Privacy Policy

Article 1 Introduction, Scope, and Who We Are

This Article identifies who we are, what this Privacy Policy covers, the roles in which we handle Personal Information, and the defined terms used throughout.

1.1 Purpose and Scope of This Policy

This Privacy Policy (this “Policy”) describes how Copyright Library collects, uses, discloses, retains, and protects Personal Information, and the choices and rights available to individuals. It is the privacy policy that the California Online Privacy Protection Act, Cal. Bus. & Prof. Code §§ 22575–22579, requires a commercial website operator to post conspicuously, and it gives the notices required by the laws identified in Article 7 and Article 8. We intend every statement in it to be accurate, recognizing that a misleading privacy statement may be a deceptive practice under Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45(a).

This Policy applies to Personal Information we collect, online or offline, in connection with:

1. your visit to and use of the Site;
2. a YouTube channel link you submit through the Site to request a Scan, and the resulting Scan;
3. inquiries you send us by email, telephone, web form, or otherwise;
4. our engagements with Clients, from first contact through termination, including information about Client personnel and representatives; and
5. the copyright matters we handle, including information about Rights Holders, Alleged Infringers, persons who submit Counter-Notifications, and others named in monitoring results, Notices, or related correspondence.

If you have an account with us or access a client portal under an Order Form or Statement of Work, this Policy also applies to Personal Information associated with that access, subject to Section 1.3(c).

1.2 Who We Are

Copyright Library is a United States copyright-protection agency, and our Services are a 100% US product: designed, built, and operated in the United States. The Site and the Services are operated by legal entity name, a entity type organized under the laws of state of organization, corporate registration No. registration number, whose principal business address is business address. “Copyright Library,” “we,” “us,” and “our” refer to that entity; “you” and “your” refer to any individual whose Personal Information we handle in a matter described in Section 1.1, whether or not that individual has any relationship with us.

1.3 The Capacities in Which We Process Personal Information

Our obligations depend on the role in which we handle Personal Information; one individual may be affected by more than one capacity.

1. Business or controller. For Site visitors, persons who request a Scan, prospective Clients, and the personnel of Clients, Service Providers, and other business contacts, we decide why and how Personal Information is processed. To the extent those laws apply to us, we act here as a “business” under Cal. Civ. Code § 1798.140(d) and a “controller” under state laws such as Va. Code Ann. § 59.1-575.
2. Authorized agent of Rights Holders. When we prepare and submit a Notice, we act for the Rights Holder and only within the written authority it has given us. That authority supports the statement, made under penalty of perjury, that the complaining party is authorized to act on behalf of the owner of an exclusive right that is allegedly infringed (17 U.S.C. § 512(c)(3)(A)(vi); see Section 3.3). In this capacity we handle information about the Rights Holder, its works, the material identified, and Alleged Infringers to establish and enforce the Rights Holder’s rights. Unless capacity (c) applies, this Policy governs that information. Our authority-verification and review procedures appear in Article 3 of our DMCA & Copyright Policy.
3. Service provider or processor. Where a signed Order Form, Statement of Work, or data processing terms so provide, we process specified Personal Information on a Client’s behalf as a “service provider” or “contractor” under Cal. Civ. Code § 1798.140(ag) and (j), or a “processor” under Va. Code Ann. § 59.1-575 and comparable laws, solely on the Client’s documented instructions. The Client’s own privacy notice, not this Policy, governs that information, and we refer inquiries about it to the Client.

Where no written agreement defines our role, we treat ourselves as acting in capacity (a) or (b), as the context indicates.

1.4 What This Policy Does Not Cover

This Policy does not apply to:

1. the practices of any Platform, including how it processes, forwards, or publishes Notices and Counter-Notifications, which its own terms and privacy policy govern;
2. the Lumen database and any other third-party database, archive, or transparency report in which copies of Notices are published;
3. third-party websites and services linked from the Site or our communications;
4. Personal Information of our employees, contractors, and job applicants, which a separate notice provided at or before collection covers; and
5. Personal Information we process under Section 1.3(c), which the relevant Client’s privacy notice governs.

We do not control, and are not responsible for, those third parties’ practices.

1.5 Defined Terms

Capitalized terms have the following meanings throughout this Policy; the singular includes the plural.

Alleged Infringer

A person identified through our monitoring, a Notice, or related correspondence as having posted, hosted, linked to, or otherwise made available material claimed to infringe a Rights Holder’s copyright, including the operator of the account, channel, or website concerned. The term is descriptive and implies no finding of infringement.

Client

A creator, brand, studio, publisher, game company, or other person that engages us to provide Services, including its authorized representatives where the context requires.

Counter-Notification

A counter notification under 17 U.S.C. § 512(g)(3), or a comparable dispute or appeal under a Platform’s own procedures, submitted in response to a Notice.

Notice

A DMCA takedown notice under 17 U.S.C. § 512(c)(3) (including as applied to information location tools by § 512(d)(3)), or a copyright complaint submitted through a Platform’s own process.

Order Form or Statement of Work

Any order form, statement of work, services agreement, data processing terms, or other written agreement between us and a Client describing the Services, as amended.

Personal Information

Information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, consistent with Cal. Civ. Code § 1798.140(v) and equivalent terms in other applicable laws. It excludes information deidentified or aggregated as described in Section 3.5.

Platform

YouTube, TikTok, Instagram, Twitch, X, Facebook, and any other online service, website, host, search engine, or intermediary on which we monitor material or to which we submit a Notice.

Rights Holder

The owner of a copyright or of an exclusive right under 17 U.S.C. § 106, or a person authorized to act for the owner, on whose behalf we act. A Rights Holder may be a Client or a person that has authorized a Client.

Scan

A review of a YouTube channel requested by submitting its channel URL through the Site, and the results we prepare.

Service Provider

A person that processes Personal Information on our behalf for a business purpose under a written contract, including a “service provider” or “contractor” under Cal. Civ. Code § 1798.140(ag) and (j) and a “processor” under comparable state laws.

Services

Scans; monitoring of Platforms and websites; preparing and submitting Notices; administering platform rights-management tools where the Client or its partners are eligible; revenue recovery; escalation to U.S. litigation counsel; and related support and reporting.

Site

The website on which this Policy is posted, including its landing and marketing pages and any page that links to this Policy.

YouTube API Data

Information we obtain through YouTube API Services, including public channel data retrieved in a Scan and, if offered, data a Client authorizes through Google OAuth, as described in Article 5.

1.6 How to Read This Policy; Related Documents; Effective Date

The Policy continues as follows:

• Article 2: Personal Information We Collect and Its Sources
• Article 3: How We Use Personal Information and Communicate With You
• Article 4: How We Disclose Personal Information, Including Through Copyright Notices
• Article 5: YouTube API Services, Cookies, and Online Privacy Choices
• Article 6: Retention, Security, Breach Notification, International Visitors, and Children
• Article 7: California Privacy Rights
• Article 8: Privacy Rights in Other States, Changes to This Policy, and Contact

“Including” means “including without limitation.” References to a statute or regulation include it as amended. Stating that a provision applies “to the extent” a law applies to us is not an admission that the law applies.

Read this Policy together with our Terms of Service, which govern use of the Site and the Services, and our DMCA & Copyright Policy, which governs how we submit Notices and handle Counter-Notifications. On the handling of Personal Information, this Policy controls over those documents, but a signed Order Form or Statement of Work prevails over this Policy for that Client’s Personal Information.

Our contact details are in Section 8.8.

Effective Date: October 1, 2026. Last Updated: October 1, 2026.

Article 2 Personal Information We Collect and Its Sources

This Article lists the Personal Information we collect, whether you give it to us, others give it to us, or our systems record it automatically, and names every category of source.

This Article covers only what we collect and from where. Our purposes are set out in Article 3, our disclosures in Article 4, and our retention periods in Section 6.1; Section 7.2 organizes the same information by California statutory category. We collect Personal Information only as reasonably necessary and proportionate to those purposes.

2.1 Information You Provide to Us

We collect the information you choose to give us when you use the Site, request a Scan, contact us, or engage us, including:

1. Contact and identity information: your name, email address, telephone number, postal address, company or brand name, and job title;
2. Scan requests: the YouTube channel link you submit and any contact details you provide with it (see Section 2.2);
3. Inquiry content: your messages, including descriptions of your works and the infringement you have observed, and any attachments;
4. Engagement information: the names, titles, and contact details of the individuals who sign or administer an Order Form or Statement of Work for a Client, including billing contacts and each representative authorized to instruct us;
5. Account information: if you have an account with us, your user name, log-in credentials, account settings, and a record of actions taken through the account; and
6. Preferences and feedback: your communication preferences, marketing opt-outs, survey responses, and any testimonial you agree to give.

Share information about another person, such as a co-author or suspected infringer, only if you are permitted to do so. Please do not send sensitive information we have not requested.

