Privacy Policy

Our commitment to protecting your personal information and privacy.

Using Osintly involves trusting us with information about your account and how you use the service. This policy explains what we collect, why we use it, who helps us process it, and the choices available to you.
You can manage your email preferences in your account settings and contact us at contact@osint.ly with questions about your data or to exercise your rights.
Osintly is an advanced Open Source Intelligence (OSINT) platform that enables users to conduct research and investigations effectively.
We are committed to transparency and security. Our infrastructure is designed to protect your data while delivering reliable search capabilities.
We collect information to provide better services to all our users. The types of information we collect include:
When you create an account, we collect personal information such as your name, email address, and account credentials.
If you make a purchase (subscription or credits), we collect payment information via our secure payment processors, Stripe (for card payments) and Plisio.net (for cryptocurrency payments).
We automatically collect information on how the platform is accessed and used. This may include your IP address, browser type, and device information.
We use Amplitude for product analytics and session replay to understand usage patterns and improve our platform.
We use Google Analytics to understand usage patterns and improve our platform.
We maintain account and service records such as your signup and last sign-in dates, credit balance, subscription status, purchase history, team membership, and recorded search or API activity. These records support account administration and the email personalization described below.
Activity dates describe events we have recorded. They do not provide a complete record of every interaction: for example, you may use an existing session without signing in again, and retained search history may be incomplete.
We employ a distributed infrastructure to ensure speed and security:
  • Database: Hosted in London.
  • Storage (R2): Located in Europe.
  • Network: Distributed globally via Cloudflare Workers.
  • Search Servers: Located across Europe, notably in Finland.
Your research data is stored securely. When you delete a search, deletion is processed almost immediately in normal conditions. During periods of high infrastructure load, deletion may take longer to complete. Once completed, all search-related data is fully removed from our database and storage systems (including R2). We also offer an Auto Delete configuration for automated data management.
We use trusted third-party services to operate our platform:
  • Cloudflare: Hosting, security, and content delivery.
  • Supabase: Database and authentication services.
  • Amplitude: Product analytics and session replay.
  • Google Analytics: User behavior analytics.
  • Resend: Transactional email delivery.
  • Amazon SES: Marketing email delivery. Marketing contacts and campaigns are managed through our self-hosted Listmonk installation.
  • Stripe: Payment processing for subscriptions and credits.
  • Plisio.net: Cryptocurrency payment processing.
  • Google Gemini & Other AI Models: Artificial Intelligence processing for summaries and chat features.
Our mapping services are self-hosted.
We use email to help you manage your account and, where permitted, keep you informed about Osintly. You control whether you receive news and offers.
Some emails are part of operating your account, such as authentication, security, payment and subscription notices. Search completion alerts follow your separate notification settings. Opting out of marketing does not cancel your account or subscription, or stop essential service emails.
Marketing emails may include product news, usage tips, reminders and personalized offers. We may group accounts using account and service information to make these messages more relevant—for example, a reminder about unused credits or information about a feature suited to your subscription.
This segmentation is a form of marketing profiling. It may use your account identifier, email address, username, signup and last sign-in dates, dates of recorded search and API activity, credit balance, subscription plan and status, trial or cancellation information, dates and types of completed purchases, team membership and role, and whether you have active API keys.
The marketing profile contains account information and activity summaries. We do not include search queries, investigation targets, search results, project files, API key secrets or payment card details in that profile. Marketing segmentation does not itself change your account access or subscription.
Where consent is required for marketing emails, we rely on your consent. You can withdraw it at any time, without affecting the lawfulness of processing before withdrawal. Where applicable law permits marketing for our similar services to existing customers without prior consent, you can object at any time.
Use the unsubscribe link in a marketing email or turn off Osintly news and offers in Settings → Notifications. Your choice is synchronized between Osintly and our mailing system. Settings may take a short time to reflect a change while synchronization completes.
Unsubscribing from marketing is separate from deleting your Osintly account. A later explicit opt-in can restore your mailing-list subscription; delivery or security restrictions may still prevent sending.
