1. Who we are
Leak Database (“we”, “us”, “our”) operates www.leakdatabase.com. For the purposes of POPIA, the responsible party is:
- Legal name
- [to be completed: legal name]
- Physical address
- [to be completed: physical address]
- Information Officer
- [to be completed: Information Officer]
- info@leakdatabase.com
You can contact us about anything in this policy through our contact page or by email.
2. Scope of this policy
This policy covers personal information we process when:
- we index identifiers from data breaches that have been publicly released;
- you use our website, including our search;
- you create an account or take out a membership; and
- you contact us.
It does not cover third-party websites that we link to; please read their own privacy policies.
3. Breach data we index
When a website or organisation suffers a data breach and the data is released publicly, we record information about the incident and index a limited set of identifiers from it. We do not collect this information from you directly — it comes from breach data that has already been distributed publicly by others.
What we keep
- Identifiers: email addresses, phone numbers and identity numbers, stored exactly as they appeared in the breach.
- Breach reference: which breach each identifier appeared in.
- Breach details: the name of the breached organisation, the date of the breach, the number of records involved, the types of data exposed and guidance on protecting yourself.
What we never keep
We do not store passwords or password hashes, names, physical addresses, dates of birth, financial or card details, or any other content of the breached records, and we do not keep copies of the breached files once our indexing is complete. We do not host, sell or distribute breach data.
What is shown publicly
Our public search lets a person check an email address. Results show which breaches the address appeared in; full breach details are shown to signed-in members. Phone numbers and identity numbers are not searchable on our website.
4. When you search
The email address you enter is used only to run your search and display the result. It is sent over an encrypted (HTTPS) connection, is never placed in the page address, and is not written to our database or our application logs.
To prevent abuse, we limit how many searches can be made in a short period. For this we store a one-way cryptographic hash of your IP address (not the address itself) together with a counter, which is deleted within 24 hours.
5. Accounts and memberships
If you create an account or buy a membership, we process the information you provide, such as your name, email address, username and password (stored in hashed form), together with your membership and transaction history. Our membership system is operated on our own servers using third-party membership software.
Payments are processed by third-party payment providers, who handle your payment details under their own security standards and privacy policies.
Providing this information is voluntary, but without it we cannot create your account or provide members-only features.
Breach monitoring
Active members can ask us to monitor up to five email addresses. For each one we store the address, the account it belongs to and which breaches it has been found in, and we check it against newly added breach data once or twice a day. When it appears in a new breach, we email that address. Addresses other than your account email are only monitored after their owner confirms by clicking a link sent to that address.
You can remove a monitored address at any time. If your membership is no longer active, your monitored addresses and their breach records are deleted automatically and alerts stop.
6. When you contact us
When you use our contact form or email us, we receive your name, email address, the topic you choose and your message. We use this only to respond to you and to keep a record of the correspondence. Please do not send us passwords, full identity numbers or other sensitive information.
8. Why we process information
| Purpose | Information | Basis |
|---|---|---|
| Letting people find out whether they were exposed in a data breach, so they can protect themselves | Breach identifiers and breach details | Protecting the legitimate interests of the people affected, and our legitimate interest in providing a breach-awareness service |
| Running searches and preventing abuse | Searched email address (not stored); hashed IP address | Legitimate interest in providing a secure, reliable service |
| Providing accounts and memberships | Account and transaction information | Performing our agreement with you |
| Breach monitoring and alerts | Monitored email addresses and their breach matches | Performing our agreement with you, at your request |
| Responding to enquiries | Contact form and email content | Legitimate interest, and steps you have asked us to take |
| Meeting legal obligations | Any of the above, where required | Compliance with the law |
We plan to offer approved organisations access to breach information through an API for security, fraud-prevention and risk purposes. Before that service launches, we will update this policy to describe exactly what is shared, with whom and on what basis.
10. Where information is stored
Our servers are located in [to be completed: country]. If personal information is transferred outside South Africa, we will only do so as permitted by section 72 of POPIA — for example, where the recipient is subject to laws or binding agreements that provide an adequate level of protection.
11. How long we keep information
- Breach identifiers and details: for as long as they remain useful for breach-awareness purposes, and reviewed periodically.
- Searched email addresses: not stored.
- Hashed IP addresses for rate limiting: deleted within 24 hours.
- Monitored email addresses: until you remove them or your membership is no longer active; unconfirmed addresses are deleted after 7 days.
- Account and transaction records: while your account is active, and afterwards for as long as tax and accounting laws require.
- Correspondence: for as long as needed to deal with your enquiry and any follow-up.
12. How we protect information
We take appropriate, reasonable technical and organisational measures to protect personal information, including encrypted connections, restricted administrative access, keeping only the minimum breach data needed, hashing IP addresses used for rate limiting, and security controls that protect our forms and pages. No system is completely secure; if we become aware of a security compromise affecting your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA.
13. Your rights
Under POPIA you have the right to:
- ask whether we hold personal information about you, and request access to it;
- ask us to correct, or to delete, information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
- object to the processing of your personal information on reasonable grounds;
- object to direct marketing (we do not send unsolicited marketing); and
- lodge a complaint with the Information Regulator.
To make a request, use our contact page and choose “Privacy request”. We may need to verify your identity before acting, and we will never ask you to send a password. Requests for access to records may also be made under the Promotion of Access to Information Act, 2000 (PAIA).
14. Children
Our accounts and memberships are not intended for children under 18. Breach data can, however, include information about anyone. If you are a parent or guardian and have concerns about a child’s information, please contact us.
15. Complaints
Please contact us first so we can try to resolve your concern. You also have the right to complain to the Information Regulator:
- Website
- inforegulator.org.za
- POPIA complaints
- POPIAComplaints@inforegulator.org.za
- General enquiries
- enquiries@inforegulator.org.za · 010 023 5200
- Address
- Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
16. Changes to this policy
We may update this policy from time to time. The “last updated” date at the top shows when it was last changed. Where changes are significant, we will highlight them on this page and, where appropriate, notify members by email.
See also our Terms of use.