Privacy Policy

Overview. This Privacy Notice for Vanish Mode ("we," "us," or "our") describes how and why we collect, store, use, and share your personal information when you use our services, including when you:

• Visit our website at https://www.vanishmode.me
• Use Vanish Mode — a data removal service that automatically submits opt-out, deletion, and suppression requests on behalf of our users to data brokers, consumer reporting agencies, people-search websites, marketing databases, employment data furnishers, insurance data companies, tenant screening agencies, and financial data brokers. Users provide their personal information once through our secure intake form, and our system uses that information solely to submit legally authorized removal requests under applicable privacy laws including CCPA/CPRA, FCRA, GLBA, GDPR, and UK GDPR. We do not sell, share, or monetize user data in any form. All sensitive fields are encrypted using AES-256 encryption before storage.
• Engage with us in other related ways

Questions or concerns? Contact us at privacy@vanishmode.me

Summary of key points

• What personal information do we process? Information you provide directly: name, address, date of birth, email, and optionally SSN and government ID.
• Do we process sensitive information? Yes — SSN, driver's license, and government IDs when optionally provided. Used only to submit removal requests on your behalf.
• Do we collect info from third parties? No.
• How do we process your information? Only to provide the service — submitting opt-out requests. We do not use your data for any other purpose.
• Do we share your information? Only with infrastructure providers (Supabase, Railway, Anthropic) strictly necessary to operate the service, and with verified Data Controllers and Data Brokers to submit removal requests on your behalf.
• How do we keep it safe? AES-256 field-level encryption for all sensitive fields. TLS 1.3 in transit. JWT authentication. 15-minute session timeout.
• What are your rights? Right to access, correct, delete, and export your data at any time. Email privacy@vanishmode.me

Our commitment to data minimization

We operate under the data minimization principle as required by GDPR Article 5(1)(c) — we collect, use, and transmit only the personal data that is adequate, relevant, and strictly necessary for the specific purpose of submitting your deletion request to each individual broker.

• We do not send your SSN or driver's license to brokers that do not require them for identity verification.
• We send only the minimum fields each broker needs to locate and remove your record — nothing more.
• We do not submit deletion requests to entities that cannot action them, including Data Processors, software vendors, and service platforms that process data on behalf of others rather than holding consumer data directly.
• When a broker or third party notifies us that they are a Data Processor and not a Data Broker or Data Controller, we immediately reclassify them and permanently remove them from our automated request system.

How we select targets for removal requests

Not all companies that handle data are the same. We maintain a structured classification of every entity in our system:

We continuously review and update this classification. When we receive a complaint or notification from any entity that believes it was incorrectly classified, we investigate within 48 hours and take corrective action immediately.

1. What information do we collect?

Personal information you provide

• Full name
• Email address
• Phone number
• Mailing address (current and previous)
• Date of birth (encrypted)
• Social Security Number — optional (encrypted)
• Driver's license number — optional (encrypted)
• Government ID — optional
• Employer name

Sensitive information

When you optionally provide it, we process SSNs, driver's license numbers, and state ID numbers. These are encrypted using AES-256-CBC before storage and used exclusively to submit legally authorized removal requests to agencies that require identity verification.

Payment data

Payment information is handled entirely by Stripe. We do not store payment card numbers. See their privacy policy: Stripe Privacy Policy

2. How do we process your information?

Legal basis for processing (GDPR / UK GDPR)

Where GDPR or UK GDPR applies, we process your personal data on the following legal bases:

• Performance of a contract (Article 6(1)(b)) — processing your data to deliver the service you subscribed to
• Legitimate interests (Article 6(1)(f)) — operating and improving our service, preventing fraud
• Compliance with a legal obligation (Article 6(1)(c)) — responding to lawful requests from authorities
• Explicit consent (Article 9(2)(a)) — for processing special category data (SSN, government ID) where you have explicitly opted in

Purposes

• To deliver the service — submitting opt-out, deletion, and suppression requests to verified Data Brokers and Data Controllers on your behalf
• To manage your account — creating and maintaining your profile
• To process payments — verifying subscription status
• To respond to inquiries — customer support
• To comply with legal obligations — responding to lawful requests

We do not use your information for advertising, profiling, marketing to third parties, or any purpose beyond delivering the service you paid for.

3. When and with whom do we share your information?

We share data only with infrastructure providers strictly necessary to operate the service, and with verified Data Brokers and Data Controllers for the purpose of submitting your removal requests:

We never sell, rent, or share your personal information with advertisers, data brokers (for their own commercial use), or any third party for commercial purposes.

