Privacy

1. Who we are

OnlyHere is run by Paragon Consulting FZE, Twin Towers, P.O. Box 4422, Fujairah, United Arab Emirates ("we", "us"). We decide how and why the personal data described here is used, so we are its controller. You can reach us through the contact form; choose "Privacy or data request".

EU representative. We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the European Union (EU). Prighter gives you an easy way to exercise your privacy-related rights (for example, requests to access or erase personal data). If you want to contact us through our representative or make use of your data subject rights, visit app.prighter.com/portal/15292804891.

This notice covers three groups of people: creators who sign up, visitors to onlyhere.me and its pages, and people whose public accounts our watch finds and captures.

2. What we collect from creators

• Account details. Your email address, your page name, your plan, and the sign-in record our login provider keeps for you. Your password is held by that provider as a hash; we never see it.
• What you put on your page. Your channel links, the platforms you say you don't use, your contact rules, and the email domains you prove. These are published on your page by design.
• What you give us for the watch. Other names your audience uses, your handles, and websites you own. These stay private and are used only to search.
• Proof records. The one-time codes we issue, the date each channel was proved, and a dated screenshot of each public profile when we read the code. The same for email domains proved by DNS record.
• The outcome of your ID check. Whether it passed, the name as printed on the document, the issuing country, the document type and the date. If a check doesn't pass, the reason and, where relevant, that the holder was under 18. We do not keep your ID images, your selfie or your date of birth.
• Billing references. Your Stripe customer and subscription references, your plan and interval, and the billing status. Stripe holds your card; we never see the full number.
• Findings. For each account our watch finds: the link, a dated capture of the public page, the AI label (likely impersonation, unclear or dismissed) with its one-line reason, and whether it is still up when we recheck.
• Capsule records, when the capsule opens. The fingerprints (SHA-256 hashes), file names and sizes you choose to anchor, and the timestamp tokens. Your photos, voice and video are fingerprinted on your own device and never uploaded.
• Messages. The emails we send you, and anything you send through the contact form.

3. What we collect from visitors

The site sets no cookies and runs no analytics or advertising scripts. Signing in to your dashboard keeps a session token in your browser's session storage, which is cleared when you close the tab. When you use Check an account, the comparison runs in your browser against the creator's public page data; what you paste is not sent to us. If you use the contact form, we keep your name (if given), email address, topic and message. Our servers keep short technical logs (time, request path, errors) to run and secure the service.

4. What we collect about other people

The watch searches the public web for accounts using a creator's name. When it finds a candidate, it opens the public page in an isolated cloud browser and keeps a screenshot, the visible text, the link and the date. It never signs in, never messages anyone and never publishes anything about the account. The capture goes privately to the creator who asked us to watch. If you believe we hold a capture of your account in error, use the contact form and we will look at it.

5. Why we use it, and on what legal basis

• To provide the service you signed up for: your account, your page, channel proofs, the watch, alerts, reports and billing. Basis: performance of our contract with you.
• The ID check. The face comparison uses biometric data. We rely on your explicit consent, which you give by ticking the box before the check starts. You can withdraw it, but a page can't go live without a passed check.
• Capturing other people's public accounts. Basis: our legitimate interest, and the creator's, in detecting and evidencing impersonation. We capture only public pages and share them only with that creator.
• Security, abuse prevention and technical logs. Basis: legitimate interests.
• Tax and accounting records. Basis: legal obligation.

We don't sell personal data, we don't use it for advertising, and we don't use it to train AI models.

6. Automated decisions

OnlyHere is fully automated. Two results are decided by software without a person reviewing them: whether your ID check passes, which decides whether your page can go live, and the label on each finding. If you think an ID result is wrong, you can start the check again with a different document, or contest the result through the contact form, and someone will review it. Finding labels are suggestions to you and change nothing on their own.

7. Who processes data for us

• Amazon Web Services: hosting, storage, database, sign-in (Amazon Cognito), email delivery (Amazon SES), the cloud browser that reads public pages (Amazon Bedrock AgentCore), and the AI model that labels findings (Anthropic's Claude, run through Amazon Bedrock). Region: Frankfurt, except AI labelling (see section 8).
• Didit: the ID check. Didit stores the images in the EU. When the result reaches us, we tell Didit to delete the session; if that request fails, Didit deletes it after one month. We have opted out of Didit using the data to train its models.
• Stripe: card payments, subscriptions, invoices and the billing portal. Stripe is also a controller of payment data under its own privacy policy.
• Brave Search: web searches for a creator's public name, aliases and handles. Searches contain those terms and nothing else about you.
• Timestamp authorities, when the capsule opens: each receives one fingerprint per capsule, never a file.

8. Where it is kept

Your account records, page data, captures and findings are stored by Amazon Web Services in Frankfurt, Germany. Two things leave the EU. AI labelling sends the text of public pages, together with the names being searched, to Anthropic's Claude through Amazon Bedrock's global inference, which can process a request in any AWS commercial region. Brave Search queries are processed by Brave in the United States. Stripe may process payment data outside the EU. Where a provider processes data outside the EU, we rely on the transfer safeguards in its data-processing terms. We are based in the UAE, and administrative access to our systems happens from there.

9. How long we keep it

• ID images and selfies: deleted at Didit when the result reaches us, and after one month at the latest.
• Account, page, proof records, captures and findings: while your subscription runs. When it ends, your page stays up for 90 days with a banner showing the date it was last checked. After that the page is replaced by a short notice, and we delete these records within a further 30 days.
• Billing records: Stripe and we keep invoices and payment records for as long as tax and accounting law requires.
• Evidence-pack downloads: deleted 30 days after they are made. The copy you download is yours.
• Capsule fingerprints and timestamp tokens: kept in write-once storage that nobody, including us, can alter or delete before its retention date. The capsule isn't open yet. Before it opens, this section will state that period, and the app will show it before you anchor anything.
• Contact-form messages: up to 24 months after the conversation ends.
• Technical logs: 90 days.

10. Your rights

Depending on where you live, you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. Where we rely on consent, you can withdraw it at any time. You can also contest an automated ID result as set out in section 6.

Use the contact form and choose "Privacy or data request", or, if you are in the EU, go through our representative at app.prighter.com/portal/15292804891. So that nobody can make a request in your name, we reply to the email address on your account. We answer within one month. Some data we have to keep, such as billing records, even after a deletion request; we'll tell you what and why.

If you're unhappy with how we've handled your data, you can complain to the data-protection authority where you live or work.

11. Security

Data is encrypted in transit and at rest. Captures are stored in encrypted storage, payment details never touch our systems, and the cloud browser only ever loads public pages, never logs in, and holds no creator credentials. Access to production systems is limited to what is needed to run the service and to answer requests you make.

12. Age

OnlyHere is for people aged 18 or over. The ID check confirms it, and we don't knowingly collect data from anyone younger.

13. Changes

This notice is versioned. If we make a material change, we'll email you before it takes effect. The date at the top shows the version in force.

14. Contact

Paragon Consulting FZE, Twin Towers, P.O. Box 4422, Fujairah, United Arab Emirates. Contact us through the contact form. We reply by email.