Unsubscribe links are personal to the recipient. Someone you forward an email to may also be able to use its link to manage your mailing preferences.
We manage marketing contacts, mailing preferences and campaigns using a self-hosted installation of Listmonk. Our configured marketing delivery provider is Amazon Simple Email Service (SES). It processes recipient addresses, message content and delivery information to send the emails. Resend is used separately for transactional email delivery.
Our mailing system can retain delivery and campaign statistics to help us understand whether messages are being delivered and maintain the mailing service. Individual open and click tracking is currently disabled in our Listmonk configuration.
While your Osintly account exists, its marketing contact and profile may remain in the mailing system, including after you unsubscribe. Unsubscribing stops marketing sends; it does not automatically erase the contact. We retain your mailing preference to respect that choice, and synchronize relevant account changes to keep the record accurate.
When your Osintly account is deleted, deletion of its linked marketing contact is queued. Completion depends on synchronization and provider availability; a minimal processing record may remain until that deletion succeeds. Account, billing and security records may be subject to separate retention requirements described in this policy.
You can contact contact@osint.ly to request access, correction or deletion of your marketing information, withdraw consent, or object to direct marketing, including profiling related to it.
Osintly includes optional AI-powered features such as AI Summaries and ChatIA.
  • Data is sent to AI services (like Google Gemini) only when you explicitly trigger an AI action.
  • Your research data may be processed by these third-party AI services to generate the requested output.
  • We prioritize user control and transparency regarding AI interactions.
Osintly is committed to compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.
Legal Basis for Processing:
  • OSINT Data: Our platform aggregates data that is publicly accessible on the internet. We process this data based on our legitimate interest in providing security research, educational tools, and situational awareness.
  • User Data: We process your account and payment data to perform our contract with you (providing the service) and to comply with legal obligations.
  • Marketing: Consent where required for marketing communications and associated personalization; where permitted, our legitimate interest in informing existing customers about our similar services, subject to their right to object. Accepting the Terms of Service does not, by itself, constitute marketing consent.
International Transfers:
While our primary data storage is located in Europe (London and EU), we use global service providers (such as Google, Cloudflare, and Supabase) which may involve data processing outside the EEA. We ensure these transfers are protected by appropriate safeguards, such as Standard Contractual Clauses (SCCs) or adequacy decisions, to ensure your data remains protected.
Osintly acts as a search engine and aggregator of publicly available information.
Right to Removal (Blacklist):
If you wish to have specific results regarding your personal information removed from Osintly's search index and API, please contact us at contact@osint.ly with the necessary identification documents.
Important Notice:
Please be aware that Osintly only aggregates data found publicly on the internet. Removing data from our platform does not remove it from the original source, the public web, or other third-party platforms. We have no control over the original sources of this data.
Inactive accounts are retained for an indefinite period. However, if an account remains inactive for an extended time, certain data may be deleted.
You can request the deletion of your account or download a copy of your data directly from your account settings at any time.
For both the Osintly app and API, when a search is deleted, all data associated with that search is deleted, including stored results, leak payloads, BYOK-related outputs, and other linked search artifacts.
Deletion is handled through asynchronous processing and is usually near-immediate, except during high-load periods.
After deletion, we may retain limited metadata that a search occurred (for example technical and security records) to enforce rate limits, prevent abuse, and maintain service integrity, for as long as necessary. This retained metadata does not include the deleted search payloads.
There is no strict minimum age to use Osintly, as OSINT tools are open to everyone.
However, users may be exposed to sensitive data or content not suitable for minors. We strongly recommend parental guidance and permission for users who are minors.
We implement robust security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction.
Despite our efforts, no method of transmission over the Internet or method of electronic storage is 100% secure, but we strive to use commercially acceptable means to protect your personal information.
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. You are advised to review this Privacy Policy periodically for any changes.
If you have any questions about this Privacy Policy, please contact us:
By email: contact@osint.ly
By mail: 50 AVENUE DES CHAMPS ELYSEES, 75008 PARIS

contact@osint.ly