Privacy Policy

Last updated: 13 July 2026

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, how long we retain it, and the rights available to individuals under applicable laws in the EU/UK (GDPR/UK GDPR), United States (CCPA/CPRA and state laws), MENA (including UAE PDPL), and Asian data protection laws (e.g., Singapore PDPA, Japan APPI, India DPDP, China PIPL).

1. Who we are, and our two roles

Dark Monitor is a breach & leak monitoring service operated by PWN-ALL Auditing, Reviewing & Testing Cyber Risks CO. L.L.C (“PWN-ALL”, “we”, “our”, “us”). Our registered address is: 145, Al Mustaqbal street, Iris Bay Tower 2101-11, Business Bay, Dubai, United Arab Emirates. Website: pwn-all.com.

We act in two capacities:

• As a data controller for the anonymous breach checker and for personal (individual) accounts — the processing described in sections 3.1–3.6.
• As a data processor for organization (business) accounts, where a subscribing organization uses Dark Monitor to monitor mailboxes on domains it controls. There, the organization is the controller of its employees’ mailbox data and instructs us; our processing is described in section 3.7. Employees or other individuals with questions about that monitoring should contact their organization first (see section 9).

2. The short version

• When you use the anonymous checker, the email you check never reaches our servers in readable form. It is blinded in your browser using an Oblivious Pseudorandom Function (OPRF); we only ever receive a blinded value and a derived token.
• Our breach index stores only OPRF-derived tokens — never plaintext emails, passwords, or other breach payloads.
• We never persist or log your IP address. Persistent daily rate-limit counters store only a keyed, non-reversible hash (HMAC-SHA256) of it; short-term abuse throttling holds the raw IP briefly in memory and never persists or logs it.
• We do not sell or share personal data for advertising, and we run no third-party analytics or advertising trackers.
• An organization can monitor mailboxes on a domain it has verified it controls; those mailbox addresses are stored in readable form because the organization owns and provides them. For individual monitoring, the monitored target is stored only as a derived token — but your account email itself is stored to operate your account and send you alerts (see section 3.2).
• We use a small number of service providers — a payment processor (Stripe) and an email delivery provider — and, at an organization’s instruction, deliver alerts to endpoints and identity providers that the organization configures (section 4). Web fonts are self-hosted, so no third-party font CDN is involved.

3. Data we collect, and why

3.1 Anonymous breach-check emails (not collected)

When you check an email on the home page, your browser normalizes and cryptographically blinds it before anything is sent. Our server applies its secret key to the blinded value without being able to see the address, and your browser derives the final lookup token locally. We receive and match only that token. A signed-in check is added to your history only when its token matches your verified account email; the stored history contains the token, result (found / not found) and timestamp — never a plaintext address.

3.2 Account emails (individual accounts)

If you subscribe or request a sign-in link, we process the email address you provide, together with account creation time and subscription state, to provision the account, send one-time sign-in (magic link) messages, and provide account features. Sign-in links are stored only as a keyed hash and expire after a short period or on first use.

3.3 Monitoring target (individual accounts)

When a subscriber activates monitoring, we derive an OPRF token from the already-verified account email and store that token as the account’s monitored target. The monitoring endpoint accepts no email address or caller-supplied token. If a monitored token later matches a newly imported breach source, we email an alert to the account address; the alert names the breach source and safe metadata but never contains the token. Pausing monitoring disables future matching while retaining the verified target state until the account is deleted.

3.4 Payments and subscriptions

Paid plans are handled by our payment processor, Stripe. When you start a checkout, we send Stripe the email to bill and receive back a subscription/customer identifier and status. We do not receive or store your card number — card data is handled by Stripe under its own terms and privacy policy. We store the Stripe customer and subscription identifiers, plan, seat count (for organizations), status, and renewal date to determine your entitlement. Stripe notifies us of lifecycle events (payment, renewal, cancellation) via signed webhooks.

3.5 Technical data

• Rate limiting: persistent counters store a keyed hash (HMAC-SHA256) of your IP address, reset each calendar day; the raw IP is not persisted or logged and the hash cannot be reversed without the server secret. Short-term abuse throttling additionally holds the raw IP in memory for the brief length of a rate-limit window.
• Session cookie (lm_session): an HttpOnly, SameSite=Lax cookie identifying your signed-in session. Stored server-side only as a keyed hash. Expires after 30 days or on sign-out.
• SSO state cookie (dm_sso_state): only set during a single-sign-on login, an HttpOnly, SameSite=Lax cookie that binds the login to your browser to prevent login CSRF. It is short-lived (about 10 minutes) and cleared once the login completes.
• Consent flag (lm_consent): a value in your browser’s localStorage remembering that you dismissed the consent banner. It never leaves your device.
• Proof-of-work challenges: short-lived random values (10-minute lifetime) used to deter automated abuse; they contain no personal data.

