PRIVACY POLICY
Last Updated: October 3, 2026
Your Privacy Matters
This Privacy Policy explains how Stepan Parkulab (trading as CreepyCORE) collects, uses, and protects personal data when you use our OSINT platform, in accordance with UK GDPR, EU GDPR, and the Data Protection Act 2018.
This Policy is incorporated into our Terms of Service. By using the Services, you acknowledge this Policy. Where we rely on consent, you may withdraw it as described below.
Important:
If you do not agree with this Privacy Policy, please do not access or use our Services.
1. Data We Collect
1.1 Information You Provide
We collect information that you voluntarily provide when you:
- Create an account: email, username, password (encrypted), age confirmation (18+)
- Complete your profile: name, photo, bio, contact information
- Use our Services: scan configurations, queries, lawful-use attestations, encrypted API keys, notes and reports
- Contact support: tickets, messages, feedback
- Make payments: billing data processed by Stripe — we do not store card numbers
1.2 Automatically Collected Information
When you access our Services we may collect device type, browser, usage events, approximate location derived from IP, and security-related identifiers (including device/session signals used to detect credential sharing and unauthorized access). Login and security events may be recorded in tamper-evident audit logs (timestamp, IP, approximate geo, device fingerprint hash). We use these signals strictly for authentication, fraud prevention, and audit — not for advertising profiling.
1.3 Cookies and Tracking
We use cookies and similar technologies as described in Section 8 and our Cookie Policy. Non-essential storage requires your consent under UK PECR.
1.4 Third-Party API Keys (BYOK)
If you supply third-party API keys, we store them encrypted and use them only to perform requests you initiate.
Your Responsibility:
You are responsible for validity, permissions, and compliance of any keys you provide. CreepyCORE is not liable for charges or issues from third-party APIs.
1.5 Collaboration & Profile Visibility (Optional)
If you use Online Mode, friends, or groups, you may choose what other members see (for example profile photo visibility to friends, or email visibility to group members). These preferences are off or limited by default where applicable; you control them in Settings. We process this data to operate social features you enable.
1.6 Scan Observation Index (Optional)
By default, entities from your completed scans (such as emails, domains, IPs, usernames, or phone numbers) may be indexed in your private workspace lookup and graph tools. You can enable Private mode in Settings to skip building this observation index while keeping scan job history in your dashboard.
2. Data Controller & Contact
For the purposes of UK GDPR and EU GDPR, the data controller for CreepyCORE account and platform data is:
Stepan Parkulab (trading as CreepyCORE)
- Suite RA01, 195-197 Wood Street
- London, E17 3NU
- United Kingdom
Email: privacy@creepycore.com
The operator is established in the United Kingdom. For questions about UK GDPR, contact us at the address above.
We assess ICO registration requirements annually and register with the Information Commissioner's Office when required for our processing activities.
3. Lawful Bases for Processing (UK / EU GDPR Art. 6)
We process personal data only where we have a lawful basis. The table below describes how we process account and platform data when you use CreepyCORE:
- Account creation & authentication — Contract (Art. 6(1)(b)): necessary to provide the Services you sign up for.
- Billing & subscriptions — Contract (Art. 6(1)(b)) and Legal obligation (Art. 6(1)(c)) where tax/accounting records are required.
- Security, fraud prevention & audit logs — Legitimate interests (Art. 6(1)(f)): protecting accounts, detecting abuse, and maintaining tamper-evident audit records; balanced against your rights.
- Device / session fingerprinting for security — Legitimate interests (Art. 6(1)(f)): detecting credential sharing, replay, and unauthorized access; we do not use this for advertising.
- Product analytics (if you consent) — Consent (Art. 6(1)(a)): only when you enable analytics cookies.
- Marketing (if ever offered and enabled) — Consent (Art. 6(1)(a)).
- Support communications — Contract or Legitimate interests depending on context.
- Legal compliance & law enforcement requests — Legal obligation (Art. 6(1)(c)) or Legitimate interests.
Withdraw consent:
Where processing is based on consent (cookies, optional analytics), you may withdraw consent at any time via cookie settings or by contacting privacy@creepycore.com without affecting the lawfulness of processing before withdrawal.
