Privacy Policy

Our commitment to protecting your personal information and privacy.

Using Osintly involves trusting us with information about your account and how you use the service. This policy explains what we collect, why we use it, who helps us process it, and the choices available to you.
You can manage your email preferences in your account settings and contact us at contact@osint.ly with questions about your data or to exercise your rights.
Osintly is an advanced Open Source Intelligence (OSINT) platform that enables users to conduct research and investigations effectively.
We are committed to transparency and security. Our infrastructure is designed to protect your data while delivering reliable search capabilities.
We collect information to provide better services to all our users. The types of information we collect include:
When you create an account, we collect personal information such as your name, email address, and account credentials.
If you make a purchase (subscription or credits), we collect payment information via our secure payment processors, Stripe (for card payments) and Plisio.net (for cryptocurrency payments).
We automatically collect information on how the platform is accessed and used. This may include your IP address, browser type, and device information.
With your consent, we use Google Analytics to understand usage patterns and improve our platform, and advertising pixels to measure our ads. See Cookies & Similar Technologies below.
We maintain account and service records such as your signup and last sign-in dates, credit balance, subscription status, purchase history, team membership, and recorded search or API activity. These records support account administration and the email personalization described below.
Activity dates describe events we have recorded. They do not provide a complete record of every interaction: for example, you may use an existing session without signing in again, and retained search history may be incomplete.
We employ a distributed infrastructure to ensure speed and security:
  • Database: Hosted in London, United Kingdom.
  • Storage (R2): Located in the European Union.
  • Network: Distributed globally via Cloudflare Workers.
  • Search Servers: Located in the European Union, in Finland and Germany.
Your research data is stored securely. When you delete a search, deletion is processed almost immediately in normal conditions. During periods of high infrastructure load, deletion may take longer to complete. Once completed, all search-related data is fully removed from our database and storage systems (including R2).
We use trusted third-party services to operate our platform:
  • Cloudflare: Hosting, security, and content delivery.
  • Supabase: Database and authentication services.
  • Google Analytics: Audience measurement, loaded through Cloudflare Zaraz with your consent.
  • Meta, X and Google Ads: Advertising measurement pixels, loaded only with your consent.
  • Resend: Transactional email delivery.
  • Amazon SES: Marketing email delivery. Marketing contacts and campaigns are managed through our self-hosted Listmonk installation.
  • Stripe: Payment processing for subscriptions and credits.
  • Plisio.net: Cryptocurrency payment processing.
  • Microsoft Azure OpenAI: Artificial Intelligence processing for summaries, chat features and the selection of retention offers.
  • Hetzner: Hosting of our search servers in Germany and Finland.
  • Tavily: Web search, used only when you ask the AI analyst to search the web.
  • Jina AI: Reading of public web pages for some tools.
  • CARTO, OpenStreetMap Nominatim and geocoding.ai: Map display and location lookup for places shown in results.
To run a search, the identifier you submit is sent to third-party data sources, including public websites, data-breach search providers and OSINT data providers, and may pass through technical intermediaries such as proxy and captcha-solving services.
We use necessary cookies and browser storage to sign you in, keep your session secure, remember your preferences and store your cookie choice. They are required for the service and do not need consent.
With your consent, we also use the following optional tools:
  • Audience measurement: Google Analytics 4, loaded through Cloudflare Zaraz, to understand how the site is used.
  • Advertising: the Meta Pixel, the X Pixel and the Google Ads tag, to measure the results of our advertising. These providers act under their own privacy policies and may combine this information with other data they hold about you.
No optional tool loads before you make a choice. In the cookie banner you can accept all, reject all, or choose by category. Rejecting is as easy as accepting and does not limit your use of Osintly.
Your choice is kept for six months, after which we ask again. You can change it at any time from Cookie Settings in the site footer or in Settings → Data & Privacy. When you withdraw consent, we stop loading the related tools and delete their cookies set on our domain.
We use email to help you manage your account and, where permitted, keep you informed about Osintly. You control whether you receive news and offers.
Some emails are part of operating your account, such as authentication, security, payment and subscription notices. Search completion alerts follow your separate notification settings. Opting out of marketing does not cancel your account or subscription, or stop essential service emails.
Marketing emails may include product news, usage tips, reminders and personalized offers. We may group accounts using account and service information to make these messages more relevant—for example, a reminder about unused credits or information about a feature suited to your subscription.
This segmentation is a form of marketing profiling. It may use your account identifier, email address, username, signup and last sign-in dates, dates of recorded search and API activity, credit balance, subscription plan and status, trial or cancellation information, dates and types of completed purchases, team membership and role, and whether you have active API keys.
The marketing profile contains account information and activity summaries. We do not include search queries, investigation targets, search results, project files, API key secrets or payment card details in that profile. Marketing segmentation does not itself change your account access or subscription.
Where consent is required for marketing emails, we rely on your consent. You can withdraw it at any time, without affecting the lawfulness of processing before withdrawal. Where applicable law permits marketing for our similar services to existing customers without prior consent, you can object at any time.
Use the unsubscribe link in a marketing email or turn off Osintly news and offers in Settings → Notifications. Your choice is synchronized between Osintly and our mailing system. Settings may take a short time to reflect a change while synchronization completes.
Unsubscribing from marketing is separate from deleting your Osintly account. A later explicit opt-in can restore your mailing-list subscription; delivery or security restrictions may still prevent sending.
Unsubscribe links are personal to the recipient. Someone you forward an email to may also be able to use its link to manage your mailing preferences.
We manage marketing contacts, mailing preferences and campaigns using a self-hosted installation of Listmonk. Our configured marketing delivery provider is Amazon Simple Email Service (SES). It processes recipient addresses, message content and delivery information to send the emails. Resend is used separately for transactional email delivery.