2.2 YouTube Channel Links and Public Channel Data Retrieved by a Scan

The scan request field on the Site accepts only the URL of a YouTube channel, in formats such as youtube.com/@handle or youtube.com/channel/UC…; links in any other form are not accepted. We record the link, the time of submission, and the log information described in Section 2.7. To produce a Scan, we may retrieve the following public information about the channel:

• the channel ID and handle;
• the channel title and description;
• public statistics, such as subscriber, view, and video counts, to the extent the channel displays them; and
• the titles, identifiers, thumbnails, and upload dates of the channel’s public videos.

Where a Scan identifies possible copies of the channel’s content elsewhere, the results also contain the information described in Section 2.4.

The person who submits a link may not be the channel’s owner. The Site does not verify ownership at submission, so we may hold public data about a channel whose operator has never contacted us. We do not act for a channel, by submitting a Notice or otherwise, until the authority checks described in Section 2.3 and in Article 3 of our DMCA & Copyright Policy are complete. A channel operator may exercise the rights in Article 7 and Article 8 as to these records.

Public visibility does not take channel data outside privacy law. The California Consumer Privacy Act’s exclusion for “publicly available” information is limited to information lawfully made available from government records, information a business has a reasonable basis to believe the consumer lawfully made available to the general public or that appears in widely distributed media, and information made available by a person to whom the consumer disclosed it without restricting it to a specific audience (Cal. Civ. Code § 1798.140(v)(2)). Whether an item qualifies depends on the facts, and the exclusion does not necessarily reach information associated with public data, such as the submitter’s identity or our analysis. We therefore treat channel data retrieved by a Scan as Personal Information to the extent it relates to an identifiable individual. Other state laws contain similar, but not identical, exclusions.

The use of YouTube API Services and the terms governing YouTube API Data are addressed in Article 5, including, in Section 5.2, any non-public data a channel owner authorizes us to access.

2.3 Client Onboarding and Rights-Ownership Documentation

Before we act for a Rights Holder, we collect the information needed to establish who owns or controls the rights and who may instruct us, which may include:

1. Agreements: the Order Form or Statement of Work, any data processing terms, and letters of authorization appointing us as authorized agent, which support the statement of authority that 17 U.S.C. § 512(c)(3)(A)(vi) requires in every Notice;
2. Information identifying the works: titles, descriptions, creation and publication dates, reference copies and metadata, and the channels on which the Rights Holder publishes (see § 512(c)(3)(A)(ii)). Works often contain the image, voice, or likeness of the Client or of performers, and so may themselves contain Personal Information;
3. Copyright registrations: registration numbers and certificates, which, if made before or within five years after first publication, “constitute prima facie evidence of the validity of the copyright and of the facts stated in the certificate” (17 U.S.C. § 410(c)), and the corresponding U.S. Copyright Office records, which are open to public inspection under 17 U.S.C. § 705 and may include authors’ and claimants’ names and addresses;
4. Licenses and chain of title: assignments, licenses, work-made-for-hire agreements, and recorded transfers identifying those through whom rights passed;
5. Identity verification: where a Platform requires verification before accepting Notices or granting access to a rights-management tool, the materials that Platform specifies, which may include government-issued photo identification, proof of address, or business registration documents; and
6. Parental authority: where a creator is a minor, the identity and contact details of the parent or legal guardian who submits the request and signs on the minor’s behalf (see Section 6.7 and Article 1 of our Terms of Service).

We never ask for the password to any Platform account, and you should never give one to us or to anyone claiming to act for us. Where a Service requires access to a Client’s Platform account, we use only delegated permission tools that the Client, or an eligible partner acting for the Client, controls and can revoke. Through them we may receive the records the permission exposes, such as asset metadata, match and claim records, and revenue reports. Eligibility depends on each Platform’s criteria, and nothing in this Policy states or implies that Copyright Library holds partner status with any Platform.

2.4 Information About Alleged Infringers and Infringing Material

Enforcement requires information about people who upload, host, or distribute apparently infringing material. Alleged Infringers rarely provide it themselves. We may collect:

1. Locators: URLs, video and post identifiers, timestamps, and other information reasonably sufficient to permit a Platform to locate the material (17 U.S.C. § 512(c)(3)(A)(iii));
2. Evidence copies: screenshots and captures of the material with the date, time, and page of capture, which may contain the uploader’s image, voice, or other personal content;
3. Account and profile information: usernames, display names, account and channel identifiers, profile images, biographies, follower counts, and links shown on the uploader’s public profile or website;
4. Contact information supplied by others: names, addresses, email addresses, and telephone numbers that a Platform, hosting provider, or domain registrar supplies in response to a Notice or inquiry, and unredacted domain registration data;
5. Correspondence: messages from Alleged Infringers or their representatives, including disputes, license requests, and settlement communications;
6. Counter-Notifications: the Counter-Notification a Platform forwards to us as the Rights Holder’s agent, which under 17 U.S.C. § 512(g)(3)(A)–(D) contains the subscriber’s signature, identification of the removed material and its former location, a sworn statement of mistake or misidentification, and the information quoted below; and
7. Subpoena returns: information produced under 17 U.S.C. § 512(h), described below.

The subscriber’s name, address, and telephone number, and a statement that the subscriber consents to the jurisdiction of Federal District Court for the judicial district in which the address is located …

17 U.S.C. § 512(g)(3)(D)

A copyright owner or its authorized representative, ordinarily through U.S. litigation counsel, may ask the clerk of a U.S. district court to issue a subpoena under § 512(h) ordering a service provider to disclose “information sufficient to identify the alleged infringer” to the extent available to it. Returns may include names, contact details, and account or billing records. Because the request must include a sworn declaration that the information will be used only to protect rights under title 17 (§ 512(h)(2)(C)), we hold subpoena returns subject to that limitation. Information produced in litigation is held on any terms the court sets, including under a protective order.

Collecting information about a person does not mean we have concluded that the person infringed; the material may be licensed, a fair use, or misidentified. Article 3 of our DMCA & Copyright Policy describes the review that precedes any Notice.

2.5 Payment, Disbursement, and Tax Information

Card payments are handled by third-party payment processors, which collect card details directly; we do not receive or store full card numbers or security codes. We receive limited transaction data: the payer’s name and billing address, card brand, last four digits, the amount, date, and status of the transaction, and a transaction reference. For bank transfers, we receive the accompanying remittance information.

If your Order Form or Statement of Work provides for us to collect revenue on your behalf and remit it to you, we also collect:

• the payee’s legal name, business name, and address;
• bank account and routing numbers or other payout details;
• a Form W-9 showing the payee’s federal tax classification and taxpayer identification number, or, for a payee that is not a U.S. person, the applicable Form W-8; and
• records of amounts recovered, deductions, and disbursements.

Under 26 U.S.C. § 6109(a), a person required to file an information return about a payee must request the payee’s taxpayer identification number, and the payee must furnish it. Where a recovery is a settlement or license fee paid by a third party, we receive the payer’s name, contact details, and payment record from the payer or its processor.

2.6 Communications and Call Records

We keep emails, letters, messages, and files exchanged with Clients, prospects, Platforms, hosts, Alleged Infringers, and their representatives, with metadata such as sender, recipients, and date. For calls, we keep scheduling details, the numbers used, the date and duration, and notes.

We record or transcribe a call only after giving notice and with any consent the law requires. Federal law permits a party to a communication, or a person with one party’s prior consent, to record it unless the purpose is a criminal or tortious act (18 U.S.C. § 2511(2)(d)). California prohibits recording a confidential communication without the consent of all parties (Cal. Penal Code § 632), as do several other states. Because a caller’s location is not always known, we apply the stricter rule: if any participant objects after notice, we do not record. Automated transcripts follow the same rules.

2.7 Device, Usage, and Log Information Collected Automatically

When you visit the Site or submit a Scan request, the servers hosting the Site automatically record, for each request:

• your Internet Protocol (IP) address;
• your browser’s user agent string, which identifies the browser, its version, and the operating system;
• the referring URL, if your browser sends one;
• the page or resource requested, the response status, and the data transferred; and
• the date and time of the request.

An IP address may indicate an approximate location, such as a city; we do not collect precise geolocation.

Cookies, browser storage, and the third-party providers from which the Site loads web fonts and script libraries, which receive information directly from your browser when it requests those resources, are addressed in Section 5.4.

2.8 Sources of Personal Information

We collect Personal Information from the categories of sources below; other Articles refer to them by these names.

Before collecting Personal Information from a new category of source, we will update this Section in accordance with Section 8.7.

Article 3 How We Use Personal Information and Communicate With You

We use Personal Information only for the purposes listed in this Article, or for compatible purposes, and you control whether we send you marketing messages.

This Article refers to the categories of Personal Information in Article 2 by name. Who receives Personal Information is covered in Article 4, and how long we keep it in Section 6.1. Consistent with Cal. Civ. Code § 1798.100(a)(1) and (c) and Cal. Code Regs. tit. 11, § 7002, we limit our collection, use, and retention of Personal Information to what is reasonably necessary and proportionate to the purposes below, or to another disclosed purpose that is compatible with the context in which we collected it.

