Your data
Ask what we hold about you
You do not have to be a customer, you do not need an account, and it does not cost anything. If someone ran a search that named you, this is how you find out what came back — and how you correct it or have it deleted.
In plain English
Tell us your name and how to reach you, say what you want — to see it, to fix it, or to have it deleted — and we will verify who you are and answer in writing within 30 days. If we hold nothing about you, we will tell you that.
Prefer email? Write to privacy@sleuthify.ca. An emailed request starts the same 30-day clock and carries exactly the same rights as this form.
What you can ask for
Four rights, and you can exercise more than one at a time. All of them are yours whether or not you have ever dealt with us.
- Access
- What personal information we hold about you, what we have used it for, and to whom it has been disclosed. You get the information itself, the categories of sources it came from, and the dates — not a summary of what a policy says we might have.
- Correction
- Challenge the accuracy or completeness of anything we hold. We fix our own errors outright. Where a government registry is the thing that is wrong, we attach your statement to our copy and point you at the office that can correct it at source.
- Deletion
- Ask us to delete what we hold. We do it wherever we are not legally required to keep something, and we tell you precisely what stayed and why — audit, refusal, and financial records have retention floors of up to 7 years, and pretending otherwise would be the easier answer rather than the true one.
- De-indexing, or cessation of dissemination
- A Quebec Law 25 right that we extend to everyone. We publish nothing about anybody, so in practice this means removing an item from our records and caches so that it cannot surface in a future report about you.
The limits are set out honestly in the privacy policy: we cannot tell you who searched you, we cannot delete the public record itself, and we cannot pre-emptively block future searches. Each of those has a reason, and the reasons are published rather than hidden behind a support macro.
Why we check who you are first
Verification looks like friction. It is the opposite: it is the thing standing between a file about you and whoever felt like asking for it.
If we answered “tell me everything you hold about Jane Smith” from any sender, we would have built a self-serve disclosure channel with a legal-rights label on it — and the first people through it would be exactly the people a subject most needs protecting from. So privacy law requires us to be satisfied you are who you say you are before we disclose anything, and we take that seriously in both directions:
- we confirm you control the email address or phone number in the request;
- we ask you to confirm details that match what we already hold, which is usually enough by itself;
- only where the request is broad or the information sensitive do we ask for a document — and we tell you what to redact first, because we do not want your document number, your photograph, or your signature;
- we destroy verification material once the request is closed. What stays is the audit record that a request was made and answered;
- we never ask for your social insurance number, your banking details, or your passwords, for any reason. If a message claiming to be from us asks for those, it is not from us.
What happens after you send it
You send the form
Nothing is charged, no account is created, and you do not need to know whether a search actually happened. “I want to know what you hold” is a complete request.
We acknowledge within two business days
By email, with a reference number. If you do not hear from us in that window, write to us directly — a form that swallowed your request is our problem to fix, not yours to absorb.
We verify who you are
Usually by confirming control of your email address and one or two details that match what we hold. Only where the request is broad or the information sensitive will we ask for a document, and we will tell you exactly what to black out before you send it.
We search our own systems
Across cases, findings, audit records, and correspondence — not only the obvious place. Where we hold nothing, you get that answer, in writing, which is a real and useful result.
We answer in writing within 30 days
With the information, where it came from, when we got it, and what we did with it. Where we refuse part of a request we say which part, give reasons, cite the provision we rely on, and tell you how to complain about that decision — including to the Privacy Commissioner, over our heads.
Make a request
Fields marked * are required. Everything else is optional and exists only to help us find the right records — if you would rather not give it, leave it blank and we will work with what we have.
Questions people ask
Do I need an account to ask what Sleuthify holds about me?
No. The request form at /privacy/my-data requires no account and no payment, and submitting it does not create an account. Requiring the subject of a search to register would mean collecting more personal information from them in exchange for a right they already have under Canadian privacy law.
Will you tell me who searched for me?
No. The customer's identity is that customer's own personal information, and PIPEDA s.9(1) requires us to sever information about a third party from an access response. We will tell you that a case exists, when it ran, which categories of source were queried, and everything we hold about you as a result. A court order can change what we may disclose; a lawyer's letter cannot.
How long does a response take, and does it cost anything?
It is free, and we respond in writing within 30 days of receiving your request, which is the deadline PIPEDA s.8(3) sets. We acknowledge within two business days so you know it arrived. If we need to extend the deadline — which s.8(4) permits in limited circumstances — we tell you before day 30 why and by how much.
Why do you need to verify my identity before answering?
Because the alternative is a service that hands over a file about somebody to whoever asks for it. Identity verification is the safeguard that stops an impersonator using your legal rights against you. We ask for the minimum needed, we tell you what to redact from any document, and we destroy the verification material once the request is closed.
Can you delete a public record about me?
No, and neither can anyone else selling you that. If a judgment, lien, or corporate filing exists at a registry, it exists there whatever we do with our copy — and a future search will find it again. We will delete our copy where we are not legally required to keep it, and we will tell you which office holds the authoritative record and what it takes to correct or seal it there.
Can I ask Sleuthify never to search me again?
We do not operate a suppression list, and the reason is a privacy reason rather than a commercial one: to match every future search against your name we would have to keep a permanent record of you with identifiers strong enough to distinguish you from everyone who shares your name. That is more retention, not less, and it would amount to a list of the people most anxious about being found. What we do instead is refuse any case where a protection order, peace bond, or no-contact condition exists in either direction, including one we discover ourselves mid-search.
Does making a request put me on any list?
No. We use what you send only to find your records, verify you, and answer you. It does not create an account, it is not used for marketing, and we do not tell the customer who searched you that you made a request unless the law requires it. The audit trail records that a request was received and answered, because that record is what makes our handling of it auditable.
What if the information you hold about me is wrong?
Tell us what is wrong and what it should say. If our finding misreads a record or attributes someone else's record to you, we correct it and annotate the case so the error cannot be reintroduced. If the underlying registry is wrong, we cannot edit a government record, but we attach your statement to our copy so any future report carries it alongside the finding — which is what PIPEDA Principle 4.9.5 contemplates — and we tell you which office can fix it at source.