Help · 41 answers
These are the only things the support assistant knows. It answers from this page and shows you which entry it used, so you can check it. Anything not here, a person answers.
Getting started
Nullivo shows you what a stranger could find out about you without hacking anything, and then helps you take it down. Two separate things make up that picture: data that leaked when a company you used was breached, and data that is being sold quite legally by firms who collect and resell personal records. The scan is free and covers the first. The paid plans work through the second, holder by holder, sending the requests and counting the legal deadlines.
Check it: How it works
Yes, and it stays free. The scan shows your exposure score, every breach your address turns up in, and what each one exposed, with one next step per finding. No card, no subscription, nothing to cancel. You pay only if you want the removal work done for you.
Check it: Pricing
Put your email address into the scan box and we email you a six-digit code. Enter it and the results appear. The code is how we confirm the address is yours — Nullivo will only ever scan an address whose owner has just proved they control it.
Check it: Run a free scan
Check the spam or promotions folder first — the code comes from noreply@nullivo.com and the subject is “Your Nullivo sign-in code”. Codes last ten minutes and work once, so if you have requested several, only the newest one will work. If nothing arrives at all, that usually means the address was mistyped: go back and request it again. Still nothing, and a human should look at it.
Check it: Sign in
Never. Nullivo only needs your email address, and a one-time code to confirm it is yours. There is no Nullivo password, which means there is no Nullivo password to steal. We will never ask for the password to any other service either, and nobody from Nullivo will ever ask you to read a sign-in code out to them.
Check it: Security
Trust, privacy and legality
Yes. Nullivo only scans an email address whose owner has just verified they control it. It is a self-protection tool, like checking your own credit report. It has no feature for looking up other people.
Check it: The no-lookup promise
No, and this is the one thing Nullivo will not build. Every scan requires a code sent to the address being scanned, so you can only ever check an address you can receive mail at. There is no people-search feature, no name lookup, and no way to ask about another person. That is a deliberate limit, not a missing feature — a tool that lets you look up a stranger is the thing this product exists to be the opposite of.
Check it: The no-lookup promise
No. Selling user data would be the opposite of the product’s purpose. Nullivo makes money from subscriptions, not from your information.
Check it: Privacy policy
As little as we can while still being able to monitor you. We keep your verified email address, your latest scan findings and which broker opt-outs you have completed. We do not store passwords, and the deep-search results (which can include exposed passwords) are shown to you and never written to our database. Analytics are first-party and cookieless, with the visitor identifier rotating daily so it cannot follow you between days. If you close your account we delete your data; you can also delete it at any time from your dashboard, and analytics rows are trimmed automatically.
Check it: Privacy policy
Nullivo runs on major cloud infrastructure in the United Kingdom behind TLS, with personal data encrypted at rest in the database. Sign-in is a one-time code sent to your address — there is no password to steal, and we never ask for the password to any other service. Card details are entered on our payment processor’s own checkout and never touch our servers. Access to the admin systems is restricted to a named allowlist. No service can promise it will never be breached, which is exactly why we hold as little about you as the product allows.
Check it: Security
You are talking to an assistant, not a person. It answers only from pages Nullivo has published, and shows you which page each answer came from so you can check it. When it does not have a published answer it stops and takes a message for a human rather than guessing. One person reads those, and you get a real reply rather than a ticket number.
Check it: Help centre
The scan and your breaches
Nullivo checks your address against the industry-standard global breach register via its official API. Breach data is global, so it works wherever you live.
Check it: How it works
No service can. Once a website is breached and its database leaks, that data exists permanently across many copies and cannot be recalled by anyone. What you can do is change any exposed password everywhere you used it and turn on two-factor authentication. Data-broker listings are different: those companies actively republish your details and do have opt-out processes, which Nullivo helps you complete.
Check it: How it works
On Complete and Household, yes, for your own verified email only. The deep breach search shows the real data found in breaches of your account, including exposed passwords, masked by default and revealed only when you choose to. Nullivo never stores these results. You cannot look up anyone else, only an address you have verified you control.
