Privacy Policy

This Privacy Policy explains how SEARCHHUB OÜ ("SearchHub", "we", "us", "our") collects, uses, discloses, and protects Personal Data when you access or use the SearchHub services (the "Service").

We operate searchhub.vip and related mirror domains. Our policy is written to satisfy applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), and to be transparent about our practices.

This Policy applies to all Personal Data processed by SearchHub in connection with the Service, whether collected through the website, APIs, forms, or via user submissions and public dataset indexing.

Our legal bases for processing Personal Data under GDPR include:

• Providing, maintaining, and improving the Service
• Account creation, authentication, and security monitoring
• Indexing and search functionality, ranking algorithms, and deriving analytics
• Fraud prevention, abuse detection, and enforcement of our Terms of Service
• Responding to legal requests and court orders where properly compelled
• Communicating with users when you have provided contact details (password resets, notifications)

Retention Principles: We retain Personal Data only as long as necessary for the purposes described, or as required by law.

Deletion Requests: To request deletion, contact [email protected] with identification details. We will verify your request and respond within statutory timeframes (GDPR: one month; may be extended by two months for complex requests).

SearchHub offers an optional Fee-Based Data Wipe service for expedited, administrative removal of indexed references under SearchHub's control.

• The Fee-Based Data Wipe does not guarantee removal from third-party sites, archives, or caches beyond our control (e.g., Internet Archive)
• Under GDPR and similar laws, data subjects retain the right to request deletion (the 'right to be forgotten') free of charge when legal conditions are met
• We will process free deletion requests where applicable and required by law
• The Fee-Based Data Wipe is an optional paid service for expedited handling or for cases not covered by statutory deletion rights

Registration: You may create an account without providing an email address. We collect only the username and store a salted hash of your password.

Account recovery: Without an email, account recovery options are limited. If you did not provide an email, account recovery may require identity verification and support assistance.

We implement organizational and technical measures to protect Personal Data, including:

We may use third-party processors to provide hosting, analytics, payments, and other services. Processors are contractually bound to act only on our instructions and to implement appropriate safeguards.

Cross-border transfers: Data may be transferred outside the EEA. Where transfers occur to jurisdictions without an adequacy decision, we use appropriate safeguards (e.g., Standard Contractual Clauses) or obtain consent where required.

Processor categories: Cloud hosting providers, CDN providers, payment processors, email/notification providers, analytics platforms.

Verification and timing: We will respond to verifiable requests within legal timeframes (typically 30 days under GDPR, 45 days under CCPA).

We use cookies and similar technologies for essential site functions, analytics, security, and preferences.

You can control cookie preferences via your browser settings and via any in-site cookie controls we provide.

We may use automated systems to provide features such as search ranking, anomaly detection, and abuse detection. These processes do not generally produce legally binding automated decisions about individuals.

Where automated profiling significantly affects individuals, we will provide meaningful information about the logic involved and provide mechanisms to request human review where required by law.

We comply with lawful requests from courts and law enforcement when properly compelled. International orders typically require proper judicial channels or mutual legal assistance (MLA).

Requests must be submitted to [email protected] and be accompanied by authenticated legal process (court order, MLAT, or subpoena). We will evaluate each request for legality and scope and notify the affected user unless prohibited by law.

In the event of a personal data breach we will:

• Notify the relevant data protection authority where required by law, without undue delay and, where feasible, within 72 hours of becoming aware of the breach
• Notify affected individuals if the breach is likely to result in a high risk to their rights and freedoms
• Take steps to contain and remediate the breach and review security practices

Where processing is likely to result in high risk to individuals' rights (e.g., large-scale processing of sensitive personal data), we will conduct a DPIA to evaluate risks and implement mitigating measures.

We will document DPIA outcomes and make them available to supervisory authorities upon request.

If you are an EU resident, you may also lodge a complaint with your local supervisory authority.

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will post the updated policy with a new effective date on the Service and, where appropriate, provide notice to registered users.

Continued use after changes constitutes acceptance of the updated policy.

To help you make verifiable deletion requests, provide the following information when contacting [email protected]:

We will acknowledge receipt and provide an estimated timeline for processing. For standard GDPR erasure requests we will act free of charge when conditions are met.

Executed on behalf of SEARCHHUB OÜ — Authorized Signatory: Legal & Privacy Team, SEARCHHUB OÜ — Date: September 27, 2025