How UltoPulto works
UltoPulto runs one loop: it finds where your identity is exposed, sends the requests the law allows, checks that each result really happened, and checks again on a schedule. The screens below are the real product with a fictional account's data.
01Find
UltoPulto checks the places where your identity is exposed.
People-search sites, breach records, face-search engines and AI dataset indexes. You get a score and the list behind it.
Exposure Scan
/scan
35
Low exposure
- People-search and broker listings
- 6 found
- Face-search engines
- Not yet checked by you
- AI dataset indexes
- 1 possible match
- Breach records
- 2 found
Fictional demo data · no real person, no real request 02Act
Where the law gives you a right to act, UltoPulto helps you use it.
Each finding becomes a case: who is asked, for what, on which legal basis, and by when they must answer. Where no law applies, the request relies on the organisation's own policy, and the case says so.
Case · Spokeo
/cases
- Request
- Removal and suppression of all records
- Recipient
- Spokeo privacy contact
- Legal basis
- California Consumer Privacy Act §1798.105 and §1798.120; California Delete Act
- Sent
- Day 0, as authorized agent
- Their deadline
- Day 45
- Status
- Requested
Fictional demo data · no real person, no real request 03Verify
A button that says “done” is not proof.
A case is called Confirmed removed only when the organisation says so in writing, or a re-check no longer finds the listing.
Evidence record · OP-73FD778327
/cases
- Response
- Day 2: “We received your request.” Day 5: “Your record has been removed.”
- Verification
- Day 14 re-check: listing not found
- Status
- Confirmed removed
Fictional demo data · no real person, no real request 04Monitor
Removal is not the end. Listings come back.
A scheduled re-scan compares with the last one. Anything new opens a case, and you are told what changed.
Monitoring
/account
- No longer listedNo longer found: Spokeo listingDay 14
- New exposureNew: listing on ClustrMaps. Case opened.Day 14
- Alert sentAlert emailed.Day 14
Fictional demo data · no real person, no real request
Five kinds of exposure
The scan sorts what it finds, so you can see the whole picture instead of a list of websites.
- Identity
- Name, home address, phone number and email on people-search sites and in data brokers' records.
- Face
- Public photos, tagged images and results on face-search engines.
- AI
- Links to your pictures in dataset indexes, and records held by AI model providers.
- Security
- Breach records that tie your email to old passwords and other details.
- Reputation
- Fake profiles and altered or generated images. You report these; monitoring for them is planned.
Each capability is labelled Built, In rollout or Planned on the transparency page.
What happens after you start
Before you pay for anything, you can see exactly what paying sets in motion.
- Minute 1You run the scan and confirm your email. You see your Exposure Score and every finding.
- Minute 5You choose a plan and sign a one-time authorization so requests can be sent in your name.
- Day 1A case opens for every finding, and for each AI provider on Plus and Creator. You can read every letter.
- Days 2–45Replies arrive and are logged. Steps only you can do come with instructions. Deadlines are tracked.
- After a deadlineA follow-up goes out. If it is ignored, a regulator complaint is drafted for you to review.
- Every week or monthA re-scan compares against the last one, opens cases for anything new and tells you what changed.
Start with the scan. It is free.
The method behind the scorePlans and pricesQuestions and direct answers