4. Do we use artificial intelligence?

Yes. Our agent uses Anthropic Claude to reason about opt-out submissions. When the agent processes a broker request, non-PII task context (broker name, form structure, legal basis) is sent to Anthropic's API. We never send your personal information — name, address, SSN, or any other PII — to the AI model. All sensitive data stays in our encrypted database and is only used to fill forms during the removal process.

Anthropic processes this data under a Data Processing Agreement as a Data Processor. Your personal data is never used to train Anthropic's models.

5. How long do we keep your information?

We retain your personal information for as long as your account is active. After account termination, we delete all personal data within 90 days, except where retention is required by law.

You can request immediate deletion of all your data at any time by emailing privacy@vanishmode.me

6. How do we keep your information safe?

We implement industry-standard and best-practice technical and organizational measures designed to protect your personal information against unauthorized access, loss, destruction, or alteration:

• AES-256-CBC field-level encryption for SSN, DOB, and driver's license — encrypted before writing to disk
• TLS 1.3 encryption for all data in transit
• JWT authentication with 7-day token expiry and server-side invalidation on logout and password change
• 15-minute session timeout — sensitive data cleared from memory automatically
• No localStorage — sensitive data never written to browser storage
• Tamper-evident audit log — SHA-256 hash chain on all actions
• Access controls — minimum necessary access; service role keys never exposed to client
• Dependency monitoring — regular security updates and vulnerability scanning

Security limitations and no-guarantee disclaimer

Despite our substantial efforts, no system connected to the internet can guarantee absolute security. We cannot warrant that our systems will never be compromised, that data transmitted over the internet will remain confidential in transit, or that third-party infrastructure providers we rely on (Supabase, Railway, Cloudflare, Stripe, Anthropic) will not experience a breach. We are not responsible for security incidents caused by factors beyond our reasonable control, including but not limited to:

• Zero-day vulnerabilities in software or infrastructure we rely on
• Attacks on our third-party service providers or their infrastructure
• Compromise of credentials through phishing, social engineering, or malware on a user's own device
• Government interception, nation-state attacks, or other force-majeure events
• Data re-aggregation or republication by data brokers after we have submitted a deletion request on your behalf

Data breach notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify affected users without undue delay, and where required by GDPR/UK GDPR within 72 hours of becoming aware
• Notify the relevant supervisory authority as required by applicable law
• Provide details of the nature of the breach, the categories of data involved, and the measures taken to address it

If you become aware of a security concern, contact us immediately at privacy@vanishmode.me

7. Do we collect information from minors?

No. We do not knowingly collect data from or market to anyone under 18 years of age. If you believe a minor has provided data, contact us at privacy@vanishmode.me and we will delete it immediately.

8. What are your privacy rights?

Regardless of where you are located, you have the following rights:

• Right to access — see all data we hold about you
• Right to rectification — correct inaccurate or incomplete information
• Right to erasure ("right to be forgotten") — request complete deletion of your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to restrict processing — ask us to pause processing your data
• Right to withdraw consent — stop all processing at any time without penalty
• Right to object — object to processing based on legitimate interests (GDPR Article 21)
• Right to non-discrimination — exercising any right will not affect your service
• Right to limit use of sensitive personal information — you may direct us to limit use of your sensitive personal information (SSN, driver's license, government ID) to what is necessary to provide the service. We already use it for that sole purpose — never to infer characteristics, for advertising, or for any secondary purpose.
• Right to opt out of sale or sharing — we do not sell or share personal information, so there is nothing to opt out of.

To exercise any right, email privacy@vanishmode.me. We will respond within 45 days as required by law.

9. Global Privacy Control & Do-Not-Track

We do not use any tracking technologies and we do not sell or share personal information, so browser opt-out signals — including the Global Privacy Control (GPC) and legacy Do-Not-Track — have no data to act on. We honor them by default: there is no selling, sharing, or cross-context behavioral advertising to opt out of. A GPC signal is treated as a valid opt-out even though we already do not sell or share.

10. United States residents

If you are a resident of California, Colorado, Connecticut, Virginia, Texas, or other US states with specific privacy laws, you have additional rights under CCPA/CPRA and applicable state law including the right to know, access, correct, delete, and opt out of the sale of personal information.

We do not sell personal information. We do not use it for targeted advertising. We do not create consumer profiles for commercial purposes.

Notice at collection. This policy serves as your notice at collection: the categories of personal and sensitive information we collect are in Section 1, the purposes in Section 2, and retention periods in Section 5. We do not sell or share personal information and use sensitive personal information only to provide the removal service you requested.