3.1 Responding to Scan Requests and Inquiries

We use the information you provide (Section 2.1) and the YouTube channel links and public channel data described in Section 2.2 to:

1. confirm that a submitted link identifies a YouTube channel, run the Scan, and deliver the results to the person who requested them;
2. answer questions, prepare proposals, and decide whether a request falls within the Services or relates to a matter we already handle;
3. follow up on your request, including scheduling any consultation you ask for; and
4. prepare an Order Form or Statement of Work if you decide to engage us.

Because the person who submits a link may not operate the channel, a Scan does not make the channel’s operator a Client, and we act on a channel for enforcement only after the verification described in Section 3.3. To the extent a Scan uses YouTube API Services, our use of YouTube API Data is subject to the further limits in Article 5.

3.2 Delivering Monitoring, Enforcement, and Revenue-Recovery Services

For Clients and the Rights Holders they represent, we use Client Onboarding and Rights-Ownership Documentation, Information About Alleged Infringers and Infringing Material, and Payment, Disbursement, and Tax Information (Sections 2.3 to 2.5) to perform the Services agreed in the Order Form or Statement of Work, including:

1. Monitoring. Searching YouTube, TikTok, Instagram, Twitch, X, Facebook, and other Platforms and websites, including piracy sites, for unauthorized copies of the Client’s content. If automated tools identify possible matches, those results are leads only; the decision to submit a Notice involves the review described in Article 3 of our DMCA & Copyright Policy.
2. Enforcement. Preparing and submitting Notices as the Rights Holder’s authorized agent, tracking them, processing Platform responses and Counter-Notifications, and addressing repeat infringement.
3. Platform rights-management tools. Administering Platform tools for claiming, tracking, blocking, or monetizing matches, only where the Client or a partner it works with is eligible to use them and has given us delegated access.
4. Revenue recovery. Identifying, calculating, reconciling, and reporting revenue attributable to the Client’s content and, if the Order Form or Statement of Work so provides, paying it out with any required tax reporting.
5. Escalation. On the Client’s instruction, assembling evidence and matter histories so that U.S. litigation counsel can evaluate and pursue claims.
6. Engagement administration. Reporting to Clients, providing enterprise services such as a dedicated rights manager and Content ID and CMS administration, and handling invoicing and collections.

We use Information About Alleged Infringers only to identify, document, and resolve the specific suspected infringement and resulting disputes, never to build profiles of Alleged Infringers.

3.3 Verifying Authority and Preventing Fraudulent or Abusive Claims

Every Notice must include the following statement, which we sign as the Rights Holder’s agent (see Section 1.3(b)):

A statement that the information in the notification is accurate, and under penalty of perjury, that the complaining party is authorized to act on behalf of the owner of an exclusive right that is allegedly infringed.

17 U.S.C. § 512(c)(3)(A)(vi)

Section 512(c)(3)(A)(v) separately requires a statement of good-faith belief that the use complained of is not authorized by the copyright owner, its agent, or the law. Under 17 U.S.C. § 512(f), anyone who knowingly and materially misrepresents that material is infringing is liable for the resulting damages, including costs and attorneys’ fees. We therefore use rights documentation, identity information, and enforcement records to:

1. verify the identity of each person who instructs us and that person’s authority to act for the Rights Holder;
2. confirm ownership of, or an exclusive license in, each work we enforce, using registrations, licenses, and chain-of-title documents;
3. consider whether a use may be authorized by license or by law, including as a fair use under 17 U.S.C. § 107. In Lenz v. Universal Music Corp., 815 F.3d 1145 (9th Cir. 2016), the court held that a copyright holder must consider fair use before sending a takedown notification. The decision is binding precedent only within the Ninth Circuit; we apply its standard to every Notice, wherever the parties are located;
4. detect and decline requests that appear fraudulent, retaliatory, intended to suppress criticism or commentary, or made by someone impersonating a Rights Holder; and
5. keep a record of the basis for each Notice so that we can respond to Counter-Notifications, Platform inquiries, and any claim under § 512(f).

3.4 Operating, Securing, and Improving Our Business

We use Device, Usage, and Log Information (Section 2.7) and, where necessary, other categories to:

1. detect, investigate, and prevent security incidents and malicious, deceptive, fraudulent, or illegal activity, including automated or abusive submissions to the Scan form;
2. debug the Site and our systems and repair errors that impair intended functionality;
3. analyze our own server logs to measure traffic, performance, and capacity. We use no third-party analytics services (see Section 5.5);
4. keep business, accounting, audit, insurance, and corporate records;
5. conduct quality assurance, including reviewing Notices, matter files, and Communications and Call Records (Section 2.6) to check accuracy and train our personnel; and
6. maintain, develop, and improve the Services, using deidentified or aggregated information wherever that is practicable.

3.5 Deidentified and Aggregated Information

We may create deidentified information, meaning information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular individual, within the meaning of Cal. Civ. Code § 1798.140 and comparable state laws. For any deidentified information, we:

1. take reasonable measures to ensure that it cannot be associated with an individual or household;
2. publicly commit, by this Policy, to keep and use it only in deidentified form and not to attempt to reidentify it, except as the law permits for testing whether our deidentification processes meet legal requirements; and
3. contractually require recipients to meet these obligations.

We may compile and publish aggregate statistics, such as the number of Notices submitted, the Platforms involved, and overall outcomes, in a form that does not identify any Client, Rights Holder, Alleged Infringer, or other individual. Deidentified and aggregated information is not Personal Information. Notices themselves are not deidentified: see Section 4.3.

3.6 Marketing Communications and Your Choices

We may send prospects, Clients, and business contacts information about the Services, publications, and events. We do not send marketing to Alleged Infringers using information obtained in an enforcement matter.

Email. Our commercial emails comply with the CAN-SPAM Act, 15 U.S.C. § 7701 et seq., and the FTC’s implementing rule, 16 C.F.R. Part 316. Each one identifies us as the sender, uses accurate header and subject lines, includes our postal address (company mailing address), and contains a clear notice of your right to opt out, with a working unsubscribe mechanism (15 U.S.C. § 7704(a)(3)–(5)). We honor opt-out requests within 10 business days. We will not charge a fee, ask for information beyond your email address and opt-out preferences, or require any step other than sending a reply email or visiting a single web page. Opting out of marketing does not stop transactional or relationship messages, as the CAN-SPAM Act defines them, such as Scan results you requested, matter updates, invoices, security alerts, and notices about this Policy.

Text messages and calls. We send marketing text messages, and make marketing calls using an automatic telephone dialing system or an artificial or prerecorded voice, only with your prior express written consent as defined under the Telephone Consumer Protection Act, 47 U.S.C. § 227, and the FCC’s rules at 47 C.F.R. § 64.1200. Consent is never a condition of purchasing the Services. You may revoke consent by any reasonable means, including by replying STOP to a text, telling us during a call, or writing to privacy contact email. We honor revocations within the time the FCC’s rules require. Telemarketing calls also comply with the National Do Not Call Registry, our internal do-not-call list, and applicable state telemarketing laws.

3.7 Legal Compliance, Legal Claims, and New Purposes

We use Personal Information as reasonably necessary to:

1. comply with applicable law, including tax, recordkeeping, and consumer-privacy obligations;
2. respond to subpoenas, court orders, other legal process, and lawful government requests;
3. establish, exercise, or defend legal claims, including claims under 17 U.S.C. § 512(f), disputes with Clients or Platforms, and collection of amounts owed;
4. enforce our Terms of Service, Order Forms, and Statements of Work; and
5. protect the rights, property, and safety of Copyright Library, our Clients, and others, and preserve information subject to a legal hold (see Section 6.2).

We will not use Personal Information for a purpose that is materially different from, unrelated to, or incompatible with the purposes described in this Policy unless we first give you notice and, where the law requires, obtain your consent. Changes to this Policy are governed by Section 8.7.

Article 4 How We Disclose Personal Information, Including Through Copyright Notices

We disclose Personal Information only to the recipients and for the reasons described here, and copyright enforcement by its nature requires some of it to reach Platforms, uploaders, courts, and, in some cases, the public.

4.1 Disclosure Principles; No Sale of Personal Information

We disclose Personal Information only as described in this Article, as required by law, or as you direct. Within those limits, three principles apply:

1. Necessity. Each recipient receives only the Personal Information it needs for the stated purpose. For a Notice, that means the elements the law or the Platform requires.
2. Accountability. Recipients that process Personal Information on our behalf do so under written contracts (Section 4.5). Independent recipients, such as Platforms, courts, government authorities, and Clients acting as Rights Holders, handle it under their own legal obligations and policies, which we do not control.
3. Candor about enforcement. A Notice necessarily discloses information to third parties; Sections 4.2 to 4.4 explain what it reveals and to whom.

