Privacy Policy

Profile Flag is operated by TBL International - FZCo, a company registered in Dubai, United Arab Emirates. We are the controller of the personal data described in this policy.

For any privacy question or request, email support@profileflag.com with "Privacy" in the subject line. We answer every request from a human.

We keep the data set deliberately small. In practice it is:

• Account data — your email address, and the one-time codes used to sign you in. We do not store passwords.
• Scan intake — whatever you submit to run a report: a name, social handles, public profile links, pasted messages, and screenshots you upload.
• Generated reports — the findings, sources, and confidence levels our analysis produced for your scan.
• Payment metadata — the fact that a payment succeeded, the amount, and the identifier our payment provider returns. We never see or store full card numbers.
• Technical logs — IP address, browser type, timestamps, and error traces, used for security, abuse prevention, and debugging.

We do not buy personal data from data brokers, and we do not collect special-category data (health, religion, political views, biometrics) on purpose. Do not submit it.

• To run the scan you asked for and deliver the report to your account.
• To authenticate you and keep your session and saved reports available.
• To take payment and issue credits, and to keep accurate billing records.
• To detect abuse, fraud, automated scraping, and misuse of the service.
• To fix bugs and improve accuracy and performance.

Our legal bases, where applicable, are performance of a contract (running your scan), legitimate interests (security, abuse prevention, product improvement), and legal obligation (accounting records).

We use a short list of service providers, each only for the function named:

• Cloud hosting and managed database — storing your account, scans, and reports.
• AI model providers — analysing the evidence you submit to produce the report text.
• Web content retrieval — fetching public pages and public profile metadata during a scan.
• Email delivery — sending sign-in codes and transactional emails.
• Payment processing (Stripe) — taking payment and handling card data on their own systems.

These providers act on our instructions and may process data outside the UAE, including in the EU and the United States. We do not sell personal data, and we do not share it for advertising or ad targeting.

• Reports and scan intake — kept while your account exists, so you can re-open them. Delete a report from your dashboard and its intake, screenshots, and findings are removed from our active systems, with backups cycling out shortly after.
• Account data — kept until you ask us to delete your account.
• Payment records — retained as long as accounting and tax rules require.
• Technical logs — kept for a limited period for security and debugging, then discarded.

You can ask us at any time to:

• Give you a copy of the data we hold about you.
• Correct anything inaccurate.
• Delete your account and everything attached to it.
• Restrict or object to a specific use.

Email support@profileflag.com from the address on your account. We verify ownership before acting, and we aim to respond within 30 days.

Profile Flag analyses public-facing information and evidence submitted by the person running the scan. We do not log into accounts, do not request access to private profiles, and do not bypass any platform's privacy settings.

A report is a summary with cited sources and confidence levels. It is not a background check, a credit check, a criminal record search, or a legal finding, and it must not be used to make decisions about employment, housing, credit, or insurance.

If you believe a report about you exists and contains inaccurate information, email us with the details. We will review it, correct or remove content where warranted, and tell you what we did.

We use cookies and browser storage for essential functions only: keeping you signed in, remembering interface preferences, and attributing affiliate referrals. We do not run advertising trackers or cross-site profiling pixels.

Data is transmitted over TLS and stored with access controls limiting who can read it. Administrative access is restricted to accounts that need it for support and abuse review. No system is perfect; if a breach affects your data, we will notify you and act to contain it.

Profile Flag is for adults. It is not directed at anyone under 18, and we do not knowingly create accounts for minors. If you believe a minor has used the service, contact us and we will remove the account.

We update this policy when the product or our providers change. The date at the top of this page always reflects the current version. Material changes will be announced by email to registered accounts.