3.6 The breach index

When breach datasets are imported, each email address is converted server-side into an OPRF-derived token and the plaintext is discarded. The index stores tokens, the breach source name, description, import date and row count — nothing else. By default, addresses on corporate/organizational domains are skipped; the exception is domains that an organization has verified it controls (section 3.7), whose tokens are indexed so that organization can be alerted about its own employees. We never store the plaintext of any indexed breach address.

3.7 Organization (business) accounts

An organization can create an account, verify one or more domains it controls (by publishing a DNS TXT record we specify), and monitor mailboxes on those verified domains. Here the organization is the controller and we act on its instructions. For an organization account we process:

• Organization profile and members: the organization name, and the account identifiers, email addresses, and roles (owner / admin / member) of the people the organization adds to it. This includes pending invitations — the invited email address and role — until the invitation is accepted, revoked, or expires.
• Verified domains: the domain, the verification token to publish, and when verification succeeded.
• Monitored employee mailboxes: the mailbox address (stored in readable form, because the organization owns the domain and must be able to see which employee is affected) together with an OPRF token used to match the breach index.
• Exposure alerts: when a monitored mailbox appears in a newly imported source, we queue an alert that names the affected mailbox and the source, and email it to the organization’s owners/admins. The matched token is never emailed.
• Audit log: an append-only record of administrative actions in the organization (who did what, and when). Each entry may also record the email or identifier of the member or mailbox affected by the action. For accountability this retains the actor’s email even if that user later deletes their individual account; it is removed when the organization is deleted.
• API keys: for programmatic read-only access. We store a public prefix and a keyed hash of the key; the secret itself is shown once at creation and never stored in readable form.
• Outbound webhooks (optional): if an organization configures a webhook (e.g., to Slack, Microsoft Teams, a SIEM, or a generic endpoint), we deliver exposure events — containing the affected mailbox and source — to the URL the organization chooses. This is a transfer the organization directs and controls; the destination is the organization’s responsibility. We only store the endpoint URL and a signing salt (the signing key is derived, never stored).
• SCIM provisioning (optional): if the organization connects an identity provider, we store SCIM resource records (the user name/email as sent by the IdP, an external id, and active status) and a keyed hash of the SCIM bearer token.
• Single sign-on / OIDC (optional): if the organization enables SSO, we store its issuer URL, client id, client secret, and the allowed email domain, plus short-lived login state (about 10 minutes). During a login we exchange an authorization code and read identity claims with the organization’s configured identity provider; we only provision or authenticate an email the IdP asserts as verified and whose domain the organization has verified.

4. How data leaves our servers

We keep third parties to a minimum. The following receive personal data, each for the limited purpose described:

• Hosting providers — operate the infrastructure Dark Monitor runs on, as processors under data-processing agreements.
• Stripe — payment processing (section 3.4). Card data goes to Stripe, not to us.
• Email delivery provider — sends transactional email (sign-in links and breach alerts) over an authenticated SMTP connection. Recipient addresses and the breach source name necessarily travel through email delivery.
• Endpoints an organization configures — for organization webhooks and single sign-on, we send data (exposure events; authentication exchanges) to the URLs and identity providers the organization sets up. These are directed by the organization as controller.
• DNS — domain-verification lookups query public DNS; these carry the domain being verified, not personal data.

Web fonts are served from our own servers; we use no third-party font CDN, so no font request discloses your IP address to another party.

Some of these providers (for example, Stripe and our email provider) and the endpoints or identity providers an organization configures may be located outside the United Arab Emirates, so personal data may be transferred across borders. Where such a transfer requires it, we rely on appropriate safeguards: for EU/UK data, EU Standard Contractual Clauses and the UK IDTA/Addendum; transfer mechanisms permitted by the UAE PDPL; and, for personal information of individuals in China, PIPL-compliant mechanisms including separate consent and CAC standard contractual clauses, where applicable.

We disclose data otherwise only when required by law or to protect our rights. We do not sell personal data, and we run no advertising or analytics trackers.

5. Purposes and legal bases

We process the data above to provide the breach-check service, operate individual and organization accounts, process payments, secure the service against abuse, and comply with legal obligations. Where a legal basis is required:

• EU/UK GDPR: performance of a contract or steps prior to entering one (Art. 6(1)(b)) for checks, accounts, subscriptions and account features; legitimate interests (Art. 6(1)(f)) for abuse prevention, rate limiting and security; consent (Art. 6(1)(a)) where we ask for it explicitly. For organization accounts we act as a processor under Art. 28 on the organization’s documented instructions.
• UAE PDPL: processing necessary for a contract with you, our legitimate interests in securing the service, and consent where required.
• Singapore PDPA / Japan APPI / India DPDP / China PIPL: consent and/or statutory bases equivalent to contractual necessity and legitimate purposes, as recognized by each law. Under PIPL, where separate consent is required (e.g., for any cross-border transfer of personal information of individuals in China), we obtain it before processing.
• US state laws (CCPA/CPRA etc.): we process personal information only for the business purposes described here; we do not “sell” or “share” personal information as those terms are defined by the CPRA.