We do not sell Personal Information for money or other valuable consideration, and we do not share it for cross-context behavioral advertising. The supporting analysis, including how Cal. Civ. Code § 1798.140 defines “sell” and “share,” is in Section 7.3; our response to opt-out preference signals is in Section 5.6. We do not publish the identities of Alleged Infringers on the Site or in our marketing materials. Disclosures of YouTube API Data, and information received by third-party resources loaded by the Site, are addressed in Article 5.

4.2 Information Included in Notices We Submit to Platforms

When we act as a Rights Holder’s authorized agent, each DMCA Notice we submit must satisfy the statute:

To be effective under this subsection, a notification of claimed infringement must be a written communication provided to the designated agent of a service provider that includes substantially the following:

17 U.S.C. § 512(c)(3)(A)

The required elements, paraphrased except where quoted, are:

For search engines and other information location tools, § 512(d)(3) applies the same elements to the reference or link to be removed. Platform copyright complaints outside the DMCA follow the Platform’s own forms, which typically request comparable information.

Where a Platform permits, a Notice identifies Copyright Library as authorized agent and gives our business contact details rather than the Rights Holder’s personal address, telephone number, or email address. Platforms may nevertheless require, and display, the Rights Holder’s name and the identity of the work; some show the claimant’s name in place of the removed material. Where a Platform requires personal details we would not otherwise include, we tell the Client before submitting where practicable. Because a Notice is signed under penalty of perjury and knowing material misrepresentations create liability under 17 U.S.C. § 512(f), we include only information that has passed the review described in Section 3.3 and the accuracy controls in Section 4.6 of our DMCA & Copyright Policy.

4.3 Forwarding to Uploaders and Publication in Transparency Databases

Forwarding to uploaders. To keep its protection against claims by its own users, a service provider that removes material in response to a Notice must take reasonable steps promptly to notify the subscriber (17 U.S.C. § 512(g)(2)(A)). Many Platforms do so by forwarding the full Notice, including the complaining party’s name and contact details, to the uploader.

Transparency databases and reports. Platforms may send copies of Notices to the Lumen database, operated by the Berkman Klein Center for Internet & Society at Harvard University, which makes them available for research and public inspection under its own policies. Platforms may also publish Notices, or data drawn from them, in their own transparency reports, and some search engines link from their results to the copy held by Lumen. Section 5.7 of our DMCA & Copyright Policy describes these databases further.

Limits of our control. We cannot control or remove copies held or published by Platforms, uploaders, Lumen, or others; redaction depends on their practices. Where a Platform allows it, we may ask that personal contact details be redacted before forwarding or publication, and we will do so at a Client’s request. Information about Alleged Infringers in a Notice, such as a username or URL, is forwarded and published in the same way.

4.4 Counter-Notifications, Reinstatement, and Litigation

Receipt. To keep the same protection, a Platform that receives a Counter-Notification must promptly provide a copy to the person who submitted the Notice (17 U.S.C. § 512(g)(2)(B)); where we submitted it as agent, the copy comes to us. A statutory Counter-Notification contains the information described in Section 2.4(f), including the subscriber’s name, address, and telephone number, the subscriber’s consent to the jurisdiction of a federal district court, and the subscriber’s agreement to accept service of process from the person who submitted the Notice or that person’s agent (17 U.S.C. § 512(g)(3)(D)).

Disclosure to the Client and counsel. We promptly provide the Counter-Notification to the Client and, where the Client has authorized escalation, to U.S. litigation counsel, so that they can decide whether to sue before the material is restored. The Platform restores it “not less than 10, nor more than 14, business days following receipt of the counter notice” unless its designated agent first receives notice from the complaining party that it has filed an action seeking a court order restraining the infringing activity (§ 512(g)(2)(C)). If an action is filed, we may notify the Platform of it as the Client’s agent. We may also give an Alleged Infringer’s contact details to the Client, or convey the Client’s position to the Alleged Infringer, for licensing or settlement discussions.

Court filings. Complaints, exhibits, and declarations, which often attach the Notice and Counter-Notification, generally become public records. Fed. R. Civ. P. 5.2(a) requires redaction of certain identifiers, such as Social Security and financial-account numbers and the names of minors, but not of adults’ names or of addresses; other material is sealed only by court order.

Subpoenas. A subpoena issued under 17 U.S.C. § 512(h) (Section 2.4) rests on a sworn declaration that “such information will only be used for the purpose of protecting rights under this title” (§ 512(h)(2)(C)). We therefore disclose information obtained this way only to the Client, its counsel, and the court, for that purpose. If either side alleges a knowing material misrepresentation under § 512(f), the related records may be disclosed to counsel, insurers, and the court.

4.5 Service Providers and Contractors

We disclose Personal Information to Service Providers for hosting and infrastructure, email and communications, customer relationship management, cloud storage and document management, and payment processing, and to professional advisers such as accountants, auditors, insurers, and outside counsel. Each Service Provider acts under a written contract containing the terms required by Cal. Civ. Code § 1798.100(d), Cal. Code Regs. tit. 11, § 7051, and the definitions of “service provider” and “contractor” in Cal. Civ. Code § 1798.140. Those contracts:

1. limit processing to the specific business purposes stated in the contract;
2. prohibit selling or sharing the Personal Information, or retaining, using, or disclosing it for any other purpose or outside the direct business relationship with us;
3. prohibit combining it with personal information from other sources, except as the law permits;
4. require compliance with applicable privacy law and the same level of protection that law requires of us;
5. require notice to us if the Service Provider can no longer meet its obligations;
6. allow us to take reasonable and appropriate steps to confirm compliance and to stop and remediate unauthorized use; and
7. require subcontractors to be bound in writing by equivalent terms.

These contracts also address the processor-contract requirements of the laws listed in Section 8.1, to the extent they apply. A payment processor that uses transaction information for its own purposes, such as fraud prevention or financial-regulatory compliance, does so under its own privacy notice.

4.6 Clients, Eligible Partners, and U.S. Litigation Counsel

Clients. We disclose to each Client the information generated in its matters, including monitoring results, information about Alleged Infringers, copies of Notices, Platform responses, Counter-Notifications, and revenue-recovery records, for use in protecting, licensing, and enforcing its rights. Where we act as a Client’s Service Provider under an Order Form or Statement of Work, the Client decides how that information is used. We do not disclose one Client’s Personal Information or confidential matter information to another Client, including where two Clients assert rights in the same work; Platforms may notify competing claimants under their own procedures.

Eligible partners. Some platform rights-management tools are open only to approved participants. Where a Client, or a partner with which we work, is eligible for such a tool and the Client authorizes it in writing, we disclose to that partner the information needed to register reference content, assert or release claims, and manage matches for the Client. We claim no platform partner status of our own. Partners receive the information under written confidentiality and data-protection terms and may not use it for any other purpose.

U.S. litigation counsel. On escalation, we disclose the matter file to independent U.S. litigation counsel that the Client retains, or that we engage with the Client’s written authorization. Counsel holds it under professional confidentiality obligations, and communications may be protected by attorney-client privilege or the work-product doctrine.

4.7 Legal Process, Safety, and Protection of Rights

We may disclose Personal Information when we believe in good faith that disclosure is reasonably necessary to:

1. comply with a law, regulation, subpoena, court order, or other legal process, or an enforceable request from a government authority;
2. respond to an emergency involving danger of death or serious physical injury;
3. detect and investigate fraud, such as false claims of ownership, abusive Notices, and impersonation of Rights Holders or of Copyright Library (see Section 6.4), and report it to affected Platforms or law enforcement; or
4. establish, exercise, or defend legal claims, enforce our agreements, and protect the rights, property, and safety of Copyright Library, Clients, Rights Holders, and others.

We review each legal demand for validity, object to overbroad demands, and disclose only what is required. Unless the law, a court order, or a risk of harm prevents it, we try to notify the person whose information is sought so that the person can seek protection from the court.

4.8 Corporate Transactions and Disclosures at Your Direction or With Your Consent

Corporate transactions. We may disclose Personal Information to actual or prospective acquirers, investors, lenders, and their advisers in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business or assets, under confidentiality obligations and only as the evaluation requires. Cal. Civ. Code § 1798.140(ad)(2)(C) excludes such a transfer from the definition of “sell” where the transferee assumes control of all or part of the business, but a transferee that materially alters its use or sharing of the information inconsistently with the promises made at collection must first give notice of the new practice.

Your direction or consent. We disclose Personal Information to any person you direct, such as your manager, label, network, agent, or a co-owner of a work, and otherwise with your consent. You may withdraw consent by contacting us as described in Section 8.8; withdrawal applies only to future disclosures and does not recall a Notice already submitted.

Article 5 YouTube API Services, Cookies, and Online Privacy Choices

This Article explains how we use YouTube API Services, what loads in your browser when you visit the Site, and how we respond to browser-based privacy signals.

5.1 Our Use of YouTube API Services

To the extent a Scan or any other Service uses YouTube API Services to retrieve information about YouTube channels and videos, this Section and Sections 5.2 and 5.3 apply. Our use of YouTube API Services is governed by the YouTube API Services Terms of Service and the YouTube API Services Developer Policies, which are contractual requirements between us and YouTube, not statutes, and do not limit your rights under this Policy or applicable law.

