Privacy notice

Who is responsible for your data

The controller is the person named in the legal notice, trading as Who Has The Keys. Contact: hello@whohasthekeys.com.

What we collect

When you use the free check

• the web address you check, and the public records we read for it
• your connection’s IP address, to limit how many checks one connection can run

When you keep a register

• your email address, to sign you in and send you alerts and summaries
• the business’s name, its domains, and what you record about each account: the service, the keeper and admins, the email address that signs in, whether two-step login is on, who pays and when it renews
• the names and email addresses of the people you name for break-glass, and your instructions
• on the Freelancer plan, your business name and logo
• a record of sign-ins and changes, to keep the account safe

We never collect passwords, recovery codes, two-step codes or card numbers.

Visits to the website

We count page visits with Vercel Web Analytics, which uses no cookies and builds no profile of you. From our server it also counts when a check is run, when an account is first created, when a register is started and when a plan is bought, with the plan’s name. It never records the domain you checked, your name, your email or what you paid.

People named in a register

A register can hold the name and email address of people who are not our customers, such as a web designer recorded as an admin, or a partner named for break-glass. If you name someone, please tell them. People named for break-glass get an email from us asking them to agree, and are sent nothing unless they do. Anyone named can ask us what we hold about them.

Why we use it

• To run the register and send its alerts: because you asked us to, under our contract with you.
• To run the free check, limit misuse and keep accounts safe: our legitimate interest in a working, safe service.
• To keep records the law requires, such as payment records: legal obligation.

Who handles it for us

• Vercel: runs the website and the service.
• Neon: runs the database, in London.
• Resend: sends our emails.
• Stripe: takes payments and holds card details.

Vercel, Neon and Resend handle data only on our instructions. Stripe decides for itself how it handles card and payment details, under its own privacy notice at stripe.com/privacy. The website runs and the database is kept in London. Vercel, Resend and Stripe are based in the United States, so some data can be handled there. Where it is, it is protected by the UK’s rules for international transfers: the UK Extension to the EU-US Data Privacy Framework where the company is certified, or the UK International Data Transfer Addendum in its data processing agreement.

How long we keep it

Check results are kept for an hour. A register is kept for 90 days after its plan ends, then deleted; deleting your account deletes your registers at once. The counts we keep to limit checks are deleted after a day. Sign-in links and expired sign-ins are deleted as soon as they stop working, and the record of sign-ins and changes is kept for 12 months. Payment records are kept for six years, as tax law requires. IP addresses are never stored as they are, only as a scrambled code that cannot be turned back into the address.

Cookies

The public pages set no cookies. Signing in sets one cookie, __Host-whk_session, that keeps you signed in for up to 30 days, or until you sign out. It is needed for the service to work, so we don’t ask before setting it.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or ask for it in a form you can take elsewhere. Email hello@whohasthekeys.com. We answer within a month.

Complaints

If you are unhappy with how we have handled your data, email hello@whohasthekeys.com with “Complaint” in the subject. We will confirm we have it within 30 days, look into it, and tell you what we found and what we did. If you are still unhappy, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes

When this notice changes, the date below changes, and registered users get an email about anything that matters. Last updated: 8th October 2026.