4. OSINT Scan Data & Third-Party Personal Data
When you run OSINT scans, you may process personal data about third parties (for example email addresses, usernames, or IP addresses). Roles and responsibilities depend on who decides why and how that data is processed:
- CreepyCORE (platform operator) acts as data controller for your account data, billing, security logs, and infrastructure that stores your scan jobs and results in your private workspace.
- You (the customer) are typically the data controller for personal data about third parties that you choose to query, collect, or analyse using the Services — unless a specific integration agreement states otherwise.
- Third-party API providers (HIBP, Shodan, etc.) may act as processors or independent controllers under their own terms; you must comply with their policies and applicable law.
4.1 Your obligations as OSINT user
Before running scans you must confirm lawful purpose and authorization where required (see Terms §5). You are responsible for:
- Identifying and documenting a lawful basis under UK GDPR / applicable law before processing third-party personal data.
- Data minimisation — query only what you need for your stated purpose.
- Accuracy — verify findings before taking action that affects individuals.
- Retention — delete or anonymize results when no longer needed.
- Respecting individuals' rights (access, erasure, objection) where you are controller.
- Not using the Services for harassment, stalking, or unauthorized access to systems.
4.2 Data Protection Impact Assessment (DPIA)
Systematic OSINT processing that may affect individuals at scale can be high-risk under UK GDPR. If your use case involves large-scale monitoring, profiling, or sensitive categories of data, you should conduct a DPIA before processing and keep a record of your assessment. CreepyCORE provides tools; you remain responsible for lawful use.
Scan attestation:
The platform requires you to attest that each scan is for a lawful purpose and that you have authorization where required. We log attestations in our audit system (timestamp, user, hashed target) for compliance and abuse prevention.
5. How We Use Your Data
We use personal data to provide and secure the Services, process subscriptions, prevent fraud, maintain audit logs, respond to support requests, improve the product (where permitted), and comply with legal obligations — always on a lawful basis as set out in Section 3.
6. How We Share Your Data
Important:
We do NOT sell your personal data or scan results. Your OSINT research stays private to your account unless you choose to share it.
We share data with processors such as Supabase (auth/database), Stripe (payments), email providers, and hosting/CDN partners under data processing terms requiring appropriate safeguards.
When you enable friends, groups, or visibility settings, limited profile information you choose to share may be visible to other users in those contexts (for example friends who can see your profile photo, or group members who can see your email). Scan results and OSINT findings are not shared with other users unless you explicitly export or share them.
We may disclose information when required by valid legal process or to protect rights, safety, and integrity of users and the platform.
7. Data Security
We use encryption in transit and at rest, strong authentication options including 2FA, access controls, monitoring, signed audit logs, and regular updates. No method is 100% secure — use strong passwords and protect API keys.
9. Your Privacy Rights
Under UK GDPR and EU GDPR you may have the right to access, rectify, erase, restrict processing, object, data portability, and withdraw consent where processing is consent-based.
UK users may lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk or 0303 123 1113. EEA users may contact their local supervisory authority.
To exercise rights: privacy@creepycore.com or in-app tools. We typically respond within 30 days.
10. Data Retention
We retain data while your account is active; after deletion we erase or anonymize within about 90 days except legal/financial retention (e.g. invoices ~7 years), security/audit logs, or litigation holds.
11. International Data Transfers
Data may be processed in the UK, EEA, and other countries where our processors operate. For transfers outside the UK/EEA we use UK IDTA / EU Standard Contractual Clauses and supplementary measures where required. Contact privacy@creepycore.com for transfer information.
12. Children's Privacy & Minimum Age
CreepyCORE is not directed at users under 18. You must confirm you are at least 18 when creating an account. We do not knowingly collect data from children under 18 without verified parental consent. Contact privacy@creepycore.com to exercise parental rights.
13. Changes to This Privacy Policy
We may update this Policy, change the Last Updated date, notify you of material changes by email or notice, and where required seek consent.
14. Contact Us
Questions about privacy or data practices:
privacy@creepycore.com
support@creepycore.com
security@creepycore.com
Your Privacy, Our Priority
Transparent data practices for security professionals — UK GDPR aligned.