Privacy Policy

Version 2026-11-03. Effective November 3, 2026.

Who we are

GetMyDMCA is a service of E.R MARKETING LLC, a Wyoming limited liability company, 30 N Gould St, Sheridan, Wyoming 82801, United States ("we", "us"). We decide how and why your personal data is used, so we are responsible for it (the "controller").

When an agency gives us details about a creator, we are a controller of those details in our own right. We are not the agency's processor.

To reach us about privacy, write to [email protected], or by post to the address above.

Who this policy covers

This policy explains how we handle personal data about:

you, the account holder, and anyone you let use your account;
creators you add to your account;
people who reply to our takedown notices;
people who appear on web pages we find while searching for a creator's content;
visitors to getmydmca.com.

GetMyDMCA is a service for businesses: agencies, and creators running their own business. This policy still covers every person whose data we hold.

If your business signed a separate written agreement with us about personal data, that agreement applies where it says so.

What we collect and where it comes from

Your account

You give us your username, email address and password when you sign up. We store your password only as a one-way hash. We also keep:

your name, company, website and profile picture, if you add them;
your time zone and your browser's language;
your newsletter choice;
the version of our terms you accepted, and when;
your answers to our sign-up questions (your account type and how you heard of us);
your two-step login settings (the secret is stored encrypted, recovery codes only as hashes);
a history of changes to your email address, with the IP address and browser of each request;
temporary codes and links for email verification, password reset and two-step login;
when you last logged in and were last active;
notes on your account's status, such as a suspension and its reason.

Security and login records

Each time you sign up or log in, we record:

your IP address and the approximate location it points to (country, region, city, approximate coordinates, time zone, internet provider and network, and whether the address belongs to a proxy, a data center or a mobile network);
your browser, operating system and device type, and the time zone your browser reports;
a short code computed from your IP address and browser details, to recognize a device we have seen before;
your sessions, your login history and failed login attempts on your account.

We use these records to protect accounts, warn you about unusual logins and spot suspended users who open new accounts.

Creators you add

You give us each creator's stage names and official profile links. We also keep the confirmation you ticked when you added the creator (its text version and the time), the creator's verification status and dates, the reason if we refuse to verify a creator, and the creator's plan.

To verify a creator, our system or our team looks at the creator's public profile page, for example to find a code we gave you in its bio.

Our service does not ask for or store a creator's legal name, email address, phone number, photos or ID. If we ask to see a creator's signed authorization (terms section 8.6), we see the details on it, such as the creator's legal name. We keep our emails about that check. We search only for creators we have verified.

If you add a creator, tell them you use GetMyDMCA and where to read this policy. Our terms ask you to.

Search results and pages we find

To find a creator's content, we send search queries that contain the creator's stage names to a web search provider, and our systems visit sites where leaked content is often posted. For each page we find, we keep its address, its site, the page it was linked from, the address of any media it embeds, which stage name matched, and the page's title and a short excerpt.

These pages are public. They may show or name other people, such as the person who posted the content. We do not set out to collect details about those people, but their names, usernames or images can appear in a page's address, title, excerpt or saved copy ("Takedowns and saved page copies").

Takedowns and saved page copies

When we act on a link you approved or added, we keep a record of the takedown. It holds the notice or request we sent, the stage name and official links it used, the reported link and the recipient. It also holds references, dates, statuses and replies. We also save a private copy of the reported page as our system received it, with technical details of the visit. A saved copy may include, or link to, explicit material.

Replies to our notices

If you reply to one of our notices, we receive your email address, the name in your email's From line, the subject, the text of your message and the number of attachments. Your reply may also include your name, postal address, phone number or anything else you choose to send. We store the text in our system. A full copy, with any attachments, is kept in our email archive, and may also be kept in our private file storage.

Billing

You enter your card details and billing address on Stripe's payment pages. Card numbers never reach our servers. From Stripe we keep your customer and subscription references, the plan of each creator, your billing period and the number of seats on each plan. We also keep payment status, amounts, taxes, invoice numbers, payment references, the card type and its last 4 digits, and failed payment attempts.

Support

We keep the messages you send us, our replies and any files you attach. If your account is suspended and you appeal, we keep your appeal.

Email

We keep whether our emails to you were delivered, bounced or marked as spam, and whether you unsubscribed.

Visitors

When you visit getmydmca.com, our network provider and our servers receive your IP address, your browser details and the pages you ask for. Our sign-up, login and password reset forms run a security check from Cloudflare. When you type an email address on our sign-up form, we check it with DeBounce to see whether it is a disposable address, even before you submit the form.

