification.	Deleted within 30 days of service completion.
Email address	To communicate with you and to receive opt-out verification emails on your behalf.	Retained only as long as you are an active client.
Facial photographs	Used to search facial recognition databases and reverse image search engines to find where your face appears online.	Deleted within 48 hours of audit completion.
Government-issued ID (anonymized)	Required by some databases (PimEyes, Clearview AI) to verify identity during opt-out. We ask you to cover your name, address, and ID number — only the photo is visible.	Deleted within 48 hours of opt-out submission.
Social media handles	To assess your exposure across platforms and provide hardening recommendations.	Deleted within 30 days of service completion.
Payment information	To process your payment. We do not store credit card numbers — payment is handled by our payment processor.	Transaction records retained for tax/legal compliance only.

  We will never ask for: Your Social Security number, financial account numbers, medical records, passwords, or any data not directly required to perform the services you hired us for.

2. How We Protect Your Data

Your data is protected by multiple layers of security:

Encryption at Rest

All client data is stored inside an encrypted container (AES-256 encryption) on our work device. Even if the device is lost or stolen, your data cannot be accessed without the encryption passphrase. Our work device also uses full-disk encryption as a second layer of protection.

Encryption in Transit

All communications between Dark Scrub and our clients use end-to-end encrypted email (ProtonMail). We do not send or receive sensitive client data over unencrypted channels. If you contact us from a non-ProtonMail address, we will use ProtonMail’s password-protected email feature to encrypt the message.

Access Control

Your data is accessible only by the Dark Scrub operator assigned to your case. We do not employ third-party contractors, offshore teams, or automated systems that would require sharing your data with outside parties. When we use third-party tools (such as facial recognition search engines) to perform your audit, we upload only the minimum data required and strip all metadata from your photos before uploading.

Network Security

All client work is performed behind an encrypted VPN connection to prevent network-level interception. We use a dedicated browser profile for client work, separate from any personal browsing, with privacy-focused settings and extensions.

3. How We Use Your Data

Your data is used exclusively to perform the services you hired us for. Specifically:

To search for and remove your records from data broker and people-search websites.
To search facial recognition databases and reverse image search engines to identify where your face appears online.
To submit opt-out requests on your behalf to data brokers, facial recognition companies, and other data aggregators.
To assess your social media exposure and provide privacy hardening recommendations.
To verify that removals have been processed by re-checking sites after the removal window.
To communicate with you about the status of your service.

  We will never:
  Sell, share, or trade your personal data with any third party.
Use your data for marketing, advertising, or any purpose other than the services you hired us for.
Retain your data longer than necessary to complete your service.
Upload your photos or personal data to any service without a direct operational need.
Contact you for marketing purposes after your service is complete, unless you have opted into ongoing communications.

4. When We Delete Your Data

We follow a strict data retention schedule:

Data Type	Deletion Timeline
Facial photographs and government ID scans	Within 48 hours of completing the audit or opt-out submission.
Personal information (name, address, phone, social handles)	Within 30 days of completing all service deliverables, including verification checks.
Audit reports and removal confirmation screenshots	Delivered to you, then deleted from our systems within 30 days.
Service records (dates, service tier, invoice)	Retained for tax and legal compliance. Does not include personal data beyond your name and email.

For clients on subscription monitoring plans (Watchdog or Overwatch), we retain only the minimum data required for monitoring (name and facial recognition alert reference) for the duration of the subscription. All other data follows the deletion schedule above. When you cancel your subscription, all remaining data is deleted within 30 days.

5. Third-Party Services

In the course of performing your service, we may use the following third-party tools:

Service	What We Upload	Why
PimEyes	Your facial photograph (EXIF-stripped)	To search for your face across indexed websites.
FaceCheck.ID	Your facial photograph (EXIF-stripped)	To search social media, dating apps, and other platforms.
Google Lens, Yandex, TinEye	Your photograph (EXIF-stripped)	Reverse image search to find duplicates and spread.
Clearview AI	Your facial photograph	To request access/deletion of your records from their database.
Data broker websites	Your name, address, email (operator email used when possible)	To submit opt-out requests on your behalf.

We do not control the privacy practices of these third-party services. However, we minimize the data shared with each service to only what is required for the specific task, and we use our operator email address (not yours) wherever possible to limit your direct exposure.

6. Your Rights

You have the right to:

Know what we have. At any time during or after your service, you may ask us what data we currently hold about you. We will respond within 48 hours.
Request immediate deletion. You may request that we delete all of your data at any time. We will comply within 48 hours. Note that this may prevent us from completing any in-progress services.
Receive your data. You may request a copy of all data we hold about you in a standard format.
Withdraw consent. If you change your mind about our services at any point, we will stop all processing and delete your data.

7. Data Breach Notification

In the unlikely event that your data is compromised due to a security incident affecting Dark Scrub, we will:

Notify you within 24 hours of discovering the breach.
Provide a clear, plain-language description of what happened, what data was affected, and what we are doing about it.
Provide specific recommendations for any steps you should take.
Cooperate fully with any investigation.

  We believe transparency is non-negotiable. If something goes wrong, you will hear about it from us — quickly, clearly, and honestly.

8. Cookies & Website Tracking

The darkscrub.com website does not use tracking cookies, analytics software, advertising pixels, or any third-party tracking. We do not use Google Analytics, Facebook Pixel, or any similar service. We do not track your browsing behavior on our site. If we add any analytics in the future, it will be privacy-respecting, self-hosted, and disclosed here.

9. Children’s Privacy

Dark Scrub does not knowingly collect data from individuals under the age of 18. If we discover that we have received data pertaining to a minor, we will delete it immediately. If a parent or guardian wishes to engage our services on behalf of a minor, the parent or guardian must be the contracting party and point of contact.

10. Changes to This Policy

If we make material changes to this privacy policy, we will update the “Last updated” date at the top of this page and notify active clients via email. We will not retroactively reduce the protections described here without your explicit consent.

Contact

Questions about this policy or your data?

Email: [email protected]

Web: darkscrub.com

Location: Anchorage, Alaska