Privacy notice.
How What’s Exposed Limited handles the details you give us through this website.
Last updated November 2026.
Who we are
What’s Exposed Limited, iHub, Westport Road, Castlebar, Co. Mayo, F23 K162, Ireland, is the controller of the personal data described here. You can reach us at hello@whats.exposed.
What we collect
When you fill in a form on this site we collect what you type: your name, work email, company, role, your company’s domain, phone number if you give it, and your message. If you ask us to check a client’s domain on their behalf, we also collect the client’s company name and domain and your confirmation that you are authorised to ask. We don’t use advertising trackers on this site; the only thing stored in your browser is described in our cookie notice.
Why we use it
We use your details to reply to your enquiry, carry out the check you asked for, prepare a proposal and follow up on it. The legal basis is our legitimate interest in answering enquiries and, where you ask for a check or a proposal, taking steps at your request before entering into a contract.
The exposure check
When you ask us to see what’s exposed, a tester looks at what is publicly visible about the domain you give us: DNS and certificate records, internet-facing services, lookalike domains and public breach and stealer-log data. We do not send traffic at your systems or attempt to log in to anything. Public breach data can include the names and work email addresses of staff. We use it only to tell you what is exposed, we do not keep copies of any passwords it contains, and we share the findings only with the person who asked and, where a partner asked on a client’s behalf, that partner. If you give us a client’s domain, you confirm that you are authorised to request the check for them.
Visit statistics
We use Cloudflare Web Analytics to count visits and page views. It does not use cookies or identify you, and we only see totals.
Who sees it
Your details are seen by the WhatsExposed team handling your enquiry. The website is hosted by Cloudflare. Form submissions are checked for spam by Cloudflare Turnstile and emailed to us by Resend, both acting on our behalf, and the findings of an exposure check are held in our own ISO 27001 certified systems. We don’t sell your data or share it for anyone else’s marketing.
How long we keep it
We keep enquiry details and exposure check findings for as long as we need them to deal with your enquiry and any follow-up, and delete them when they’re no longer needed. If you do not go on to work with us, check findings are deleted within twelve months.
Your rights
You can ask to see, correct or delete your data, object to how we use it or ask us to restrict it, by emailing hello@whats.exposed. If you’re unhappy with how we’ve handled your data, you can complain to the Data Protection Commission in Ireland.
Security
We’re certified to ISO/IEC 27001:2022, and only the people who need your details to answer you can see them.