Why we use it, and our legal bases

Some laws, such as the GDPR in the European Union and the United Kingdom, ask us to state a legal basis for each use. Ours are:

To provide the service: run your account, search for your creators' content, send and track takedowns, bill you, answer support and send service emails. Basis: our contract with you or your business.
To act for your creators: use their stage names and official links in searches and notices, and keep the record of what we sent. Basis: legitimate interests (yours, the creator's and ours, in enforcing the creator's copyright).
To handle replies to our notices: store, sort and answer them, and update the takedown. Basis: legitimate interests.
To keep the service safe: login records, location from IP addresses, the device code, the form security check, the disposable email check, spotting suspended users and alerting our team. Basis: legitimate interests (security and fraud prevention).
To keep records after a takedown ends or a creator or an account is deleted, in case a notice is ever disputed. Basis: legitimate interests (establishing, exercising or defending legal claims).
To run and improve the service, including anonymous, aggregated statistics (for example, removal rates by site) that we may also use to promote it. They never name a creator without permission. Basis: legitimate interests.
To send our newsletter, if you chose to receive it. Basis: your consent, which you can withdraw at any time ("Your rights").
To meet legal duties: tax and accounting records, answering lawful requests and reporting suspected child sexual abuse material. Basis: legal obligation, or our legitimate interest in protecting children where no law requires it.

Pages we find and save may show a creator's sexual content. Where the law treats that as sensitive data, we use it only because it is needed to establish, exercise or defend the creator's legal claims.

You must give us a username, an email address and a password to open an account. You must also give us a creator's stage names and official profile links to protect that creator, and payment details to buy a plan. Without them we cannot provide the service. We collect the security and login records automatically. The other account details are optional.

Automated processing

Some of our processing is automatic:

Login checks compare each login with your recent ones (for example a new country, or travel that looks impossible) and may email you an alert. For a high-risk login we alert you even if you turned login alerts off.
When a new account matches the IP address or device code of a suspended account, our system flags it for our team. A person decides what happens next.
Once we give you a code for a creator's bio, our system can check the bio and verify the creator when it finds the code. If it cannot, our team reviews the profile.
An automated tool sorts each reply to our notices into one of a few categories and can move the takedown to a new status, for example acknowledged or rejected. A reply it cannot sort is left for our team.
We match search results against your creators' stage names, and skip their official profile links.

None of this makes a decision about you, with legal or similarly significant effects, by automation alone. If you think an automatic result is wrong, write to us and a person will look at it.

No biometric processing

We do not collect photos of creators, and we do no face recognition or other biometric processing. If we add a feature that does, we will update this policy and ask for consent first.

Who receives your data

Recipients of our notices

Sending notices is the service, so notices go to those who can remove content: Google, hosting providers, networks such as Cloudflare, domain registrars and platforms. A notice names the creator by stage name and lists the creator's official profile links and the reported link. It gives our reply address and a reference. A notice sent by email, or through the form of a host, network, registrar or platform, also gives our postal address. An email notice also lists the page where we found the link, when we know it. A notice does not include your name, your email address or the creator's legal name.

Recipients may forward or publish notices. Google may send copies of removal requests to the Lumen database, which publishes them, and Google may list them in its Transparency Report. A host may forward a notice to the person who posted the content.

Report links

If you share a report link for a creator, anyone who has the link can see that creator's takedown results, until you stop sharing it.

Our service providers

These companies process data for us, under their own terms:

Latitude.sh: our servers.
MongoDB (Atlas): our database.
Cloudflare: the network and security in front of our site, the security check on our forms, and file storage, including the private storage of saved page copies.
Mailgun: sends our emails and receives replies to our notices.
Google (Google Workspace): our email archive, which keeps a copy of every reply to our notices.
Amazon Web Services: storage and backup of our server logs.
Stripe: payments and invoices.
OpenRouter and TypeSafe: sorting replies to our notices. They receive the reply's sender address, subject and text, and one line saying which kind of notice we sent and to which site. TypeSafe states that it does not train its models on these requests.
OpenWeb Ninja, through RapidAPI: web search. It receives search queries that contain creators' stage names.
Databay: a proxy network we use to visit web pages, including creators' public profile pages. It sees the addresses we visit.
ip-api.com: finds the approximate location of an IP address.
DeBounce: checks whether an email address is disposable. It receives the email address typed on our sign-up form.
Telegram and Discord: alerts to our team. An alert can include your username or email address, account events such as a suspension, and the first lines of a support message.

Our team

The people who run GetMyDMCA, our team and our contractors, can access personal data to operate and support the service. All of them are bound to confidentiality in writing. To help you, a team member can sign in to your account for up to 2 hours at a time, and we log each time. Our team can see your saved page copies.

Legal and safety

We share data when the law, a court or a public authority requires it, or when we need to protect rights, property or safety. If we find signs that content involves a person under 18, we report it to the National Center for Missing & Exploited Children (NCMEC). If a creator tells us an agency added them without their authority, we may tell the creator which account added them, and we tell that account we did.