By submitting a YouTube channel link for a Scan, or by using any feature of the Services that relies on YouTube API Services, you agree to be bound by the YouTube Terms of Service. Information that Google collects or processes in connection with those features is governed by the Google Privacy Policy. This Policy governs what Copyright Library does with YouTube API Data once we receive it.

5.2 YouTube API Data We Access, Use, Store, and Share

We handle public channel data differently from data a Client authorizes us to access by signing in with Google through OAuth, if we offer that option.

In addition, we commit that:

1. we do not sell YouTube API Data, use it to serve or target advertising, or provide it to data brokers;
2. we do not use data that one Client authorizes through OAuth for the benefit of any other Client;
3. because the person submitting a channel link may not own the channel, Scan results contain only public channel data and our analysis of it, never OAuth-authorized data;
4. we refresh or delete stored YouTube API Data as the YouTube API Services Developer Policies require, and delete data we can no longer refresh or no longer need; and
5. to the extent those policies and applicable law permit us to keep information that has become part of a submitted Notice or an enforcement record, such as a video URL or title identified in a Notice, we keep it only as described in Sections 6.1 and 6.2.

5.3 Revoking Access and Requesting Deletion of YouTube API Data

Revoking access. If you authorized access to a YouTube channel through Google OAuth, you may revoke it at any time through Google’s security settings at https://security.google.com/settings/security/permissions, or by asking us to disconnect it. Revocation:

1. stops our further retrieval of authorized data;
2. may limit or end Services that depend on that access, as your Order Form or Statement of Work provides, but does not withdraw Notices already submitted, which Platforms handle under their own procedures; and
3. leads us to delete stored authorized data as the YouTube API Services Developer Policies require, subject to item (e) of Section 5.2.

Requesting deletion. Anyone, including a channel owner whose link someone else submitted for a Scan, may ask us to delete stored YouTube API Data about a channel by writing to privacy contact email and identifying the channel URL. We may delete public channel data held only in Scan records without proof of ownership, but before deleting data connected to an active Client engagement we will confirm that the request comes from the Client or its authorized representative. We will confirm in writing when deletion is complete.

Deletion does not prevent a later Scan if someone submits the link again, and it does not reach enforcement records about Alleged Infringers kept for the reasons in Section 6.2 and Section 7.5. These options supplement your rights under Article 7 and Article 8.

5.4 Cookies, Similar Technologies, and Third-Party Resources on the Site

Cookies are small text files a website stores in your browser; similar technologies include pixels and browser storage such as local and session storage. As of the Effective Date, the Site sets no advertising or analytics cookies and uses no browser storage. It does load resources from the third-party providers listed below:

Your browser connects directly to these providers, which receive that information because it is technically necessary to deliver the file and process it under their own privacy policies, including the Google Privacy Policy linked above. We have not engaged these providers to collect information for us, and we receive no information about your visit from them. Their servers may be located outside the United States (see Section 6.6). Our own server logs are described in Section 2.7.

Browser controls. Most browsers let you block or delete cookies, clear site data and cached files, and block requests to third-party domains; content-blocking extensions offer finer control. If you block the resources listed above, the Site will display in substitute fonts and some interactive elements may not work as intended.

If we introduce cookies or similar technologies, we will first update this Section to identify them and their purposes and obtain any consent the law requires.

5.5 Analytics and Advertising Technologies

As of the Effective Date, we do not use:

• third-party analytics services, including session-replay tools;
• advertising pixels, tags, or conversion-tracking code; or
• cross-context behavioral advertising, which California law treats as “sharing” (Cal. Civ. Code § 1798.140(ah)), or targeted advertising as other state privacy laws define it.

We measure Site use only through our own server logs (see Section 3.4). Before adopting any of these technologies, we will (a) update this Policy to describe them; (b) provide the opt-out methods required by Cal. Civ. Code § 1798.135 and by any other applicable state law, including honoring opt-out preference signals as described in Section 5.6; and (c) obtain consent wherever the law requires it. We will not use YouTube API Data for advertising under any such change.

5.6 Global Privacy Control and Other Opt-Out Preference Signals

Global Privacy Control (“GPC”) is a setting in some browsers and extensions that tells websites you do not want your personal information sold or shared (see globalprivacycontrol.org).

California requires a business that sells or shares personal information to treat a qualifying opt-out preference signal as a valid opt-out request (Cal. Code Regs. tit. 11, § 7025; see Cal. Civ. Code § 1798.135). Colorado requires controllers that sell personal data or engage in targeted advertising to honor a universal opt-out mechanism meeting the Colorado Attorney General’s technical specifications (Colo. Rev. Stat. § 6-1-1306; 4 Colo. Code Regs. § 904-3, Part 5). Several other state laws listed in Section 8.1 impose similar requirements, with dates and standards that vary by state.

We do not sell or share Personal Information (see Section 7.3). We nevertheless honor GPC as follows, regardless of the state in which you live:

1. we treat a GPC signal as a valid request to opt out of sale, sharing, and targeted advertising for that browser and for any consumer we know to be associated with it, for example because you submitted a Scan request or inquiry while the signal was active;
2. we do not ask you to provide further information or confirm the request;
3. we apply the same treatment to any other opt-out preference signal that meets the requirements of § 7025 or is recognized under an applicable state law; and
4. a later visit without the signal does not change our practices, because we do not sell or share Personal Information in either case.

A browser signal applies only to that browser. For information we hold from other channels, such as email or telephone, submit a request under Section 7.6 or Section 8.3. We will record it and give it effect if our practices change.

5.7 Do Not Track Signals and Cross-Site Tracking Disclosures

California law requires us to disclose how we respond to web browser “Do Not Track” (“DNT”) signals and whether other parties may collect personally identifiable information about your online activities over time and across different websites when you use the Site (Cal. Bus. & Prof. Code § 22575(b)(5)–(6)).

How we respond to DNT. No uniform technology standard for recognizing and implementing DNT signals has been adopted. Because we do not collect personally identifiable information about your online activities over time and across third-party websites or online services, DNT signals do not change our practices. GPC signals are handled under Section 5.6.

Third-party tracking. We do not allow third parties to collect personally identifiable information about your online activities over time and across different websites through the Site. The only third parties that receive information directly from your browser on the Site are the resource providers listed in Section 5.4, which receive the technical request information needed to deliver their files and govern it under their own policies. If this changes, we will first update this Policy under Section 8.7.

Article 6 Retention, Security, Breach Notification, International Visitors, and Children

We keep Personal Information only as long as a stated purpose or legal obligation requires, protect it with reasonable safeguards, notify you of breaches that affect you, process it in the United States, and do not knowingly collect information from children under 13.

6.1 Retention Principles and Periods

We retain Personal Information only as long as is reasonably necessary and proportionate to the purposes in Article 3, and then delete or deidentify it. Because copyright claims and defenses can arise years after the underlying events, we disclose retention criteria rather than fixed periods, as Cal. Civ. Code § 1798.100(a)(3) permits. Those criteria are the duration of the relationship or matter, including the term of any Order Form or Statement of Work; the period in which a related claim could be brought by or against us, a Client, or an Alleged Infringer; recordkeeping duties under tax and other law; and the sensitivity of the information. The principal anchor for copyright records is:

“No civil action shall be maintained under the provisions of this title unless it is commenced within three years after the claim accrued.”

17 U.S.C. § 507(b)

That period governs infringement claims and claims under 17 U.S.C. § 512(f) for knowing material misrepresentation in a Notice or Counter-Notification. Each infringing act generally starts its own period (Petrella v. Metro-Goldwyn-Mayer, Inc., 572 U.S. 663 (2014)), and many federal courts start it only when the infringement was or reasonably should have been discovered. We therefore measure retention from the latest event that could give rise to a claim, not from the date a record was created.

6.2 Copyright Enforcement Records, Legal Holds, and Deletion

Enforcement records document the Rights Holder’s authorization, the review that preceded each Notice (see Article 3 of our DMCA & Copyright Policy), and the Platform’s response, and may be the only evidence available to prove infringement or defend a § 512(f) claim. A request to delete them, including from an Alleged Infringer, is assessed under the exceptions in Section 7.5, and we cannot recall copies held by Platforms, uploaders, or transparency databases (Section 4.3). For every record type:

1. Legal holds override deletion. When we receive legal process, or litigation, an investigation, or a regulatory inquiry is pending or reasonably anticipated, we suspend deletion of relevant records until the hold is released. Fed. R. Civ. P. 37(e) permits curative measures or sanctions where a party fails to take reasonable steps to preserve electronically stored information that should have been preserved in anticipation or conduct of litigation.
2. Deidentification. Where information is no longer needed in identifiable form, we may deidentify or aggregate it instead of deleting it, subject to Section 3.5.
3. Backups. Backups are overwritten on a rolling schedule rather than edited record by record. Until then, deleted information is isolated from ordinary use, and we reapply deletions if a backup is restored.
4. Service Provider data. Where we act as a Service Provider (Section 1.3), the Client’s agreement governs retention and the return or deletion of data at the end of the engagement.
5. Disposal. We dispose of records so that Personal Information is unreadable or undecipherable, consistent with Cal. Civ. Code § 1798.81.

