Privacy Policy

Fanlock LLC operates Fanlock and is responsible for personal data we process to run our service. Contact legal@fanlock.com about this notice or your privacy rights. An agency managing your account may also be responsible for its own use of your information.

For EEA and UK users, providing the service relies on performance of our contract with you. Security, abuse prevention and necessary service administration rely on legitimate interests, balanced against your rights. Applicable financial and other legal duties may require specific records. Where information falls within a specially protected category, an additional applicable legal condition is required; contact us about the processing used for your case.

• Account and contact details: email, account identifiers, authentication records, settings, stage names, aliases, platform handles and URLs. We use these to provide and secure your account. Phone numbers are optional unless you choose a service that needs one. Text updates require your messaging preference; you can remove your number or turn texts off in settings.
• Ownership and authorization: dashboard screenshots, verification submissions, any legacy verification selfie, legal name and signed authorization where needed for your case. Submit only the requested proof and hide unrelated balances, messages and other people’s details.
• Protection and enforcement: reference media, reported URLs, search results, detected content and metadata, scan results, takedown notices, case status and correspondence. These may come from you, your authorized agency, search services, websites or platforms we review. Content can be sensitive, including intimate material.
• Payments, gifts and referrals: subscription and transaction identifiers, billing status, gift messages, sender/recipient details, affiliate applications and commission records. Stripe handles payment collection. We do not need your full card number in our application database.
• Support and security: messages you send us, notification delivery records, access events and limited technical diagnostics. Hosting and service providers may process IP addresses and device information to deliver requests and prevent abuse.
• Public-site tracking: visit, engagement and referral information collected by our public-site analytics, advertising and referral services. These purposes are separate from the information needed to run your account.

Our infrastructure, authentication, storage, payment, communication and monitoring providers process information needed for their services. These include Supabase, Vercel, Google Cloud, Stripe, Resend, BoldSign, Chatwoot and Sentry where the relevant feature is used. Search and AI service providers may process queries, URLs or content needed for detection and review. Contact us for the providers relevant to your account.

Authorized staff and an agency you have connected can access information needed for their work. Verification-file access is restricted and audited. Takedown recipients receive case details and evidence needed to assess a notice. We use Fanlock’s agent contact details and your stage name where possible. A recipient or applicable legal process may require additional identifying information; we do not promise that every notice can be handled without it. Recipients may keep their own legally required records.

We do not sell personal data for money. Optional advertising or referral services may involve sharing under some privacy laws. Our public-site trackers respect browser Do Not Track and Global Privacy Control signals. We do not send signup, scan, checkout or purchase conversion feeds or account contact details for advertising matching.

Essential cookies support authentication and security. Public-site analytics, advertising and referral services may include Google Analytics, Meta Pixel and Rewardful and may load automatically. Optional tracking is excluded from account, onboarding, checkout and other private pages; session replay is disabled.

The site currently has no cookie-consent banner or preferences control. You can manage cookies in your browser. Our public-site trackers respect Do Not Track and Global Privacy Control signals. You can also contact us to request deletion of information already collected.

We use authenticated access, database access policies, restricted server credentials, private file storage, permission checks and access auditing. New verification download links require authenticated access. Older links may remain valid until we complete their replacement. New case-evidence links shared through our privacy controls are revocable and expire within seven days. Account exports require renewed email verification; download access expires 24 hours after release. We reduce sensitive information in logs and restrict staff access according to their role. No system can guarantee absolute security.

We keep account and protection records while needed to provide your service. We review verified erasure requests, including which records we must delete and which providers need to act. Automated erasure and scheduled deletion remain disabled while we verify provider cleanup and backup handling. Our team handles requests during this rollout; we confirm completion and explain any outstanding steps in our response. Leaving an agency removes its access and does not automatically erase an independently owned creator account.

A legal claim, accounting duty or other specific obligation may require us to retain limited records. We review the reason, scope and duration of any exception when responding to your request. Backups and provider records may follow separate schedules. We are verifying these schedules and the process for reapplying deletions before restoring backups to service.

The periods below are our retention targets during rollout. They do not confirm that we have deleted existing copies or configured each provider to match. Export download access expires after 24 hours even while physical deletion remains subject to review.

• Temporary uploads and generated export copies: a 24-hour deletion target. A reviewed export is available for 24 hours after release; an expired draft must be rebuilt.
• Reviewed legacy selfies: a deletion target of 30 days after the verification decision, unless a specific retention obligation applies.
• Routine application logs: a 30-day retention target. Security and search diagnostics: a 90-day target. We are verifying provider settings and any mandatory retention exceptions.
• Minimal privacy request, consent and access audit records: a 12-month retention target. Our erasure process includes suppression records to block delayed jobs from recreating an erased account.

Fanlock and its providers may process data in the United States and other countries outside your home country. Applicable transfers require an appropriate legal mechanism and safeguards. Contact us for information about the locations, contractual protections and safeguards relevant to your data. We do not represent that all information stays in the EEA or UK.

Depending on applicable law, you can request access and a portable copy, correction, deletion, restriction, or object to processing, including direct marketing. You may withdraw consent at any time. Use Privacy & your data in your account or email legal@fanlock.com; an account is not required to make a request. We verify identity proportionately, and do not ask you to send identity documents in ordinary email.

For GDPR requests we aim to respond within one calendar month. If the law permits an extension for complexity or the number of requests, we will explain the reason within the first month; an extension is limited to two further months. We explain any refusal or retention exception. You can complain to your local data protection authority and seek other remedies available under applicable law. You can ask for human review of a disputed verification or enforcement decision.

We will update the date above when this notice changes and provide additional notice where required. Our Terms of Service explain the service and your authorization for enforcement.

Fanlock offers an optional browser extension ("FanLock Content Reporter") that lets you report leaked or infringing copies of your own content directly from your browser — by ticking results on a Google search or Google Images page, or by right-clicking a page, link, or image. This section governs the extension. The analytics and advertising services described in Cookies and your choices (Google Analytics and the Meta Pixel) run on the Fanlock website only; the extension contains no analytics, advertising, or third-party tracking code.

The extension does not track your browsing, read your history, or run on any site other than Google. It reads a page's address only when you explicitly act on it, and it transmits data only to Fanlock's backend over an encrypted (HTTPS) connection — only when you sign in or submit a report. It collects and stores the following:

• Authentication information: Your Fanlock login session (and, if you use "Sign in with Google," the account email that sign-in returns). This is stored locally in your browser so you stay signed in, and is sent only to Fanlock to authenticate your requests.
• The links you choose to report: When you tick results on Google, or right-click a page, link, or image and choose "Report this to Fanlock," the extension reads the URL(s) you selected — and the address and title of the tab you are on at that moment — so it can file the takedown. It does not read, log, or transmit any other page.
• Your reporting preferences: The creator you are reporting for (for agencies), whether the Google overlay is on or off, a short list of your own recent submissions, and a link handed from a right-click to the report window. These are stored locally in your browser.

When you choose "Sign in with Google" in the extension, it receives basic account information (such as your email address) through Google's OAuth sign-in, so it can authenticate you to your Fanlock account.

Fanlock's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including its Limited Use requirements. We use this information solely to sign you in to your Fanlock account. We do not sell it, use it for advertising, or transfer it to third parties except as necessary to provide the Service, to comply with applicable law, or in connection with a merger or acquisition; and we do not allow humans to read it except with your consent, for security or support, or where required by law.