A sale of the business

If we sell or transfer all or part of the business, data can pass to the buyer, and this policy keeps applying to it.

No sale, no advertising

We do not sell personal data, and we do not share it for advertising.

Where your data is

We are based in the United States. Your data is stored and processed mainly in the United States and in other countries where our providers operate. When data about people in the European Economic Area, the United Kingdom or Switzerland goes to another country, we rely on our providers' data protection terms, including the standard contractual clauses where they offer them. If your business needs a data transfer agreement with us, write to us. Write to us for a copy of these safeguards.

How long we keep it

Your account, your sessions and your login history: while your account exists.
In-app notifications: 30 days. Security and billing notifications, such as a login alert with its IP address and city: 365 days.
Creators, their search settings, search results and findings: until you delete the creator or your account.
Takedown records, saved page copies and replies to our notices, including the copy in our email archive: until 3 years after the takedown reaches its final status (such as removed, already gone before we sent, canceled, or our checks ended without a removal). They stay after you delete a creator or your account, because they show what was sent for you.
A saved page copy that appears to show a person under 18: reported, then kept or deleted only as the law requires.
A reply we cannot match to a takedown: up to 3 years after we receive it.
When you delete your account, we keep your email address, your username and the version of our terms you accepted, with its date, for as long as we keep your takedown records.
Also kept for up to 3 years after you delete your account: a ban appeal you sent and our log of team sign-ins to your account. The same applies to our record of which newsletters were sent to your account, which holds no email address, and to usage counts per creator, which hold no names.
Support messages: deleted with your account. Files you attached to support messages, and your profile picture, are not deleted automatically when you delete your account. Write to us and we delete them.
The original of each reply, held by Mailgun: about 3 days.
Server logs, which can include your IP address and username: up to 30 days.
Database backups: for a limited time, after which they are replaced.
Working copies in our caches and job queues: from minutes up to 7 days.
Payment records held by Stripe: as Stripe's own legal duties require.
Your newsletter choice: until you change it or delete your account.

We may keep data longer when the law requires it, or when we need it for a legal claim.

Security

We protect data with encrypted connections, one-way hashed passwords, encrypted two-step login secrets, and private storage for saved page copies, which open only through download links that expire within minutes. Access to our systems is limited to the people who run the service.

Your profile picture is stored at an unlisted link: anyone who has the link can open it. Files you attach to a support message are kept in private storage and open only through links that expire within minutes, for you and our team. Do not attach explicit images.

No system is perfectly secure. If a breach affects your personal data, we will tell you as the law requires.

Cookies and browser storage

We set one cookie, authToken, which keeps you logged in for 24 hours, or for 30 days if you choose to stay logged in. Your browser's storage keeps your display settings, such as theme and sidebar, and the progress of forms you are filling in, such as two-step login. Cloudflare may set its own cookies to protect our site and run the form security check.

All of these are needed for the site to work. We use no analytics or advertising cookies, and we do not track you across other websites, so a Do Not Track signal changes nothing here.

Your rights

Depending on where you live, you may have the right to:

see the personal data we hold about you, and get a copy in a common format;
correct it;
delete it;
limit how we use it;
object to a use (see below);
withdraw your consent to our newsletter.

You can correct most account details yourself in Settings, and see and end your sessions there. For everything else, including deleting your account, write to [email protected] from your account's email address. We may ask you to confirm who you are. We answer within 30 days, and tell you if a complex request needs more time.

Your right to object. You can object at any time to the uses we base on legitimate interests ("Why we use it, and our legal bases"). Write to us and we stop, unless we have compelling reasons to continue or need the data for a legal claim.

To stop the newsletter, use the unsubscribe link in any newsletter, or write to us.

Some data stays after a deletion request: the takedown records and the other items listed in "How long we keep it", which we keep for legal claims.

If you are in the European Economic Area or the United Kingdom, you can also complain to your data protection authority.

If you are a creator. You have these rights too. If an agency added you without your authority, write to us. While we look into it, we pause all work for you by sending your profile back to verification, and we may suspend the account that added you. We may also tell you which account added you.

If you replied to one of our notices, or appear on a page we found, write to us. We will answer, but we keep the notice records we need for legal claims.

Children and age

GetMyDMCA is only for people 18 and older, and every creator you add must be 18 or older. We do not knowingly collect data about anyone under 18. If you believe we have, write to us.

Changes to this policy

When we change this policy, we post the new version here with its version and date. For a change that reduces your rights, we also email account holders at least 14 days before it applies.

Contact

GetMyDMCA, a service of E.R MARKETING LLC

30 N Gould St, Sheridan, Wyoming 82801, United States

[email protected]