Legal

Orahold privacy policy

Last updated: 20 September 2026

This is a plain-language policy, written to be read rather than skimmed past. It is not a substitute for legal advice.

There is an awkward truth at the heart of a service like ours: to get your personal information deleted from six hundred companies, we have to hold some of it ourselves, and we have to hand it to those companies so they can find your records. This policy is mostly about being straight with you about that: what we take, who we give it to, why, and how long we keep it.

Who we are

Orahold is a personal data removal and monitoring service, owned and operated by Nuu Labs LLC, a limited liability company registered in Wyoming, United States. In this policy, Orahold, we, and us all mean the same thing, and you means the person using the service.

You can reach a person at hello at orahold dot com. That inbox is read by a human, and it is also the address for every request described under "Your rights" below.

Our registered office is 312 W 2nd St, Unit #A2299, Casper, Natrona County, WY 82601, United States. Email is much faster than post.

What this policy covers

The marketing site, the free scan at /free-scan, the checkout, and the account you use afterwards.

The short version

The free scan asks for one thing: a phone number or an email address. That is all we require from anyone.
To search for you, we look that identifier up with a people-search provider, which returns the record those companies already hold about you. We did not create that record and we do not sell it.
If you never sign up, we delete everything from that scan within thirty days.
If you do sign up, we use your details for one purpose: asking companies to delete you, and checking whether they did.
We do not sell your personal information and we never have.

What we collect

What you give us

The one identifier you start with. A phone number or an email address, typed into the scan.
Your account details. Email address and a password, which is stored only as a hash we cannot reverse.
The details a removal request needs. Your name, your year of birth, your current and previous home addresses, your phone numbers and your email addresses. A broker matches on these; a request that omits a previous address simply finds fewer of your records.
Anyone else you add. If your plan covers more than one person, whatever you enter about them. See "Adding other people" below, because that part matters.
Anything you send us. Messages to support, and anything you paste into the scam checker.

What we find out about you

When you run the scan, we ask a people-search provider what is already published about the identifier you gave us. What comes back is typically your name, your approximate age, your current city, an address history, other phone numbers and email addresses, and the first names of relatives. We also check whether your email address appears in known data breaches.

None of this is information you gave us. It is what those companies were already selling, and showing it to you is the entire point of the scan.

What we collect automatically

Standard technical information: IP address, browser and device type, pages viewed, and the approximate city or region your IP suggests.
The campaign link you arrived from, if you came from an advertisement.
Cookies and similar technology, described under "Cookies and analytics".

What we never collect

We do not ask for your Social Security number, your driver's licence number, or your financial account numbers, and you should not send them to us. We never see or store your full card number. Card details are entered directly with our payment processor.

Why we use it, and on what basis

To run the free scan: because you asked us to, by typing your details in.
To send removal requests on your behalf: because you appointed us as your authorised agent and ticked the box saying so. That permission is the legal basis for the entire service. Nothing is sent for anybody before it is given, and you can withdraw it at any time from your account, which stops the requests.
To keep checking: these listings come back, so we re-check monthly and send the request again.
To take payment and run your account: to perform our contract with you.
To tell you what happened: the monthly report, alerts when something new appears, and service email about your account.
To keep the service working and safe: security, abuse prevention, debugging, and rate limits.
To measure our advertising: described under "Cookies and analytics".

We do not use your personal information to train any artificial-intelligence model, ours or anybody else's.

And nothing else. California's rules for authorised agents say an agent may not use a person's information for any purpose beyond fulfilling their requests, verifying them, and preventing fraud. We hold ourselves to that for every member, wherever they live: the details you give us for removal requests are not used to market to you, are not built into any dataset or index, and are not sold, rented or licensed to anybody, ever.

Who we give it to, and why

Data brokers and other businesses: this is the point of the service. When you authorise us, we send each company a written deletion or opt-out request in your name. Those requests contain the identifying details listed in the authorisation you agreed to: your name, year of birth, email addresses, phone numbers, and current and previous addresses. They have to, because a company cannot delete a record it cannot find.

This is a disclosure we make on your instruction, for your benefit. It is not a sale, and we receive nothing for it. It is also, unavoidably, information going to companies you may not have heard of. If you would rather that did not happen, do not authorise us. The scan works without it.

Our service providers. They handle data to do a job for us and nothing else:

Hosting, database and infrastructure providers — where the website runs and where your account and removal records are stored.
Our payment processor — taking payment and managing your subscription.
Our email provider — sending the removal requests and your account email, and receiving the replies.
People-search and identity data providers — the lookups behind the scan.
A data-breach monitoring service — checking an email address against known breaches.
An artificial-intelligence model provider — the scam checker, and reading broker replies.

We will tell you which companies these are if you ask. We pick providers who are contractually bound to handle your information only to do that job, and who may not reuse it for their own purposes.

When the law requires it. If we are legally compelled, or to establish or defend a legal claim, or to protect somebody from harm.

If the business changes hands. If Nuu Labs LLC is ever sold or merged, your information may transfer with it. Any buyer would be bound by this policy, and we would tell you before anything changed.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising in the sense California uses those words, with one qualification you should read, in the next section.

Information about people who are not our customers

A scan turns up the first names of relatives, and the listings we find are records about real people. Some of that is information about somebody who has never heard of us.

We collect it only because it arrives inside a record about the person who asked us to search, we use it only to recognise which listings are actually theirs, and we do not build a profile of anybody from it or make it searchable. It is deleted on the same clocks as everything else below. If you are not a member and believe we hold something about you, email us and we will find it and delete it.

