Privacy Policy

01Who we are

Command One, a sole trader (self-employed, not an incorporated company), operates the open-source intelligence (OSINT) research platform at com1.cloud. This policy explains what personal data we process when you visit the site, register an operator account, and run investigation modules.

Command One is the data controller for your account data and the data you enter into investigations. For questions or to exercise your rights, contact us at privacy@com1.cloud.

02Data we collect

We keep collection to the minimum needed to run the service.

• Account data: email address, hashed password (or Google account identifier if you sign in with Google), optional call sign / display name, and account creation date.
• Usage data: investigations you create, search selectors you submit (usernames, email addresses, phone numbers, domains), module runs, credit ledger entries and job status.
• Results data: findings returned by the modules you run, including publicly available information about the subject of your search.
• Technical data: IP address, browser and device type, and timestamps in server and security logs.
• Support data: any messages you send us.

03How we use your data

We process your data to create and secure your account, run the modules you request, allocate and enforce credits and rate limits, maintain audit and abuse-prevention logs, produce your exported reports, and improve reliability of the platform.

We do not sell your personal data, and we do not use your investigation content for advertising or profiling.

04Lawful bases

Where UK/EU data protection law applies, we rely on: contract (providing the platform to you), legitimate interests (platform security, abuse prevention, service improvement), consent (optional communications, where offered) and legal obligation (responding to lawful requests).

If you enter another person's data into the platform, you act as the controller of that data and you are responsible for having a lawful basis for the search.

05Searches about other people

Command One aggregates information that is already publicly accessible. You must only run searches where you have a lawful purpose — for example due diligence, fraud investigation, journalism, security research, or the subject's consent.

You must not use the platform for stalking, harassment, doxxing, discrimination, or any decision that requires a regulated background-check provider (for example employment, tenancy, insurance or credit screening in jurisdictions where that is restricted).

06Sharing and sub-processors

We share data only with service providers that help us operate the platform, and only as needed:

• Cloud hosting, database and authentication infrastructure used to run the site and store your account and investigation records.
• Paddle.com, our reseller and Merchant of Record, which processes purchases, subscription management, payments, invoicing and sales-tax compliance. Paddle receives the billing details you enter at checkout and your account email.
• Google, if you choose Google sign-in (it receives the fact of a sign-in attempt).
• Worker infrastructure operated by us, which executes open-source modules and returns findings.
• Third-party public sources and APIs queried by a module you run — these receive the selector needed to answer the query.
• Professional advisers (for example accounting or legal) where necessary.
• Law enforcement or regulators where we are legally required to disclose.

07International transfers

Our infrastructure and some public sources are located outside the UK and EEA. Where data is transferred internationally we rely on appropriate safeguards such as UK/EU standard contractual clauses or an adequacy decision.

08Retention

Account data is kept while your account is active. Investigations, findings and job logs are kept for as long as the investigation exists, so you can revisit and export case files. Security and audit logs are kept for up to 12 months.

You can delete an investigation at any time from the console, which removes its findings. When you ask us to delete your account, we remove your account and investigation data within 30 days, except records we must keep for legal or abuse-prevention reasons.

09Security

Access to your data is restricted by row-level database policies so operators can only read their own investigations. Traffic is encrypted in transit, passwords are stored hashed and never in plain text, and administrative access is limited to accounts with an explicit admin role.

No online service can be guaranteed absolutely secure. If a breach affects your personal data and presents a risk to you, we will notify you and the relevant regulator as required by law.

10Your rights

Subject to local law, you may request access to your data, correction, deletion, restriction, a portable copy, or object to processing based on legitimate interests. You may also withdraw consent where processing relies on it.

Email privacy@com1.cloud to make a request; we respond within one month. If you are in the UK you may complain to the Information Commissioner's Office; in the EEA, to your local supervisory authority.

11Cookies and local storage

We use strictly necessary cookies and browser local storage to keep you signed in and remember interface preferences. We do not use advertising cookies or cross-site tracking. Clearing this storage will sign you out.

12Children

The platform is not intended for anyone under 18. We do not knowingly create accounts for children; contact us if you believe a child has registered and we will remove the account.

13Changes to this policy

We may update this policy as the platform evolves. We will change the date at the top of this page and, for material changes, notify registered operators by email or in-app notice before the change takes effect.