6.3 How We Safeguard Personal Information

We maintain administrative, technical, and physical safeguards appropriate to our size, activities, and the sensitivity of the information we hold, designed to meet Cal. Civ. Code § 1798.81.5, N.Y. Gen. Bus. Law § 899-bb, and the Federal Trade Commission’s data-security expectations under 15 U.S.C. § 45(a). They include:

• Administrative: assigned security responsibility, risk assessment, confidentiality obligations and training for personnel, need-to-know access removed when roles change, and an incident response plan.
• Technical: encryption in transit, access controls with multi-factor authentication where supported, least-privilege permissions, separation of each Client’s records, restricted storage of any access tokens, logging, and timely updates.
• Physical: hosting providers with controlled-access facilities and limits on portable media.
• Vendors: diligence before engagement and contractual security obligations (Section 4.5).

6.4 Protecting Yourself Against Impersonation and Phishing

Scammers pose as copyright agents and send fake “copyright strike” messages to steal credentials, install malware, or extort payment. Copyright Library will never:

1. ask for a password, recovery code, or two-factor code for any Platform or email account;
2. demand payment by gift card, cryptocurrency, payment app, or transfer to a personal account;
3. ask you to install software or sign in through a link to a page imitating a Platform; or
4. threaten a strike unless you act within minutes or hours.

We do not issue strikes; only a Platform can apply one, under its own policies, and Platforms generally notify users inside the account. Any license or settlement request on a Rights Holder’s behalf is made in writing and identifies the Rights Holder and the work. If a message claims to come from us, do not click its links or reply; instead forward it, with headers if possible, to our contact email in a new message, and we will confirm whether it is genuine. Check your Platform account directly for any real notice. You may also report impersonation at ReportFraud.ftc.gov and ic3.gov. Business impersonation may violate 15 U.S.C. § 45(a) and the FTC’s Impersonation Rule, 16 C.F.R. Part 461. Report a Notice falsely submitted in our name as described in Section 8.3 of our DMCA & Copyright Policy.

6.5 Data Breach Notification

Every U.S. state, as well as the District of Columbia, Puerto Rico, Guam, and the U.S. Virgin Islands, requires notice of certain security breaches, including under Cal. Civ. Code § 1798.82 and N.Y. Gen. Bus. Law § 899-aa. These laws differ in the data that triggers notice (commonly a name with a Social Security, driver’s license, or financial account number, and in many states online credentials), in timing, and in whom must be told. If we discover a breach of the security of Personal Information, we will:

1. contain the incident, determine its scope, and restore the reasonable integrity of our systems;
2. notify affected individuals in the most expedient time possible and without unreasonable delay, within any period applicable law sets, subject to any delay law enforcement determines is necessary to avoid impeding a criminal investigation;
3. notify attorneys general, other regulators, and consumer reporting agencies where applicable law requires;
4. include the content the law prescribes, such as the headings required by § 1798.82(d) for California residents; and
5. where we maintain the information for a Client, notify that Client promptly, as § 1798.82(b), comparable laws, and our agreement require.

A genuine breach notice from us will never ask for passwords or payment information (Section 6.4).

6.6 Where We Process Information; Visitors Outside the United States

The Site and Services are operated from the United States, and we process and store Personal Information there. If you visit or submit information from another country, it will be transferred to the United States, where data protection law may differ from, and be less protective than, the law of your country. Platforms, transparency databases (Section 4.3), and the font and script providers in Section 5.4 process information under their own policies and may do so abroad.

This Policy does not represent that we participate in the EU-U.S. Data Privacy Framework or its UK and Swiss counterparts, or that we have appointed a representative under Article 27 of the EU or UK General Data Protection Regulation. To the extent another jurisdiction’s law applies to our processing, we will honor the rights it grants as it requires; contact us as described in Section 8.8.

6.7 Children and Minors

Children under 13. The Site and Services are not directed to children under 13, and we do not knowingly collect their Personal Information within the meaning of the Children’s Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506, and 16 C.F.R. Part 312. If we learn that we have collected such information without verifiable parental consent, we will delete it promptly. Parents may contact us at our contact email.

Minor creators. A creator under 18 may not request a Scan or engage us in their own name. A parent or legal guardian must submit the request and sign any Order Form, Statement of Work, or letter of authorization on the minor’s behalf, consistent with Article 1 of our Terms of Service, and receives our communications. Where a Platform allows, we ask it not to publish a minor Rights Holder’s personal contact details.

Minors in enforcement matters. Platforms rarely disclose an operator’s age, so an Alleged Infringer may be a minor without our knowledge. If a parent or guardian tells us so, we will direct communications to them where practicable and limit processing to what is reasonably necessary to resolve the matter, preserve evidence, and comply with law.

No sale or sharing; marketing to minors. We do not sell or share the Personal Information of any consumer, including consumers we know to be under 16 (Section 7.3). We do not market to minors any product or service listed in Cal. Bus. & Prof. Code § 22580. The content-removal right under § 22581 is addressed in Section 7.8.

Article 7 California Privacy Rights

If you are a California resident and the California Consumer Privacy Act applies to us, this Article summarizes the Personal Information we handle about you, confirms that we do not sell or share it, and explains how to exercise your rights.

7.1 Application of California Law and Notice at Collection

To the extent the CCPA applies to us, this Article supplements this Policy for California residents (“consumers”). “CCPA” means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, Cal. Civ. Code § 1798.100 et seq., and its regulations, Cal. Code Regs. tit. 11, § 7000 et seq. Statutory terms such as “sell,” “share,” and “sensitive personal information” have the meanings given in Cal. Civ. Code § 1798.140.

The CCPA applies to a for-profit entity that does business in California, determines the purposes and means of processing consumers’ personal information, and meets at least one threshold in Cal. Civ. Code § 1798.140(d)(1):

1. as of January 1 of the calendar year, it had annual gross revenues in the preceding calendar year above the statutory threshold, originally $25,000,000 and adjusted for inflation by the California Privacy Protection Agency;
2. alone or in combination, it annually buys, sells, or shares the personal information of 100,000 or more consumers or households; or
3. it derives 50 percent or more of its annual revenues from selling or sharing consumers’ personal information.

Unlike most other state privacy laws (Section 8.1), the CCPA also protects individuals acting in a business capacity: its temporary exemptions for business-to-business and employment-related information expired on January 1, 2023. It therefore covers California-resident creators, representatives of Clients, Platforms, and vendors, and Alleged Infringers. Where we act as a Service Provider to a Client (Section 1.3), please direct CCPA requests about that information to the Client; we will assist the Client in responding.

Notice at collection. Articles 2 through 6 and this Article together constitute our notice at collection (Cal. Civ. Code § 1798.100(a); Cal. Code Regs. tit. 11, § 7012) and our privacy policy (Cal. Civ. Code § 1798.130(a)(5); Cal. Code Regs. tit. 11, § 7011). They state the categories of Personal Information, including sensitive personal information, that we collect, the purposes for each, whether any is sold or shared, and our retention criteria. We link to this Policy from every page of the Site, including the page that contains the Scan request form, and refer callers to it. We review this Article at least once every 12 months.

7.2 Categories of Personal Information: Collection, Sources, Purposes, Recipients, and Retention

The table below summarizes, by the categories in Cal. Civ. Code § 1798.140(v)(1), the Personal Information we collected in the 12 months preceding the Last Updated date and the recipients to which we disclose it for a business purpose.

We do not intentionally collect characteristics of protected classifications, biometric information, or non-public education information, and do not use any that appears incidentally in content we review. We draw no inferences from Personal Information to create a profile about any consumer.

7.3 No Sale or Sharing; Consumers Under 16

We do not sell Personal Information or share it for cross-context behavioral advertising, as Cal. Civ. Code § 1798.140(ad) and (ah) define those terms, and we have not done so in the 12 months preceding the Last Updated date. Disclosures under Article 4, including Notices submitted to Platforms, are made to perform the Services or to enforce or defend legal rights, not for monetary or other valuable consideration or for advertising. We therefore provide no “Do Not Sell or Share My Personal Information” link under Cal. Civ. Code § 1798.135, but we record opt-out requests made under Section 7.6 and honor opt-out preference signals as Section 5.6 describes (Cal. Code Regs. tit. 11, § 7025). Before any sale or sharing, we would update this Policy and provide the notice and opt-out methods the CCPA requires.

Consumers under 16. We have no actual knowledge that we sell or share the Personal Information of consumers under 16. Cal. Civ. Code § 1798.120(c) prohibits that without affirmative authorization from the consumer, if 13 to 15 years old, or from a parent or guardian, if the consumer is under 13, and treats willful disregard of a consumer’s age as actual knowledge. We would obtain that authorization first. See also Section 6.7.