Check it: Pricing
It is a single number out of 100 summarising how much of you is findable today, built from how many breaches hold your address and how sensitive what they exposed is. It is a way to see whether things are getting better or worse over time, not a grade. What matters more is the breakdown underneath it, which tells you which specific fields leaked and what to do about each.
Check it: How it works
It is a plain-language summary of the risks your exposed data creates — credential stuffing, impersonation, SIM-swap, targeted phishing — based on exactly what your breaches exposed, so you know what to fix first.
Check it: How it works
Every month, on all paid plans. We re-run your breach scan and re-check your data-broker listings, and we email you only when something has actually changed — a new breach, or a broker that has re-listed you. On top of that, new breaches added to our sources trigger an alert as soon as they appear rather than waiting for the monthly cycle. Brokers routinely re-list people every few months, which is why removal is an ongoing process rather than a one-time job.
Check it: Pricing
It can be, and it is worth knowing what it does and does not mean. It means this address does not appear in the breaches our source has catalogued. It does not mean no breach has ever included you — breaches surface months or years after they happen, and some never become public at all. It also says nothing about data brokers, who are publishing you quite legally rather than leaking you. Turning on monitoring is the useful move here: you will hear the moment that changes.
Check it: How it works
Removals and data brokers
There are two routes, and each holder’s card tells you which it is. ‘Find your listing’ holders, which is most US people-search sites: search your name, copy your profile’s URL, and submit that URL on their opt-out page. ‘Email request’ holders: copy the ready-made deletion letter and email it to them. Tap ‘How to do this’ on any holder for exact steps, and remember to click the confirmation link they email you — a request that is never confirmed is a request that never happened.
Check it: Clean me up
It depends on the holder, and each row on your cleanup page says which. Companies House we check for you through its official API, and you confirm whether a match is you. Holders with a public search — 192.com, UK Phone Book, People Trace UK, Ancestry, Findmypast and most US people-search sites — get a ‘Search for yourself’ link pre-filled with your name, because those sites forbid automated searching and block it. Holders with no public search but a published address — the credit-bureau marketing files, CACI, Acxiom, 118 118 and others — can only be asked: with sending switched on, ‘Ask them if they hold your data’ sends a subject access request in your name, and they have one month to answer. The suppression services and the open register have nothing to search at all; there you register the opt-out and move on.
Check it: Clean me up
Both, depending on the holder. Where a holder accepts a written request, you can give Nullivo a standing authorisation and we send it as your authorised agent, dated, with the legal one-month clock counted for you. Where a holder requires you to find your own listing and submit its URL — most US people-search sites — nobody can do that on your behalf, and we give you the exact steps and the link instead. The list on your cleanup page says which is which, per holder, before you start.
Check it: Clean me up
142 holders, and they are all published by name rather than summarised as a number. 22 UK, 100 US, 8 EU and 12 global. Essential covers the UK register; Complete and Household cover all of them. The list is on the coverage page so you can check it before you pay rather than after.
Check it: Coverage
Under UK and EU data protection law a holder has one month from receiving your request. Nullivo dates every request when it goes out and counts that month down for you, so a holder running out of time is visible before the deadline passes rather than after. In practice many respond within days. Some do not respond at all, which is what the escalation step is for.
Check it: How it works
Often, yes, and that is the honest answer. Brokers re-acquire the same records from the same upstream sources roughly every few months, so a removal that is never re-checked is temporary. That is why the paid plans re-check rather than just send: monthly on Essential, weekly on Complete and Household, with an alert when someone re-lists you.
Check it: Pricing
The statutory month is the point. If a holder lets it lapse without complying, that is a failure you can complain about to the Information Commissioner’s Office, and on Complete and Household Nullivo drafts that complaint for you on the day the deadline passes, with the dates and the correspondence already assembled. You decide whether to send it.
Check it: Pricing
Not remove — the register is public by statute and nobody can take you off it. What you can do is apply to Companies House to restrict your residential address from public view using form SR01, which stops it being disclosed to credit reference agencies and the public. Nullivo checks the register for you and shows you what is published under your name, because most people have no idea the correspondence address is there until they see it.
Check it: Coverage
The open register — the version anyone can buy — is the single biggest upstream source for UK data brokers, which is why it is worth doing first. You opt out through your own local council rather than through a search on the register itself; there is no public lookup for it. Nullivo gives you the route and counts it as a holder, but the request has to come from you to your council.
