The words this product uses, defined once

Everything about you that someone could find without hacking anything.

Two separate things add up to it. Data that leaked when a company you used was breached, and data that is being sold quite legally by firms who collect it. Exposure is the total picture a stranger could assemble about you today, for free or for a few pounds.

A company that held your details lost control of them.

Someone got into a service you had an account with and took the customer database. Those files circulate for years afterwards. You are almost never told which of your details were in it, which is the gap a scan closes.

A company that buys and resells personal records — legally, and about you.

They buy the electoral roll, credit-file marketing data, company filings and the rest, join it together, and sell the result to anyone who pays. Nothing was hacked. Your name, address history and phone number are on sale because collecting and selling them is a business, and in the UK you have a legal right to make them stop.

The version of the electoral roll anyone can buy — and most people are on it by default.

There are two registers. The full one is restricted; the open one can be bought by any company, and it is the single biggest source feeding UK data brokers. You can opt out at any time, and it costs nothing. Doing it first means the brokers stop being refilled.

A formal instruction to a company to delete your record and stop selling it.

In the UK and EU this is a legal right, not a favour, and the holder has one month to comply. Each one has to be sent to the right address, in the right form, and then chased if it is ignored. That is the work the subscription does for you.

A broker buys your details again and puts you back on the list.

Removal is not permanent, and this is the part nobody mentions when they sell you a one-off cleanup. Brokers re-acquire the same source data roughly every four months, so a profile you deleted in January can be back by May. It is why the job is a subscription rather than a purchase.

We keep checking after the first scan, and tell you when something changes.

New breaches surface constantly and brokers relist. Monitoring re-runs the checks on a schedule and emails you when your address turns up somewhere new — so you learn it from us rather than from the news, or from a scam call.

Which passwords and records actually leaked — not just which companies were breached.

The free scan tells you which breaches you appear in. The deep search goes into the leaked data and shows what was in there against your address, including passwords still circulating. Those results are shown to you once and never written to our database.

One number, 0 to 100, for how exposed you currently are.

It weighs what leaked rather than how many times. A single breach containing your password and home address scores worse than five that leaked only an email. It exists so you can tell whether last month's work moved anything.

The minimum we need to prove to a broker that a record is yours.

A name, optionally a town, and the outward half of a postcode — SW1A, never SW1A 1AA. Enough for a holder to match you and not enough to be an address. You can delete it on its own without closing your account.

Reporting a company to the UK regulator when it ignores your legal deadline.

The Information Commissioner's Office enforces UK data protection law. A holder that lets the statutory month pass in silence has broken it, and a complaint is free to make. We draft it, dated and evidenced, so the threat behind the request is real.

The same service for up to five people you live with — from one account.

Each person still confirms their own address with their own code; nobody can be added without proving the inbox is theirs. Removal is per person, because the brokers hold each of you separately.

A six-digit code emailed to you instead of a password.

It is how you sign in, and it is also what stops the product being used on anyone else. No password means no password database to steal and nothing for a fake login page to capture.