6. What we never do

• Store or log the plaintext of emails checked through the anonymous checker, lookup tokens tied to your identity beyond your own check history and your verified monitoring target, raw IP addresses, or session tokens. (Organization-owned mailbox addresses are an exception, disclosed in section 3.7: they are stored in readable form because the organization owns them.)
• Store your payment card number (that goes to Stripe, not to us).
• Sell, rent, or share personal data for cross-context behavioral advertising.
• Use third-party advertising or cross-site tracking.
• Make automated decisions producing legal or similarly significant effects.

7. Retention

• Account emails and subscription records: until the account is deleted, subject to any payment-record retention required by law.
• Sessions: 30 days, or immediately on sign-out. SSO login state: about 10 minutes. Sign-in (magic) links: short-lived, and invalidated on use.
• Check history and the verified monitoring target: while your account exists; the target’s active/paused state changes immediately when you use the monitoring control.
• Organization data (profile, members, domains, monitored mailboxes, alerts, API keys, webhooks, SCIM/SSO configuration): while the organization exists, or until the relevant item is removed; deleting the organization removes them. Audit-log entries persist while the organization exists (retaining the actor email for accountability even after that user’s individual account is deleted).
• Alert and webhook-delivery queue rows: retained with the account/organization so the record of “we alerted you” survives; the matched token is never emailed or forwarded.
• Rate-limit counters: reset daily; stale entries are overwritten.
• Proof-of-work challenges: 10 minutes.

8. Security

TLS in transit; OPRF blinding so anonymous-checker emails never reach us in readable form; keyed hashing (HMAC-SHA256) for session tokens, sign-in links, API keys, SCIM tokens and IP-derived rate-limit keys; HttpOnly, SameSite cookies with browser-bound SSO login state; proof-of-work and rate limiting against abuse; signed webhook deliveries with strict server-side validation that blocks requests to internal addresses; verified-email enforcement on single sign-on; and server secrets kept in dedicated secret storage with key versioning.

9. Your rights

Depending on where you live, you have some or all of the rights below. Individual-account holders can export their account data or delete their account at any time from the account page; deletion removes your account records and best-effort cancels any active subscription. To exercise any other right, or if you cannot use the self-service tools, write to privacy@pwn-all.com. We verify requests before acting on them and respond within the timeframe required by the applicable law (e.g., one month under GDPR, 45 days under CCPA/CPRA). Note that we cannot link breach-check tokens back to email addresses — by design — so requests can only apply to account data and your own check history.

Employees monitored under an organization account: for that data the organization is the controller. Please direct access, correction, or deletion requests to your organization; we will support it as its processor and will refer individual requests we receive to the relevant organization.

9.1 EU / UK (GDPR / UK GDPR)

Right of access, rectification, erasure (“right to be forgotten”), restriction of processing, data portability, objection, withdrawal of consent at any time, and the right to lodge a complaint with your supervisory authority (in the EU) or the ICO (in the UK).

9.2 United States (CCPA/CPRA and other state laws)

Right to know/access the personal information we hold about you, right to delete, right to correct, right to data portability, right to opt out of “sale” or “sharing” of personal information (we do not sell or share), right to limit use of sensitive personal information (we do not use it beyond providing the service), and right to non-discrimination for exercising your rights. You may use an authorized agent to submit requests.

9.3 MENA — UAE PDPL

Right to access your personal data and obtain a copy, right to rectification, erasure and restriction, right to object to processing (including for direct marketing — which we do not perform), right to data portability, and the right to complain to the UAE Data Office.

9.4 Asia

• Singapore (PDPA): right of access and correction, and the right to withdraw consent on reasonable notice.
• Japan (APPI): right to request disclosure, correction, addition or deletion of retained personal data, and cessation of use or third-party provision.
• India (DPDP Act): right to access a summary of your personal data and processing activities, right to correction and erasure, right to grievance redressal, and the right to nominate a person to exercise your rights.
• China (PIPL): right to access and copy your personal information, right to correction and deletion, right to restrict or refuse processing, right to withdraw consent, right to an explanation of processing rules, and rights of next of kin regarding a deceased person’s information.

10. Cookies and local storage

We use first-party cookies only: a session cookie (lm_session) and, during a single-sign-on login, a short-lived state cookie (dm_sso_state) — both described in section 3.5. We also use one localStorage key (lm_consent) to remember that you dismissed the consent banner. No third-party cookies, no advertising or analytics trackers.

11. Children

The service is not directed at children (under 16 in the EU/UK, under 13 in the US, or the equivalent age of consent in your jurisdiction) and we do not knowingly process their data.

12. Changes

We may update this Policy as the service evolves. The “Last updated” date above always reflects the current version; material changes will be announced on the site.

13. Contact

PWN-ALL Auditing, Reviewing & Testing Cyber Risks CO. L.L.C
145, Al Mustaqbal street, Iris Bay Tower 2101-11, Business Bay, Dubai, United Arab Emirates
https://pwn-all.com
Privacy requests: privacy@pwn-all.com
Corporate inquiries: corp@pwn-all.com