Authorized agent. When you authorize us at signup you designate Vanish Mode as your authorized agent to submit privacy, opt-out, deletion, suppression, and file-freeze requests to data brokers and state deletion platforms on your behalf under CCPA/CPRA, FCRA, GLBA, and your state's applicable privacy law. We retain a record of that authorization (timestamp and IP) and act only through lawful mechanisms.

To submit a request: privacy@vanishmode.me

California Shine the Light

California Civil Code Section 1798.83 permits residents to request information about personal information disclosed to third parties for direct marketing purposes. We do not disclose personal information to third parties for direct marketing purposes.

11. UK and EU residents (GDPR / UK GDPR)

If you are located in the United Kingdom or the European Union, the following additional provisions apply under the UK General Data Protection Regulation (UK GDPR) and EU General Data Protection Regulation (GDPR):

Data controller

Vanish Mode is the Data Controller for your personal data. Contact: privacy@vanishmode.me

Legal bases for processing

We process your data under the following lawful bases (GDPR Article 6):

• Article 6(1)(b) — Contract performance: processing your identity data to submit deletion requests on your behalf as part of the service agreement
• Article 6(1)(c) — Legal obligation: complying with applicable laws including CCPA, FCRA, and GDPR itself
• Article 6(1)(f) — Legitimate interests: fraud prevention, service security, and operational improvements
• Article 9(2)(a) — Explicit consent: processing special category data (SSN, government ID) where you have given explicit consent

Data minimization (Article 5(1)(c))

We are committed to the data minimization principle. We collect and transmit only data that is adequate, relevant, and limited to what is necessary for the specific purpose of each deletion request. We do not send personal data to any entity that does not have the standing or authority to action a deletion request. This specifically includes Data Processors — companies such as SaaS platforms, CRM tools, and infrastructure providers that process data on behalf of other controllers and do not hold independent consumer records.

Data transfers outside the UK/EEA

Our infrastructure providers are primarily US-based. Where personal data is transferred outside the UK or EEA, we rely on Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA) as the lawful transfer mechanism. Our key processors (Supabase, Railway, Anthropic, Stripe) operate under appropriate data processing agreements.

Your GDPR rights

In addition to the rights listed in Section 8, UK and EU residents have the following specific rights:

• Article 15 — Right of access: obtain confirmation of whether we process your data and a copy of it
• Article 16 — Right to rectification: have inaccurate data corrected without undue delay
• Article 17 — Right to erasure: have your data deleted where it is no longer necessary, you withdraw consent, or you object to processing
• Article 18 — Right to restriction: have processing restricted pending your objection or a rectification request
• Article 20 — Right to data portability: receive your data in a structured, commonly used, machine-readable format and transmit it to another controller
• Article 21 — Right to object: object at any time to processing based on legitimate interests (Article 6(1)(f)). We will cease processing unless we can demonstrate compelling legitimate grounds
• Article 22 — Automated decision-making: we do not make decisions about you solely by automated means that produce legal or similarly significant effects

Right to lodge a complaint

If you believe we have violated your data protection rights, you have the right to lodge a complaint with your supervisory authority:

• UK: Information Commissioner's Office (ICO) — ico.org.uk
• EU: Your national data protection authority — see edpb.europa.eu for a list

We ask that you contact us first at privacy@vanishmode.me so we have the opportunity to address your concern directly.

12. Notice to organizations receiving deletion requests

Vanish Mode submits data deletion and opt-out requests on behalf of individual consumers under applicable privacy law including the California Consumer Privacy Act (CCPA/CPRA), the Fair Credit Reporting Act (FCRA), and other applicable US and international privacy regulations. Our customers are private individuals exercising their legally established rights.

If you have received a request in error — for example, if your organization is a Data Processor rather than a Data Broker or Data Controller, or if you do not hold the consumer's data — please notify us immediately at privacy@vanishmode.me. We will:

• Investigate and reclassify your organization within 48 hours
• Permanently remove you from our automated request system
• Provide written confirmation of the corrective action taken

We take data minimization seriously and do not intend to send requests to entities that cannot action them. We appreciate notifications that help us improve our targeting accuracy.

13. Updates to this policy

We may update this policy as our service evolves. Material changes will be communicated via email or prominent notice on the site. The "Last updated" date at the top reflects the most recent revision.

14. Contact us

If you have questions about this privacy policy, how we handle your data, or if you are an organization that believes it received a request in error:

Vanish Mode
Email: privacy@vanishmode.me
Website: vanishmode.me

For GDPR/UK GDPR enquiries, please include "GDPR Request" in the subject line. We will respond within 30 days.