Check it: Coverage
Plans, billing and cancelling
The free scan shows your exposure score and a risk breakdown, and it stays free. Essential (£49 a year) covers the 22 UK holders in our published registry — 192.com, LexisNexis Tracesmart, the credit-bureau marketing files, the electoral roll at source — with every request dated and the one-month legal deadline counted for you. Complete (£99) adds US and EU brokers, weekly re-checks, the deep breach search that shows the actual data exposed including leaked passwords, and an ICO complaint drafted when a broker lets the month lapse. Household (£189) is Complete for up to 5 people, with the correspondence handled end to end.
Check it: Pricing
Yes, and it depends on whether we have started. Cancel before we run your scan or send your first removal request and it is a full refund, no questions. After that we may keep a fair share of what has already been done — a removal request is a legally binding notice sent to a named company and it cannot be un-sent — and we will tell you what that amount is and why. Beyond that, if we simply have not delivered for you, email support@nullivo.com within 30 days of your first payment and we will put it right. Cancelling at any time stops future renewals and your access runs to the end of the period you have paid for.
Check it: Terms
From your dashboard, in one form. No retention call, no phoning anyone, nobody trying to talk you out of it. We action it within one business day and confirm by email. Your access runs to the end of the period you have already paid for.
Check it: Your dashboard
Prices are in pounds sterling and include VAT. If your card is in another currency your bank converts it at their rate, and what you are charged may differ slightly from the figure shown.
Check it: Pricing
Yes. Subscriptions renew at the same price until you cancel. Under the Consumer Contracts Regulations 2013 you have 14 days from purchase to change your mind, and our 30-day guarantee is on top of that rather than instead of it.
Check it: Terms
Nothing is charged on the day you start. Card details are taken so the plan can continue without interruption, and we email you 30 days before the first charge so it is never a surprise. You can cancel at any point during the trial from your dashboard and you will not be billed.
Check it: Pricing
Your account
Your account is the address, so there is no in-place change: scanning a different address means verifying that address. If you want your old account and its history closed, delete it from your dashboard — that removes what we hold. If you need the two joined up, a human should do that rather than the assistant.
Check it: Your dashboard
From your dashboard, at any time, without asking us. It deletes what we hold about you. A privacy company that made this hard would be failing at the one thing it claims to do, so it is one action and it is yours.
Check it: Your dashboard
Every email we send carries a one-click unsubscribe and a link to your preference centre, where you can choose which kinds you get rather than all or nothing. Alerts about your own exposure and messages about your subscription are separate from marketing, and turning off marketing does not turn those off.
Check it: Email preferences
Up to five people, managed from one dashboard, and you can add or swap people whenever the household changes. Each person still verifies their own email address before anything is scanned for them — paying for someone’s cover does not let you look them up, and it never will.
Check it: Household
What the words mean
A company that buys and resells personal records — legally, and about you. They buy the electoral roll, credit-file marketing data, company filings and the rest, join it together, and sell the result to anyone who pays. Nothing was hacked. Your name, address history and phone number are on sale because collecting and selling them is a business, and in the UK you have a legal right to make them stop.
Check it: Glossary
A company that held your details lost control of them. Someone got into a service you had an account with and took the customer database. Those files circulate for years afterwards. You are almost never told which of your details were in it, which is the gap a scan closes.
Check it: Glossary
Everything about you that someone could find without hacking anything. Two separate things add up to it: data that leaked when a company you used was breached, and data that is being sold quite legally by firms who collect it. Exposure is the total picture a stranger could assemble about you today, for free or for a few pounds.
Check it: Glossary
Taking a password that leaked from one site and trying it automatically on hundreds of others. It works because most people reuse passwords, and it is the single most common way a years-old breach turns into a real loss today. This is why changing a leaked password everywhere you used it matters more than changing it on the site that leaked it.
Check it: Glossary
Not answered here
Open the Help button in the corner and ask. If the assistant does not have a published answer it will say so and take a message, and one person reads those — usually the same day, always within one business day. Or write to support@nullivo.com.