Our mailing system can retain delivery and campaign statistics to help us understand whether messages are being delivered and maintain the mailing service. Individual open and click tracking is currently disabled in our Listmonk configuration.
While your Osintly account exists, its marketing contact and profile may remain in the mailing system, including after you unsubscribe. Unsubscribing stops marketing sends; it does not automatically erase the contact. We retain your mailing preference to respect that choice, and synchronize relevant account changes to keep the record accurate.
When your Osintly account is deleted, deletion of its linked marketing contact is queued. Completion depends on synchronization and provider availability; a minimal processing record may remain until that deletion succeeds. Account, billing and security records may be subject to separate retention requirements described in this policy.
You can contact contact@osint.ly to request access, correction or deletion of your marketing information, withdraw consent, or object to direct marketing, including profiling related to it.
Osintly includes optional AI-powered features such as AI Summaries and ChatIA.
  • Data from your searches is sent to AI services (such as Microsoft Azure OpenAI) only when you explicitly trigger an AI action.
  • Your research data may be processed by these third-party AI services to generate the requested output.
  • We prioritize user control and transparency regarding AI interactions.
Retention offers:
When you start cancelling a subscription or an API plan, we use an AI model to choose which of our predefined retention offers to show you. The model receives the cancellation reason you select and information about your account: your plan, account and subscription age, usage, payments, total amount paid, credit purchases, failed or refunded payments and previous discounts. For organization subscriptions, it also receives seat and member counts. It does not receive your searches, investigation targets or search results.
This is a form of profiling based on our legitimate interest in offering relevant alternatives before you leave. The model can only choose among offers we have defined in advance. It cannot prevent or delay your cancellation, and you can cancel without accepting any offer. You can object to this processing at any time by contacting contact@osint.ly.
Osintly is committed to compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.
Legal Basis for Processing:
  • OSINT Data: Our platform aggregates data that is publicly accessible on the internet. We process this data based on our legitimate interest in providing security research, educational tools, and situational awareness.
  • User Data: We process your account and payment data to perform our contract with you (providing the service) and to comply with legal obligations.
  • Marketing: Consent where required for marketing communications and associated personalization; where permitted, our legitimate interest in informing existing customers about our similar services, subject to their right to object. Accepting the Terms of Service does not, by itself, constitute marketing consent.
International Transfers:
Our primary database is hosted in London, United Kingdom, which is outside the European Union but benefits from an EU adequacy decision. Our storage and search servers are located in the European Union. We also use global service providers (such as Google, Microsoft, Cloudflare, and Supabase) which may involve data processing outside the EEA. We ensure these transfers are protected by appropriate safeguards, such as Standard Contractual Clauses (SCCs) or adequacy decisions, to ensure your data remains protected.
Under the GDPR and French data protection law, you have the right to:
  • Access your personal data and receive a copy of it.
  • Rectify data that is inaccurate or incomplete.
  • Erase your data.
  • Restrict the processing of your data.
  • Data portability: receive the data you provided in a structured, machine-readable format.
  • Object at any time to processing based on our legitimate interest, including profiling, and to direct marketing.
  • Withdraw your consent at any time, without affecting processing carried out before the withdrawal.
  • Give instructions on what happens to your data after your death.
You can download your data and delete your account from your account settings, or contact us at contact@osint.ly. We answer within one month. For complex or numerous requests, this period can be extended by two further months, in which case we tell you why. We may ask for information to confirm your identity.
You also have the right to lodge a complaint with the French data protection authority, the CNIL (3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07), or with the supervisory authority of the country where you live or work.
Osintly acts as a search engine and aggregator of publicly available information.
Right to Removal (Blacklist):
If you wish to have specific results regarding your personal information removed from Osintly's search index and API, please contact us at contact@osint.ly with the necessary identification documents.
Important Notice:
Please be aware that Osintly only aggregates data found publicly on the internet. Removing data from our platform does not remove it from the original source, the public web, or other third-party platforms. We have no control over the original sources of this data.
Your account is kept until you delete it.
Your searches and results are kept until you delete them or delete your account.
Payment records are kept by our payment processors, and invoices are kept for 10 years to meet our accounting obligations.
You can request the deletion of your account or download a copy of your data directly from your account settings at any time.
For both the Osintly app and API, when a search is deleted, all data associated with that search is deleted, including stored results, leak payloads, BYOK-related outputs, and other linked search artifacts.
Results of tools run without an account are linked to your browser for 30 days, then deleted.
Deletion is handled through asynchronous processing and is usually near-immediate, except during high-load periods.
After deletion, we may retain limited metadata that a search occurred (for example technical and security records) to enforce rate limits, prevent abuse, and maintain service integrity, for as long as necessary. This retained metadata does not include the deleted search payloads.
You must be at least 15 years old to create an Osintly account or use the service. If we learn that an account belongs to someone under 15, we may suspend or delete it.
Users may be exposed to sensitive data or content not suitable for minors. We strongly recommend parental guidance and permission for users aged 15 to 17.
We implement robust security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction.
Despite our efforts, no method of transmission over the Internet or method of electronic storage is 100% secure, but we strive to use commercially acceptable means to protect your personal information.
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. You are advised to review this Privacy Policy periodically for any changes.
If you have any questions about this Privacy Policy, please contact us:
By email: contact@osint.ly
By mail: 50 AVENUE DES CHAMPS ELYSEES, 75008 PARIS

contact@osint.ly