Information we collect
We collect only what is needed to find and remove leaked content.
- Free scan: the username you enter, the per-source counts returned, your browser's user-agent string, and a salted hash of your network address used only for rate limiting. The raw address is not stored.
- Lead capture and "email it to me": the email address you enter, the source page, and (for the free scan) the handle and counts you were shown. Where an endpoint records a network address it is stored as a salted hash; the older lead-capture endpoint may hold the raw address.
- Free tools: the URL, name and details you type are used to render the result and discarded; only a salted hash of your network address and browser id is kept for rate limiting.
- Leak watchlist: the email address and up to three URLs you ask us to watch, plus the confirmation and unsubscribe tokens for that watch, kept until you unsubscribe.
- Intake forms: the details, identification documents and reference images you upload through an agency's intake link, stored in access-controlled private storage for that agency.
- Account data: email and authentication details if you create an account.
- Creator profiles: the social handles and platforms you add so we can target scans.
- Takedown data: the URLs you choose to action and the information needed to file a valid notice.
- Billing data: handled by our payment processor; we do not store full card numbers.
- Usage data: standard logs and analytics to operate and improve the service.
How we use it
We use your information to run scans, send and track takedown notices, prepare and track de-indexing requests, process payments, communicate with you about your account, and improve detection. We do not sell your personal information.
What we store
A username scan does not require uploading private content. Where content or evidence is needed to file a specific notice, it is stored only as long as necessary to pursue and document that request.
Cookies and analytics
We use essential cookies/local storage to keep you signed in, plus limited analytics to understand and improve the service. See our Cookie Policy for details and how to control them.
Service providers
We rely on a small set of vetted third parties (for hosting, payments and scanning) to operate the service. They process data only on our instructions. The current list is published on our Subprocessors page.
Face data (biometric information)
Face matching is optional. It is off unless the creator shown in the reference photos gives consent on a consent page sent to them. With that consent, openDMCA makes a face template (a list of numbers that describes a face) from each reference photo that shows only that creator, and compares the faces in images on pages its scans find with those templates. When the consent text the creator agreed to says so, it also compares the faces in an image checked for being a deepfake, to tell whether the fake shows that creator. Faces found in those images are compared and then discarded, never stored.
- Templates are stored encrypted, used only to find leaks of that creator's content and fakes of them, compared only with that creator's own reference photos, and never sold, leased, traded or shared.
- A face match is noted on the leak for a person to review. It never sends a notice by itself.
- Templates are deleted when the creator withdraws consent (with their consent link, or by asking the account that manages them), when the photo or the creator profile is deleted, and at the latest three years after consent was given.
- The consent record (the name typed, the time and the text agreed to) is kept as proof of consent for as long as the creator profile exists.
Marked copies (forensic watermarking)
A creator can make copies of their own picture or video that each carry an invisible mark, one per person they give a copy to, and later check a leaked copy for whose mark it carries. For each recipient openDMCA stores only the name or ID the creator typed, together with that copy.
- Recipient names and check results are visible only to the account managing that creator. openDMCA never contacts recipients or publishes their names.
- A recipient's name is deleted with their copy, when the creator deletes the batch, or when the original picture or video is deleted.
Data retention
We keep account and takedown records for as long as your account is active and as needed to provide the service, resolve disputes and meet legal obligations. Free-scan logs, hashed rate-limit keys and lead records are kept until deleted on request; watchlist rows are kept until you unsubscribe; intake uploads are kept while the agency that collected them is a customer. You can ask us to delete any of it sooner, subject to those obligations.
Your rights
Depending on where you live, you can request access to, correction of, or deletion of your personal data, and you can cancel your account at any time. To exercise these rights, email privacy@opendmca.com.
Contact
Questions about this policy, or privacy requests, can be sent to privacy@opendmca.com or by mail to:
- FounderGem LLC c/o
- 1309 Coffeen Avenue STE 1200
- Sheridan, WY 82801
- United States
- Email: privacy@opendmca.com