DRAFT — ATTORNEY REVIEW REQUIRED BEFORE PUBLISHING
Counsel to confirm: the verification standard, the Article 14 notice and the Article 14(5)(b) disproportionate-effort position, the appeals mechanism against Colorado, Connecticut, Virginia and Texas requirements, and whether the stated clocks are operationally deliverable at our current staffing. Strategy §8.7 requires this form to be open to non-clients.
Ask us what we hold about you. You do not have to be a client.
Most companies open this form to customers. Ours is open to anyone, and it has to be, because we hold data about people who never chose to deal with us.
When our detection surfaces a client's leaked content and a person verifies it, we record URLs, page captures, timestamps and the usernames displayed on those pages. Some of those usernames belong to uploaders. Some belong to other creators whose content sits on the same page. None of those people are our clients.
If you are one of them, this form is for you.
§1 — Who can use this
- Clients. Anything we hold about you.
- Anyone whose handle, stage name, or content appears in our scan data. Including people who have never heard of us until today.
- An authorized agent acting for either. See §5.
§2 — What you can ask for
| Request | What it means |
|---|---|
| Access | A copy of the personal data we hold about you, the categories, the sources, why we hold it, who we have disclosed it to, and how long we keep it. |
| Correction | Fix data that is wrong or incomplete. |
| Deletion | Delete what we hold. See the exceptions in §6. |
| Restriction | Stop processing while a dispute about accuracy or lawful basis is resolved. |
| Portability | A machine-readable copy of data you gave us, where the right applies. |
| Objection | Object to processing carried out on the basis of legitimate interests. |
| Withdraw consent | Where we rely on your consent. Withdrawal is as easy as giving it, and it does not affect processing already carried out. |
| Limit use of sensitive personal information | We already limit it. See the standing statement in §7. |
| Opt out of sale or sharing | There is nothing to opt out of. We do not sell or share personal information, period. |
| Appeal | If we refuse, you can appeal, and we answer every appeal. See §8. |
§3 — The clocks we hold ourselves to
| Regime | Clock |
|---|---|
| Acknowledgement, everyone, every time | 1 business day |
| UK and EU (UK GDPR / GDPR) | 30 days, extendable by up to 2 further months where the request is complex. If we extend, we tell you why inside the first 30 days. |
| California and other US state privacy laws | 45 days, extendable once by a further 45 days with notice. |
| Appeals | 45 days, everywhere, regardless of which regime is shorter. |
We do not charge for any of this. If a request is manifestly unfounded or repetitive we may say so and explain why, rather than quietly not answering.
§4 — How we verify you
We have to know you are who you say you are before we hand over data about you. We also have to do that without collecting more sensitive data than the request itself.
If you are a client: the request is confirmed through the email on your account. No new documents.
If you are not a client: tell us the handle, username or URL that connects you to the data. We match it against what we hold and reply to the address you give us. If the match is ambiguous, we ask you one narrow follow-up question. We do not ask for a government ID for an access request unless there is no other way to verify, and if we do ask, we tell you why, we look at it in a live session, and we do not store it.
We never ask for a password, a payment method, or a social security number as part of verification.
§5 — Authorized agents
You can appoint someone to make a request for you.
Send us written permission signed by you, plus your agent's contact details. We will contact you directly to confirm the appointment and to confirm the request, unless you have supplied a valid power of attorney. We do not accept an agent's assertion alone.
§6 — What we cannot delete, and why
A deletion promise with no exceptions listed is a promise nobody kept. Here are ours.
| What survives deletion | Why | How long |
|---|---|---|
| Takedown notices we sent | Already public record in part, and our own defence file under 17 U.S.C. § 512(f). Retained on the basis of establishing, exercising or defending legal claims. | 7 years |
| Evidence captures attached to a notice we sent | Same basis. | 7 years where attached to a dispatched notice, otherwise 12 months |
| Billing and tax records | Required by tax law. | As long as tax law requires |
| Suppression list entries | If you asked us never to contact you, we have to keep enough to honour that. | An email hash and nothing else, kept until you ask us to remove it |
| Records of a data request and how we answered it | So we can show we answered it. | 3 years |
Everything else goes. Deletion is started the same working day we read the request and completed within 30 days. When it completes you get a Certificate of Destruction listing what was destroyed and when.
§7 — Standing statements
We do not sell or share personal information, period. No exceptions, no "we may in future", no list of partners. We honour Global Privacy Control signals automatically.
Sensitive personal information. We use sensitive personal information only for the permitted purposes in CCPA regulation § 7027(m) and do not use or disclose it to infer characteristics.
No advertising trackers. There is no Meta Pixel, no GA4, no third-party chat widget and no reCAPTCHA on this site. Analytics are cookieless. Cloudflare sits in front of the site for the bot check and processes your IP address when the page loads. That one operation is named in our privacy notice.
§8 — Appeals
If we refuse a request in whole or in part, we tell you why in writing and we tell you how to appeal in the same message.
To appeal, reply to that message with the word appeal and anything you want us to consider. The request is reviewed again from the start, by a person, against the original request rather than against our first answer. We answer within 45 days, everywhere, whether or not your state requires an appeals route.
If you are still not satisfied:
- UK: you may complain to the Information Commissioner's Office.
- EU: you may complain to your national supervisory authority, or to FOUNDER: EU Article 27 representative.
- US states with an appeals right: we will give you the contact details for your state Attorney General's office in our appeal response.
Our representatives:
EU Article 27 representative: FOUNDER: EU Article 27 representative
UK Article 27 representative: FOUNDER: UK Article 27 representative
§9 — Notice for people who are not our clients
This section is our Article 14 notice. It is here because we collect personal data about people from sources other than those people.
What we collect. URLs, page titles, page captures, timestamps, and any username, handle or display name shown publicly on a page where a client's content appears. Where a page shows a poster's username, we record that username.
Where we get it. Publicly accessible websites, publicly accessible channels, and search engine results. We do not buy data, we do not scrape private areas, and we do not create accounts to access material behind a paywall.
Why we hold it. To produce the evidence a removal notice requires, and to keep a record of what we sent and when. The lawful basis is our legitimate interests, and for evidence captures and the notice archive, the establishment, exercise or defence of legal claims.
How long. Evidence captures for 12 months. Notices and their attached evidence for 7 years.
Who sees it. The people who verify matches and file notices, working from URLs and page captures. The recipient of a notice, which is the host, registrar, search engine or platform. Nobody else. We do not publish it, sell it, or add it to any product.
Why we did not write to you individually. In most cases we hold a username and no contact route of any kind. Locating and contacting each person would involve collecting far more data about them than we currently hold, which is the opposite of what a privacy notice is for. We rely on Article 14(5)(b) and publish this notice instead. That position is documented and dated internally.
What you can do about it. Use the form below. You will get the same clocks and the same appeal route as a client.
§10 — The form
If the bot check fails, email FOUNDER: privacy email and we'll open the request manually, on the same clock.
§11 — Where to write instead
If you would rather not use a form:
FOUNDER: privacy email
Postal: Data Requests, FOUNDER: entity legal name, FOUNDER: registered agent address
Both routes run on the same clocks.
Last updated LAST_UPDATED. Our data protection impact assessment was completed and dated FOUNDER: DPIA completion date.