7.4 Sensitive Personal Information

We collect sensitive personal information (Cal. Civ. Code § 1798.140(ae)) only where an engagement requires it: government identification numbers, where a Platform requires identity verification (Section 2.3); Social Security or other taxpayer identification numbers provided on IRS Form W-9, and financial account numbers, where we disburse recovered revenue (Section 2.5); and, if you have an account with us, your account log-in credentials (Section 2.1). We never ask for the password to any Platform account.

We use and disclose sensitive personal information only for purposes listed in Cal. Code Regs. tit. 11, § 7027(m): to perform the Services that an average consumer requesting them would reasonably expect; to prevent, detect, and investigate security incidents; to resist fraudulent or illegal actions directed at us, including impersonation of Rights Holders; and to process payments and verify customer information. We also use it to comply with tax and other legal obligations (Cal. Civ. Code § 1798.145(a)). We do not use it to infer characteristics about you.

Cal. Civ. Code § 1798.121 lets consumers direct a business to limit its use of sensitive personal information to what is needed to provide reasonably expected goods or services and to other permitted purposes. Because our use is already so limited, we provide no notice of right to limit or “Limit the Use of My Sensitive Personal Information” link; before any other use, we would give that notice and act on requests to limit within 15 business days (§ 7027).

7.5 Your California Privacy Rights

Subject to verification (Section 7.6) and to the CCPA’s exceptions, you have the following rights:

1. Right to know and access. You may request the categories of Personal Information we have collected about you, its sources, our purposes, the categories of recipients, and the specific pieces we hold (Cal. Civ. Code §§ 1798.110, 1798.115). A request covers the preceding 12 months unless you ask for a longer period, which we honor for information collected on or after January 1, 2022, unless that proves impossible or would involve a disproportionate effort (§ 1798.130(a)(2)). We will not disclose government identification, taxpayer, or financial account numbers or account passwords, but will tell you that we hold them (Cal. Code Regs. tit. 11, § 7024(d)).
2. Right to delete. You may request deletion of Personal Information we collected from you (§ 1798.105), and we will direct our Service Providers and contractors to delete it too. Much of what we hold about Alleged Infringers comes from Platforms, Clients, and public sources rather than from the individual; whether or not the right reaches that information, the exceptions below ordinarily apply.
3. Right to correct. You may request correction of inaccurate Personal Information. We use commercially reasonable efforts, considering the nature and purposes of the information (§ 1798.106). Records of what was stated or submitted at a given time, such as a Notice or Counter-Notification, are corrected by a dated annotation, not by alteration.
4. Right to opt out of sale or sharing (§ 1798.120). We do neither (Section 7.3).
5. Right to limit use of sensitive personal information (§ 1798.121), as described in Section 7.4.
6. Right to data portability. We provide specific pieces of Personal Information obtained from you in an easily understandable and, where technically feasible, machine-readable format that you may transmit to another entity (§ 1798.130(a)(3)).
7. Right to non-discrimination (§ 1798.125), as described in Section 7.7.

Exceptions to deletion; enforcement records. Cal. Civ. Code § 1798.105(d) permits retention reasonably necessary for listed purposes, and § 1798.145(a) preserves our ability to comply with law and legal process and to exercise or defend legal claims. The most relevant exceptions are:

1. Legal claims. An infringement action may be brought within the three-year period of 17 U.S.C. § 507(b), and knowing material misrepresentation in a Notice or Counter-Notification is actionable under 17 U.S.C. § 512(f). We keep Notices, supporting evidence, Counter-Notifications, and correspondence while a claim may be asserted (§ 1798.145(a); Section 6.2).
2. Security and integrity (§ 1798.105(d)(2)): detecting fraudulent or abusive claims, impersonation, and attacks on our systems.
3. Free speech or another right provided by law (§ 1798.105(d)(4)), including a Rights Holder’s rights under the Copyright Act and 17 U.S.C. § 512.
4. Legal obligations (§ 1798.105(d)(8)), including tax law and legal holds.
5. Contract performance (§ 1798.105(d)(1)): Services a Client has requested.

If we deny a request in whole or in part, we will explain why, delete what no exception covers, and use retained information only for the excepted purpose (Cal. Code Regs. tit. 11, § 7022). We may also withhold or retain information to preserve an evidentiary privilege or to protect the rights and freedoms of other persons, such as Rights Holders and witnesses (§ 1798.145). We cannot recall copies of Notices held by Platforms or the Lumen database (Section 4.3), and will not withdraw a Client’s Notice without the Client’s instruction.

7.6 Submitting Requests: Methods, Verification, Authorized Agents, and Timing

Methods. You or your authorized agent may submit a request:

• by email to privacy email address, with “California Privacy Request” in the subject line;
• by telephone at privacy telephone number; or
• through a privacy-request web form on the Site, if one is available.

Opt-outs may also be sent by an opt-out preference signal (Section 5.6). Please identify the right exercised and any relevant channel URLs or Notice references. Do not send sensitive personal information unless we ask for it.

Verification. We verify requests to know, delete, and correct by matching information you provide with information we hold (Cal. Code Regs. tit. 11, §§ 7060–7062). Requests for categories require a reasonable degree of certainty (generally two reliable data points); requests for specific pieces require a reasonably high degree (generally three, plus a signed declaration under penalty of perjury). For deletion and correction, the standard rises with sensitivity and risk of harm; we apply the higher standard to sensitive personal information and enforcement records. If you have an account, we may verify you through it (§ 7061). Verification information is used only for verification, security, and recordkeeping. Requests to opt out or to limit need no verification, but we may deny one we have a good-faith, reasonable, and documented belief is fraudulent (§§ 7026, 7027).

Authorized agents. An authorized agent must have your signed permission, and we may also ask you to verify your identity or confirm the authorization directly with us (§ 7063), unless the agent holds a power of attorney under the California Probate Code. Agents must safeguard your information and use it only for your request. A parent or legal guardian may act for a minor.

Timing. We confirm receipt of requests to know, delete, or correct within 10 business days (§ 7021(a)) and respond within 45 calendar days of receipt (§ 7021(b); Cal. Civ. Code § 1798.130(a)(2)). If reasonably necessary, we may extend once by 45 more days, telling you why within the first period. We act on requests to opt out or to limit within 15 business days (§§ 7026, 7027). Responses are free and in writing, by mail or electronically at your option. Manifestly unfounded or excessive requests may incur a reasonable fee or be declined, with reasons (§ 1798.145).

Records. We keep records of requests and responses for at least 24 months and use them only for compliance (§ 7101). You may raise concerns with us (Section 8.8), the California Privacy Protection Agency, or the California Attorney General.

7.7 Non-Discrimination and Financial Incentives

We will not discriminate against you for exercising CCPA rights, including by denying goods or services, charging different prices or rates, providing a different level or quality of service, or suggesting that we will (Cal. Civ. Code § 1798.125(a)). If a Client asks us to delete information needed to perform the Services, we may be unable to continue them; that is a consequence of the request, not a penalty. We offer no financial incentive or price or service difference tied to Personal Information. Before offering one, we would provide a notice of financial incentive under Cal. Code Regs. tit. 11, § 7016 and obtain your opt-in consent, which you could revoke at any time (§ 1798.125(b)).

7.8 Shine the Light, CalOPPA, and Minors’ Content Removal

Shine the Light. Cal. Civ. Code § 1798.83 lets California customers request, once per calendar year, information about personal information a business disclosed to third parties for their direct marketing purposes in the preceding calendar year. We make no such disclosures and will not do so without your consent. You may send requests to privacy email address with “Shine the Light Request” in the subject line.

CalOPPA. This Policy is intended to satisfy the California Online Privacy Protection Act, Cal. Bus. & Prof. Code §§ 22575–22579, and contains each disclosure § 22575(b) requires, including how we respond to Do Not Track signals and whether third parties may track your activities across websites (Section 5.7) and how we give notice of material changes (Section 8.7).

Minors’ content removal. The Services are not directed to minors (Section 6.7). Cal. Bus. & Prof. Code § 22581 requires the operator of a service directed to minors, or with actual knowledge that a minor uses it, to let a minor who is a registered user remove, or request removal of, content the minor posted. If you are under 18, live in California, and have an account that lets you post content, you may remove it yourself where the feature allows or ask us to do so by emailing privacy email address from your account’s email address; a parent or legal guardian may ask for you. As § 22581 permits, we need not remove content that law requires to be maintained, content stored or reposted by a third party, anonymized content, content whose removal request does not follow these instructions, or content for which you received compensation or other consideration. Removal does not ensure complete or comprehensive removal.

Article 8 Privacy Rights in Other States, Changes to This Policy, and Contact

If you live in a state with a comprehensive privacy law or in Nevada, this Article explains your rights and how to exercise and appeal them, how we change this Policy, and how to reach us.

