Last updated 2026-07-28
The data controller is StormDMCA. You can reach us about anything in this notice at privacy@stormdmca.com, which is the fastest way to get an answer from us.
We are established in Italy, so the EU General Data Protection Regulation (GDPR) applies to everything we do with your data, wherever in the world you live. Most of our clients are in the United States; that does not reduce the protections described here.
Information you give us. Your email address, the stage name your fans know you by, any other aliases you use, the platforms you post on, and the addresses of your official pages. If you subscribe, your billing details are collected and held by Stripe, not by us: we only ever see your plan, your subscription status, and the last four digits and card brand that Stripe shows us.
Information we find for you. This is the core of the service. When we run an analysis we search public web pages, Google Search and Google Images for your name and aliases, and we record the web addresses (URLs) where copies of your content appear, plus the domain, the date we found it, a confidence score, and the removal status we track over time.
Information about your case. The takedown notices we send on your behalf, who we sent them to, when, and how each recipient responded.
Technical information. Your IP address when you sign up or sign an agreement (we record it as proof of consent and to stop abuse), and ordinary server logs.
We do not download, copy, host, or store the infringing images or videos themselves. We store the addresses that point to them.
A web address that shows sexually explicit material depicting an identifiable person is, in law, information about that person's sex life. Article 9(1) GDPR prohibits processing that kind of data unless a specific exception applies. Two of them apply here, and we rely on both:
We want to be explicit about a basis we do notrely on. Leaked content is technically public, but the law does not treat "publicly accessible" as "made public by you". The Court of Justice of the European Union has held that this exception requires a clear, affirmative act by the person themselves. Content posted without your consent is the opposite of that, so we never treat it as data you made public.
| What for | Legal basis |
|---|---|
| Creating your account and running your free analysis | Performance of a contract, Art. 6(1)(b) |
| Handling the addresses of explicit content depicting you | Your explicit consent, Art. 9(2)(a), and legal claims, Art. 9(2)(f) |
| Filing takedown notices and delisting requests | Contract, Art. 6(1)(b), and Art. 9(2)(f) |
| Taking payment and managing your subscription | Contract, Art. 6(1)(b), and legal obligation for tax records |
| Preventing abuse of the sign-up form, keeping the service secure | Legitimate interests, Art. 6(1)(f) |
| Sending you your weekly progress digest | Contract, Art. 6(1)(b). You can turn it off. |
Recipients of the notices we send for you. To get content removed we have to tell the recipient what to remove and on whose behalf. A takedown notice therefore identifies you by the name you gave us and lists the addresses to be removed. It goes to website operators, hosting providers, CDNs such as Cloudflare, domain registrars, and search engines including Google. Many of these are outside the EU, in countries without an EU adequacy decision. That transfer is permitted under Article 49(1)(e) GDPR because it is necessary for the exercise of a legal claim, and it is the entire point of the service you asked us to perform.
Service providers acting on our instructions. Each is bound by a data processing agreement and may only use your data to provide their service to us:
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database and authentication | EU / USA |
| Vercel | Hosting of this portal | USA |
| Stripe | Payments and subscription billing | USA / EU |
| Resend | Transactional email delivery | USA |
| Serper.dev | Search queries used to locate leaked content | USA |
| Anthropic | Drafting of published articles (no creator data) | USA |
| Hostinger | Email hosting for our legal mailbox | EU |
We never sell your data, never share it for advertising, and never use it to train an AI model.
Several of the providers above are in the United States. Those transfers rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses. Transfers contained in the takedown notices themselves rely on Article 49(1)(e), as described above. You can ask us for details of the safeguards in place for any specific provider.
Our system searches automatically and gives each result a confidence score, but it does not decide anything about you on its own. Every link is reviewed by a person before it enters a case, and no notice is ever sent in your name without a signed authorization from you. You are not subject to a decision based solely on automated processing within the meaning of Article 22 GDPR.
Wherever you live, you can ask us to:
Write to privacy@stormdmca.com and we will answer within one month. Withdrawing consent does not undo what we did lawfully before you withdrew it, and it does not recall notices already sent.
If you think we have handled your data badly, you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali, or to the authority where you live.
GDPR rights apply to you too, because we are established in the EU. We do not sell or share personal information as those terms are defined in California law, and we do not use your data for targeted advertising. If California, Colorado, Virginia, or another state gives you a right that goes beyond the list above, write to us and we will honour it.
The service is for adults only. You must be 18 or older to create an account. If we learn that we hold data about a minor, we delete it immediately.
This portal sets one cookie, which keeps you signed in. It is strictly necessary for the service to work, so it does not require consent. We use no analytics, no advertising, and no third-party tracking here.
If we change this notice we update the date at the top, and if the change matters we tell you by email before it takes effect. See also our terms of service.