Privacy policy

OFACScreen is the controller of the personal data described in this policy, except where section 5 says we act for our customers. Contact us about privacy at [email protected].

• Account data: name, email address, company name, industry, phone number if you give it, a hashed password, sign-in history, plan and usage, how you first found us (referring site and campaign), and the IP address and Google Analytics identifier of the browser you signed up and paid from.
• Team data: the email addresses and roles of team members you invite.
• Billing data: your name, email, company and Stripe customer and subscription identifiers. Card details are collected by Stripe and never reach our servers.
• Screening data: what you search for (names, ID numbers, addresses, email addresses, websites and phone numbers), the results, settings, your match decisions and notes, monitored names and addresses, uploaded files and batch results, and the time of each search. For searches on the website, including the free search, and through the MCP server, we also record the IP address the search came from.
• Report purchases: the search, its results, your email address and name if you give them, the Stripe payment identifier and the Google Analytics identifier of your browser.
• Training data: the names, email addresses and roles of people a customer adds to training, the modules assigned, quiz answers and scores, acknowledgments and completion records.
• Messages: emails you send us and the contact form (name, email, company, message), and our replies.
• Usage and device data: pages visited, including search terms that appear in page addresses, approximate location, browser and device information, collected through the cookies and tools in section 8 and our server logs.

• To provide the Service you signed up for or bought: running searches, monitoring, batch screening, reports, records, training and billing, and sending service emails. Legal basis: performance of our contract with you or your organization (GDPR Art. 6(1)(b)), or our legitimate interest in serving the organization you represent (Art. 6(1)(f)).
• To keep records of screening and training so that you can show what was checked and when (section 7). Legal basis: our legitimate interest, and yours, in reliable compliance records (Art. 6(1)(f)).
• To support you and answer messages. Legal basis: contract, or our legitimate interest in answering enquiries (Art. 6(1)(b) or (f)).
• To secure the Service, prevent fraud and abuse and enforce usage limits, including by logging free and MCP searches. Legal basis: legitimate interest (Art. 6(1)(f)).
• To understand and improve the website and the Service, and to measure our advertising. Legal basis: legitimate interest (Art. 6(1)(f)) or, where the law requires it for cookies, your consent (Art. 6(1)(a)).
• To send you information about the Service if you are a customer or have asked for it. Legal basis: legitimate interest (Art. 6(1)(f)). Every such email has a link to unsubscribe.
• To comply with the law, including tax, accounting and lawful requests from authorities. Legal basis: legal obligation (Art. 6(1)(c)).

We do not sell personal data for money, and we do not use it for automated decisions that have legal or similarly significant effects on you.

The sanctions lists in the Service contain personal data about designated individuals, such as names, aliases, dates of birth, nationalities, addresses and identification numbers. We obtain this data from the official lists published by the authorities that issue them, shown on our Data Sources page. We process it as controller, based on our legitimate interest, and the public interest, in enabling businesses to comply with sanctions law (Art. 6(1)(f)). We keep each entry for as long as it appears on the source list, and afterwards as part of the screening records that relied on it.

You can use your rights under section 11 for this data. Because we reproduce official lists, a request to correct or remove a designation must normally be made to the authority that published it.

When a customer screens a person, monitors them, or adds staff to training, the customer decides what data to enter and why. For that data we act on the customer's behalf as a processor, under section 6 of our Terms of Service, and the customer is responsible for having a lawful basis and for informing the people concerned. If your data was entered by one of our customers, please contact that customer first. We will help them answer your request.

A training completion record can be checked on a public verification page reached through a link the customer receives. The page shows the name and company entered by the customer, a partly hidden email address, the module, the score and the date. It is not listed by search engines.

We share personal data only with providers that help us run the Service, and only what each needs:

• DigitalOcean hosts our servers and database in Amsterdam, the Netherlands.
• Cloudflare carries all traffic to the website and receives incoming email to ofacscreen.com addresses before it reaches our servers.
• Stripe processes payments and receives your billing details. Stripe processes payment data as an independent controller under its own privacy policy.
• Brevo sends our emails, including emails that contain search results, alerts and training invitations.
• Google provides Google Analytics, Google Tag Manager and Google Ads measurement. When you are signed in, Google Analytics also receives your account's internal number, so visits from your different devices count as one person. It never receives your name, your email address or the names you screen.
• Microsoft Clarity records how pages are used (clicks, scrolling and page addresses). Search boxes and search results are masked so their content is not recorded.
• Anthropic provides an AI model that helps us draft replies to support emails. It reads the email conversation and basic details of the sender's account.
• jsDelivr delivers a script used by the website.

We may also disclose data where the law requires it, to protect our rights, to our advisers where needed to establish, exercise or defend legal claims, or to a buyer or successor of the Service.

• Screening and training records (searches, results, match decisions, reports, batch results, monitoring history and training records): 10 years from when they were created, including after an account is closed, because they are records customers may need to produce under U.S. sanctions rules.
• Uploaded files: a file uploaded for batch screening or monitoring is deleted 30 days after upload, or earlier when you delete the upload. The results are kept as a screening record.
• Account data: while the account is open, and afterwards as long as it is needed for the records above, for billing and tax records, or to handle claims.
• Messages and contact form submissions: as long as needed to handle them and any follow-up. Copies of incoming email held by Cloudflare are deleted after 30 days.
• Analytics data: Google Analytics keeps it for up to 14 months.

• Necessary: sessionid (keeps you signed in and holds your search session, up to two weeks) and csrftoken (protects forms, 1 year).
• Analytics: Google Analytics (_ga, _ga_*, up to 13 months) and Microsoft Clarity, which runs without cookies.
• Advertising measurement: Google Ads (_gcl_au, 90 days) records whether a visit came from one of our ads.

You can block or delete cookies in your browser settings, and opt out of Google Analytics with Google's browser add-on. Blocking necessary cookies stops sign-in from working.

Our servers are in the European Union. Some of the providers in section 6 process data in the United States or other countries. Where data protected by EU law leaves the European Economic Area, the transfer relies on the European Commission's standard contractual clauses or the provider's certification under the EU-U.S. Data Privacy Framework.

Data travels encrypted (HTTPS). Passwords are stored as one-way hashes, API keys are stored hashed, and access to production systems is limited to the people who run the Service. No system is completely secure, and we cannot guarantee the security of data sent to us.

Depending on where you live, you may have the right to access your personal data, correct it, have it deleted, restrict or object to its use (including use based on our legitimate interests, and direct marketing at any time), receive it in a portable format, and withdraw consent you gave. Residents of California and other U.S. states with privacy laws may also ask what we collect and disclose, ask us to delete it, and opt out of the use of their data for targeted advertising; we will not treat you differently for using these rights.

Some rights are limited where we must keep records (section 7) or need data to handle a legal claim. To use your rights, email [email protected]. We may need to confirm your identity, and we answer within one month, or within 45 days where U.S. state law sets that period. In the EU you can also complain to a data protection authority, such as the one in your country.

The Service is for businesses and is not meant for anyone under 18. We do not knowingly collect children's data, and if we learn that we have, we delete it promptly.

We will update this policy when our use of personal data changes, and tell account holders about material changes by email or in the Service. The date at the top shows the latest version.

Email: [email protected].