Last updated: August 22, 2026.
1. Who controls your data
The data controller is Oleh Tatarynov, a sole proprietor, of Kherson, Ukraine(“exo[intel]”, “we”). Contact us about privacy at support@exointel.watch.
2. What we collect
- Account data: email address, hashed password, and account role.
- Session data: a signed session cookie used to keep you logged in.
- Usage data:which plan you're on and how much of each metered tool (AI queries, scans, lookups) you've used this month, to enforce plan quotas.
- Tool queries: the targets you submit to recon tools (domains, IPs, usernames) are sent to the relevant lookup provider to fetch results; we do not sell this data.
- Payment data: we never see your card details — subscription payments are handled entirely by Paddle (see §5).
- Technical request data: your IP address, browser user-agent, and the page requested are recorded for each page view in our own self-hosted analytics, to measure traffic and detect abuse. This is not shared with an analytics vendor.
- Support conversations: if you contact support — in the app, by email, or through our Telegram bot — we store the messages, together with your account email and plan, in our own self-hosted helpdesk so we can answer and follow up.
- Telegram OSINT tool: if you choose to connect your own Telegram account to search channel history, you give us your phone number, the SMS login code Telegram sends you, and — only if your account has two-factor authentication — your Telegram cloud password. These are used solely to establish the connection and are never stored: the code and password are not written to disk at all, and the phone number is kept only for as long as needed to complete the login. What we do store afterward is the resulting authorized Telegram session (functionally, staying logged in on a device), encrypted at rest on our server, so you are not asked to log in again on every visit. We do not read your personal chats, contacts, or messages — the tool only searches channels you explicitly look up. You can end the connection at any time from the Telegram panel, which revokes the session with Telegram and deletes it from our server immediately.
3. Data about other people
The recon tools return information about whoever or whatever you look up, and that is often personal data belonging to someone who is not our customer. This section says plainly what happens to it, because the rest of this policy is about you.
- What is stored:for each lookup you run, we store the target you submitted and the provider's full response, attached to your account. From those responses we also derive a structured record — subjects (which may be a person, an email address, a username, a phone number, an organisation, or a piece of infrastructure), the individual facts observed about each, and the links between them — so that repeat lookups build one picture instead of a pile of transcripts.
- Who can see it: only the account that ran the lookup. Every read is scoped to your own user id and there is no parameter that widens it; other customers cannot see your results, and we do not sell, publish or pool them.
- How long it is kept:you choose, under “OSINT history retention” in your account. The default is 90 days, after which older results are deleted automatically together with every derived fact traced to them; 30 and 365 days are also offered, as is “Always”, which keeps them until you delete them or close your account. Results not attributable to any account are capped on a fixed maximum regardless of anyone's setting.
- Your responsibility as the person running the search: our Acceptable Use Policy permits these tools only against systems, domains and individuals you own or have explicit authorization to investigate. Where you use exo[intel] to process personal data about third parties, you are responsible for having a lawful basis for doing so and for meeting your own obligations to those people; we provide the tool and store the results on your behalf.
- Our own basis:we hold this material to provide the service you asked for and to keep it secure and abuse-free — our and our customers' legitimate interests — and for no other purpose. We do not use it for advertising, we do not enrich it from our own sources, and we do not build a cross-customer profile of anyone.
- If you are not our customer and believe we hold data about you: write to support@exointel.watch. You have the same access, correction, deletion and objection rights as anyone else (§8), and we will act on them or explain why we cannot. Because these records sit inside individual customers' accounts, we may need to ask you for enough detail to find them, and we may have to notify the customer concerned in order to act.
4. Why we process it (legal basis)
Account and usage data: performance of our contract with you (providing the service you signed up for). Payment data: performance of contract and our legitimate interest in fraud prevention. We do not use your data for advertising.
5. Who we share it with (processors)
- Paddle.com Market Limited — payment processing and billing (Merchant of Record) for paid subscriptions.
- Google (Gemini)— the AI assistant, the region briefs and the AI summaries of tool results are generated by Google's Gemini models. When you use any AI feature, the text of your request is sent to Google, together with the material the feature needs to answer: the results the OSINT tool returned, the search results behind a region brief, or the message history of that assistant conversation. Your account identity and payment details are never included. If you would rather no third party see a particular query, do not put it to the AI — the non-AI tools and map layers do not send anything to Google.
- Public data-source APIs the recon tools call on your behalf (e.g. DNS resolvers, WHOIS registries, certificate-transparency logs) — only the target you look up is sent, never your account details.
- Telegram— if you connect your own Telegram account (above), our server talks to Telegram's own API on your behalf, using your authorized session, to run the channel searches you request. This is inherent to using your Telegram account through our tool rather than Telegram's own app: Telegram sees the connection and the API calls we make for you, from our server rather than your device. You remain subject to Telegram's own privacy policy for your Telegram account itself.
- Web search engines — region briefs are built from live news found through our own self-hosted search service, which queries public search engines. The region name you asked about reaches those engines; your identity does not.
- Map and font providers— the map loads basemap tiles from CARTO and, in satellite view, imagery from Esri, and the interface loads fonts from Google Fonts. Your browser contacts these directly, so they receive your IP address and the map area you are viewing. Place names shown as you move the map are resolved through OpenStreetMap's Nominatim service, which receives the map coordinates.
Our analytics and helpdesk (§2) run on our own infrastructure, not a third-party service. We do not sell personal data to third parties.
6. International transfers
Some processors above may process data outside your country of residence — in particular, AI requests are processed by Google outside the EEA, and payments by Paddle in the UK/EU. Where required, transfers rely on Standard Contractual Clauses or an equivalent safeguard.
7. Retention
We keep account and usage data for as long as your account is active, plus a limited period afterward for legal and accounting purposes. You can request deletion at any time (§8). A connected Telegram session (§2) is kept, encrypted, until you disconnect it or delete your account — disconnecting revokes it with Telegram and removes it from our server immediately. Lookup results and the record derived from them follow the window you choose yourself (§3): 90 days by default, and deleted automatically once past it.
8. Your rights
Subject to applicable law — including the GDPR if you're in the EU/UK, and Ukraine's Law “On Personal Data Protection” as the controller's home jurisdiction — you have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, email support@exointel.watch. If you're in the EU/UK, you also have the right to lodge a complaint with your local data-protection authority.
9. Cookies
We use essential cookies only: a signed session cookie to keep you signed in, and a preference cookie remembering your chosen interface language. We do not use advertising or cross-site tracking cookies.