Cookies and analytics

We use a small number of analytics and advertising tools, and only in production:

Product analytics providers — how people move through the site, so we can see where the funnel confuses people.
Advertising measurement providers — so we can tell which advertisement led somebody to subscribe.

To the advertising platforms we send a hashed, irreversible version of the identifier you typed, together with your IP address, browser type and approximate location, so a conversion can be recognised. We deliberately do not send anything the scan found out about you: not your name, not your address history, not your relatives. That was a decision, not an oversight — those details are yours, and handing them to an advertising platform to improve a match rate would be indefensible for a company selling privacy.

Some US state privacy laws treat this kind of advertising measurement as "sharing" or as a "sale", even though no money changes hands. Rather than argue about the definition, we let you switch it off:

Turn on Global Privacy Control in your browser, or use a browser or extension that sends it. We treat that signal as a valid opt-out, on every page, without you having to find anything on our site. This is the quickest route and it needs no account.
Or email us and ask, at the address above.

You can also refuse cookies in your browser settings. The service works without them; the free scan needs local storage to remember which scan is yours.

Do Not Track. Browsers can send a Do Not Track header. There has never been an agreed standard for what a website should do about it, so we do not respond to it. We do honour Global Privacy Control, which does have one, as described above.

Sensitive information

California has a specific category called sensitive personal information. The details we ask you for (name, year of birth, addresses, phone numbers, email addresses) are identifiers, not sensitive information in that sense.

The one thing we hold that does fall in that category is your account password, which exists only so you can sign in. We use it to log you in, to keep the account secure, and to prevent fraud, and for nothing else. Those are exactly the purposes the law permits without offering a separate right to limit, which is why you will not find one here.

We do not ask for your Social Security number, and if a company ever demands one to process a removal, we will tell you rather than collect it.

How long we keep things

A scan nobody signed up from: thirty days. Then it is deleted automatically. Most people who run the scan never buy, and keeping a stranger's address history indefinitely because they once typed in a phone number would be indefensible.
A scan you did sign up from: seven days after signup. By then its findings live on your own record and the scan is a redundant second copy.
Your account and removal history: while you are a member, and for a reasonable period afterwards. We keep enough of the removal record to prove a request was made. That evidence is what protects you if a company puts you back.
Billing records: as long as tax and accounting law requires, which in the US is generally seven years.
Support email: up to two years.

When you ask us to delete everything, we do. See below.

Your rights

Wherever you live, you can ask us to:

Know what we hold about you, where we got it, why we have it, and who we have given it to.
Get a copy of it, in a portable format.
Correct anything that is wrong.
Delete it.
Opt out of the advertising measurement described above.
Withdraw your authorisation for us to act as your agent, which stops all outgoing requests.

Several of those rights come from state privacy laws, including California's CCPA, as amended by the CPRA, and the comparable laws in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Maryland, Minnesota and a growing list of others. Some of those laws only bind companies above a size we have not reached.

We are not going to hide behind that. A company that sells privacy and then tells you your rights depend on its revenue has missed the point. So we give everybody the same rights, in every state and every country, whether or not the law currently obliges us to.

You will never be treated differently for exercising any of this. No worse price, no worse service.

How to ask: email hello at orahold dot com and say what you want. We will verify it is really you, usually by confirming you control the email address on the account, and answer within 45 days, or tell you why we need longer. An authorised agent may ask on your behalf with your written permission; we will ask for proof of it, as the law allows.

If we say no, we will tell you why, and you can appeal simply by replying to that email. We will answer an appeal within 45 days, in writing, with our reasons. If you are still unhappy, you can complain to your state Attorney General, and we will tell you how.

Nevada. If you are a Nevada resident, that same address (hello at orahold dot com) is our designated address for a request not to sell your information, and we will answer within 60 days.

California "Shine the Light". We do not disclose personal information to third parties for those third parties' own direct marketing. There is nothing to opt out of, but you may ask us to confirm it and we will.

Children. We have no actual knowledge that we sell or share the personal information of anybody under 16, because we do not sell or share personal information and the service is for adults.

Adding other people

If your plan covers more than one person, you can enter their details so we can act for them too. Please only do this for someone who has actually asked you to, or for a child you are responsible for. When you add someone, you are telling us you have the right to act for them, and we act on that. If we hear from them that you did not, we will stop.

Children

Orahold is for adults. It is not directed at children, and you must be at least 18 to hold an account. We do not knowingly collect information from anyone under 18. If you believe a child's information has reached us, email us and we will delete it.

Where your information is held

We are based in the United States and our providers are principally in the United States, so that is where your information is stored and processed. If you are somewhere else, using Orahold means your information is transferred there.

Security

Everything travels over encrypted connections and is stored encrypted at rest by our providers. Passwords are hashed. Access to member data is limited to the people who need it to run the service.

We will not pretend to be unbreakable, because nobody is. What we can do is hold as little as possible, for as short a time as possible, and be honest with you quickly if something goes wrong. If a breach affects you, we will tell you and the regulators that require telling.

Changes to this policy

When we change it, we update the date at the top. If a change materially affects what we do with your information, we will email you before it takes effect.

Contact

hello at orahold dot com, for questions, and for any of the requests above.

Nuu Labs LLC, 312 W 2nd St, Unit #A2299, Casper, Natrona County, WY 82601, United States.