8.1 Comprehensive State Privacy Laws Covered by This Article

This Article applies to residents of the states listed below, to the extent their state’s law applies to us and to the Personal Information concerned. California residents should read Article 7.

Applicability. Most of these laws apply to a controller that processes the personal data of at least 100,000 state residents a year, or of fewer residents (often 25,000) where a set share of its revenue comes from selling personal data. Some states set lower thresholds, such as 35,000 residents in Delaware, New Hampshire, Maryland, and Rhode Island, and some laws have been amended since enactment. Utah and Tennessee also require $25 million in annual revenue. Texas and Nebraska cover any business that is not a small business as the U.S. Small Business Administration defines that term.

Most of these laws exclude individuals acting in a commercial or employment context, such as a Client’s employee writing on the Client’s behalf. Whether a law applies to us depends on facts that can change, and we describe these rights only to the extent these laws apply.

8.2 Your Rights Under Those Laws

Subject to the conditions and exceptions in your state’s law, you may have the following rights (see, for example, Va. Code Ann. § 59.1-577; Colo. Rev. Stat. § 6-1-1306). Not every state grants every right.

1. Confirmation and access. To confirm whether we process your personal data and to access it.
2. Correction. To correct inaccuracies, taking into account the nature of the data and the purposes of processing.
3. Deletion. To have us delete personal data provided by or obtained about you; in some states, only data you provided.
4. Portability. To obtain a copy of your personal data (in some states, only data you provided) in a portable and, to the extent technically feasible, readily usable format, where we process it by automated means.
5. Opt-outs. To opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. We do none of these things (Section 3.4, Section 5.5, Section 7.3), but will record any opt-out request and apply it if our practices change.
6. Sensitive data. Most of these laws require consent before a controller processes “sensitive data”; a few provide an opt-out instead, and Maryland’s law limits its collection to what is strictly necessary. Definitions vary but typically cover data revealing racial or ethnic origin, religious beliefs, a health diagnosis, sexual orientation, or citizenship or immigration status; genetic or biometric data; precise geolocation; and data collected from a known child. Some states add categories, such as financial account information in New Jersey. In our business, information that may meet some of these definitions includes an identity document revealing citizenship and account details collected for disbursements (Section 2.5; Section 7.4). Where your state requires consent, we obtain it first; you may withdraw it at any time, and we will stop the processing within any period your state sets.
7. Additional rights in some states. Under the Oregon and Minnesota laws, for example, you may request a list of the specific third parties to which we have disclosed your personal data (or, where the law permits, personal data generally). Minnesota’s law also lets a consumer question the result of profiling that produces legal or similarly significant effects, learn the reasons, review the data used and, if it was inaccurate, have it corrected and the decision reevaluated.

Enforcement matters. These laws do not restrict a controller’s ability to comply with law or legal process, to establish, exercise, or defend legal claims, or to prevent and respond to fraud and security incidents, exemptions comparable to those in Section 7.5. If you are an Alleged Infringer, we may keep records of a Notice or Counter-Notification while an exemption applies, and will tell you which one we rely on. A privacy request cannot withdraw a Notice; to dispute a removal, use the counter-notification procedure in Article 6 of our DMCA & Copyright Policy. These rights do not extend to deidentified data (Section 3.5).

8.3 Submitting Requests and Our Response

How to submit. Email privacy email address with “State Privacy Request” in the subject line, call privacy telephone number, or use a privacy-request web form on the Site, if one is available. Tell us your state of residence and the right you are exercising. We honor opt-out preference signals as described in Section 5.6.

Verification. We authenticate requests to access, correct, delete, or port data using the standards in Section 7.6. If commercially reasonable efforts do not authenticate a request, we may ask for additional information reasonably necessary and need not act until we receive it. Opt-out requests need no authentication, but we may deny one that we have a good-faith, reasonable, and documented belief is fraudulent, and will tell you why.

Authorized agents. We accept requests from an authorized agent only where your state’s law permits, which under several of these laws means opt-out requests only. We may require written proof of authority and, except for opt-outs, ask you to verify your identity directly with us. As state law provides, a parent or legal guardian may act for a known child, and a guardian or conservator for a person under a protective arrangement.

Timing. We respond without undue delay and within 45 days after receipt. When reasonably necessary, considering the complexity and number of your requests, we may extend once by 45 days, telling you of the extension and its reason within the first 45 days. If we decline to act, we will explain why, and how to appeal (Section 8.4), within the same period.

Fees. Responses are free at least once in any 12-month period, and more often where your state’s law requires. For a manifestly unfounded, excessive, or repetitive request we may charge a reasonable fee or decline to act, and we bear the burden of showing that character.

Data from other sources. Where we obtained your personal data other than from you, such as from a Platform in an enforcement matter (Section 2.8), and your state’s law permits, we may honor a deletion request by keeping a record of it with the minimum data needed to ensure your data stays deleted and by opting you out of any processing the law does not exempt.

Data we process for a Client. If we process your personal data as a processor for a Client (Section 1.3), the Client is the controller. We will refer you to the Client where our contract permits and assist the Client as our contract and the law require.

8.4 Appealing Our Decision

If we decline to act on your request in whole or in part, you may appeal. Most laws in Section 8.1 require an appeal process (e.g., Va. Code Ann. § 59.1-577; Colo. Rev. Stat. § 6-1-1306). We offer it to residents of every listed state, and it is conspicuously available and similar to our process for submitting requests.

1. How to appeal. Within a reasonable period after receiving our decision, reply to it or email privacy email address with “Privacy Appeal” in the subject line. Identify the request and explain why you believe our decision was wrong.
2. Our decision. We will tell you in writing what action we took or did not take, and why, within the period your state’s law sets, generally 45 or 60 days after receipt, extended only where your state permits and with notice to you.
3. Your Attorney General. If we deny your appeal, we will provide an online mechanism, if one is available, or another method through which you may contact your state’s Attorney General to submit a complaint. You may contact that office at any time.

8.5 Nevada Residents

Nevada law (Nev. Rev. Stat. § 603A.300 et seq.) lets a Nevada consumer direct the operator of a website or online service not to sell “covered information”: personally identifiable information collected online, such as a name, physical address, email address, telephone number, or other identifier that allows a specific person to be contacted. A “sale” is, in summary, an exchange of covered information for monetary consideration to a person who will license or sell it to others.

We do not sell covered information. You may still submit a request not to sell by emailing privacy email address with “Nevada Opt-Out Request” in the subject line, or by calling privacy telephone number. Include your name, confirm your Nevada residence, and give the contact details you have used with us, so we can verify the request. We respond within 60 days after receiving a verified request, or up to 30 days later where reasonably necessary and with notice to you, and we will apply the request if our practices change.

8.6 Consumer Health Data (Washington and Similar Laws)

Washington’s My Health My Data Act (Wash. Rev. Code ch. 19.373) regulates “consumer health data”: personal information linked or reasonably linkable to a consumer that identifies the consumer’s past, present, or future physical or mental health status. It reaches beyond the laws in Section 8.1, and several other states have enacted similar laws. We do not collect, process, share, or sell consumer health data within the meaning of the Washington Act or those laws.

Unsolicited health information. Please do not send us information about your health. If you do, for example in an email or a Counter-Notification, we will not use it and will delete it once we become aware of it. If it forms part of a record we must preserve intact under a legal hold (Section 6.2), we will instead restrict access to it for as long as that obligation lasts.

8.7 Changes to This Policy

We may update this Policy to reflect changes in our Services, practices, or the law. As Cal. Bus. & Prof. Code § 22575(b)(3) requires, this Section describes how we notify you of material changes.

1. Posting. We post each revised version on this page with a new “Last Updated” date. A change that is not material takes effect when posted.
2. Advance notice of material changes. A material change is one that significantly affects how we collect, use, or disclose Personal Information or the rights described in this Policy. We give advance notice of it by a prominent notice on the Site and, where we have an ongoing relationship with you, such as a Client relationship, by email or other direct communication, stating when the change takes effect.
3. No retroactive reduction in protection. We will not apply a less protective change to Personal Information collected earlier, in a way materially different from what we disclosed at collection, without first obtaining your consent where applicable law requires it (see also Section 3.7).
4. Earlier versions. We archive earlier versions of this Policy and will provide any of them on request (Section 8.8).

8.8 How to Contact Us

Copyright notices are not privacy requests. We designate an agent to receive notifications of claimed infringement under 17 U.S.C. § 512(c)(2) and maintain that designation with the U.S. Copyright Office under 37 C.F.R. § 201.38. An effective notification must be “a written communication provided to the designated agent of a service provider” (17 U.S.C. § 512(c)(3)(A)). A copyright notice sent to our privacy contact has not been provided to our designated agent, though we may forward it.

Verifying messages from us. Verify any message claiming to come from us, especially one about a “copyright strike” or payment, as described in Section 6.4.

Accessibility. If a disability limits your ability to read this Policy, contact us and we will provide it in an alternative format you can access.