This policy explains how Creator Lighthouse Ltd collects, uses and protects your personal data when you use our website and app. Please read it alongside our Terms of Service.
Controller details
Creator Lighthouse Ltd is the data controller for the personal data described in this policy. Creator Lighthouse Ltd is a company registered in the United Kingdom (company number 17311446), with its registered office at 128 City Road, London, EC1V 2NX, United Kingdom. We are registered with the UK Information Commissioner’s Office (ICO) under registration number ZC187070. You can contact us at hello@creatorlighthouse.co.uk.
Who can use Creator Lighthouse
Our service is intended only for individuals aged 18 or over. We do not knowingly collect personal data from anyone under 18. If we become aware that an account belongs to a person under 18, we may suspend or delete the account and remove associated data.
What we collect
- Account data: your email address and, optionally, your name.
- Protection data you provide: the stage names, other names, official links and reference images you add so we can search for leaks on your behalf and recognise your own pages.
- Where you found us: when you sign up or run a free scan, the page of our site you first arrived on and the name of the site that sent you (for example a search engine), so we can tell which pages help creators. This is held in the page while you browse, not in a cookie.
- Service data: the discoveries, cases, notices and settings generated as you use the app.
- Usage data: basic technical information such as scan history and activity, used to run and improve the service.
- Payment data: handled by our payment processor. We do not store your card details.
Reference images and identity data
Reference images, aliases, stage names, official links and similar information are processed solely for the purpose of providing the protection services you request. Where image-based matching or identity verification is used as part of the service, we process such information only as necessary to provide the service and in accordance with applicable data-protection requirements. We do not use customer reference images to train public AI models.
Special category data
Because we protect content for adult and independent creators, some of the information you give us, or that we process to protect you, may amount to special category data under UK GDPR, in particular data that could reveal information about your sex life (for example your creator niche, the content we search for on your behalf, or an intimate-image protection case you choose to track). We only process this to provide the protection and related services you ask for.
Our lawful basis for processing this special category data is your explicit consent (UK GDPR Article 9(2)(a)), which we ask for separately when you create your account. You can withdraw that consent at any time by deleting your account (Account → Delete account), which erases your associated data; withdrawal does not affect processing carried out before you withdrew. We never require you to upload explicit content, and for intimate-image protection the image is fingerprinted on your own device and never reaches us or StopNCII.
How and why we use it, and our lawful bases
We process personal data for the following purposes:
- To create and manage your account and subscription.
- To provide content-protection services, including monitoring, case management and takedown assistance.
- To prepare and send notices and requests that you authorise us to submit on your behalf.
- To provide customer support.
- To maintain the security, reliability and performance of the service.
- To improve our products and services.
Depending on the activity, we rely on one or more of the following lawful bases under UK data protection law:
- Performance of a contract with you.
- Your consent, where required.
- Our legitimate interests in operating, securing and improving the service.
- Compliance with legal obligations where applicable.
Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.
AI-assisted processing
We use third-party AI service providers to assist with analysis, classification, drafting, support functions and related service operations. Data shared with these providers is limited to what is reasonably necessary to provide the requested functionality. We require contractual data-protection commitments from these providers and do not permit them to use customer personal data to train public models.
Search, indexing and matching providers
To identify potential infringements and assist with content-protection activities, limited data may be processed through third-party search, indexing, computer-vision and related technology providers. Where possible, we minimise the personal data shared and avoid transmitting unnecessary identity information.
To find copies of your content, we send the stage names, aliases and usernames you give us, with search words such as "leaks" or the name of a leak site, and the addresses of pages we are checking, to search providers. We never send them your legal name, email address or account details. The reference images you add go only to image-matching providers, to look for copies of those images. We do this to provide the service you signed up for (performance of a contract).
Other providers we share data with
We also use the following providers to run the service. They process data only on our instructions and under data processing terms:
- Cloud infrastructure and data hosting: your account details and service data are stored on cloud infrastructure and encrypted database platforms located within the European Economic Area (EEA).
- Communications infrastructure: email delivery, including system notifications and the legal notices you authorise, is routed through enterprise transactional email infrastructure.
- Reddit: only if you choose to connect your account for posting and subreddit suggestions. This is a direct, user-authorised connection you control.
- Stripe: our payment processor. If you live in the UK you buy from us directly and Stripe processes the payment. If you live anywhere else you buy through Onelink, Stripe's merchant of record service, who handle payment, tax, receipts and billing support. Either way Stripe receives your name, email address, billing address and payment details for this. We do not store your card details.
As part of the service, takedown notices you authorise are sent to the relevant website hosts and to search engines. These are filed under an authorised agent (Creator Lighthouse Ltd) so that your real identity is not disclosed to the infringing site.
International transfers
Some of our service providers may process personal data outside the United Kingdom, including in the United States and the European Union. Our search data provider is a company in the European Union and receives only search words (such as your stage name and handles, and the addresses of pages we are checking), never your legal name, contact details or images. Where personal data is transferred internationally, we rely on appropriate safeguards, including adequacy regulations, the UK Extension to the EU-US Data Privacy Framework where applicable, or the International Data Transfer Agreement (IDTA) and/or Standard Contractual Clauses with the UK Addendum. We implement additional technical and organisational safeguards where appropriate.
How long we keep it
We keep personal data only for as long as we need it. These periods are applied automatically every night.
- Your account: while you have a subscription. If you have no subscription and have not signed in for 12 months, we delete the account. We email you 30 days before, and signing in keeps it.
- Reference images, stage names, aliases and protection data: until you delete them, or your account is deleted.
- Takedown records: a takedown notice is a formal legal statement made on your behalf, and we may be asked to account for it. So where a notice, chase or search engine request has actually been sent, we keep the record of that case (the page, what was sent, the replies, and the authorisation you signed) for 6 years after the case closes or your account is deleted, then anonymise it, keeping only the dates, the outcome and the website for our statistics. This applies even if you delete your account, on the basis that we may need it to establish or defend legal claims. Drafts that were never sent are deleted with your account.
- Emails we send you about your account: 2 years, or until your account is deleted if sooner.
- Feedback and support messages: 12 months.
- Security logs (recognised devices and sign-in codes): 12 months.
- Newsletter and waitlist sign-ups: until you unsubscribe, and no longer than 2 years.
- Free scans (the name searched, your IP address, and your email if you unlocked the results): 90 days.
- Emails from websites and hosts that we could not match to a case: 2 years.
- Billing records: held by our payment provider, which keeps them for the period tax law requires (6 years in the UK).
You can delete your reference images and identities at any time, and you can permanently delete your account yourself from the Account page (Delete account). Everything is deleted at once, except the takedown records described above.
One exception, stated plainly. If you have taken a free trial, we keep a one-way cryptographic hash of your email address after your account is deleted, so that the same address cannot take a second free trial. It is not your email address and it cannot be turned back into one: it cannot be used to contact you, to identify you, or for any other purpose, and it is the only thing that survives deletion. We keep it on the basis of our legitimate interest in preventing repeated free trials.
Automated decision-making
We do not make decisions about users based solely on automated processing that produce legal effects or similarly significant effects.
Your rights
Subject to applicable law, you have the right to:
- Access your personal data.
- Correct inaccurate personal data.
- Request deletion of your personal data.
- Restrict certain processing activities.
- Object to certain processing activities.
- Request portability of data that you have provided to us.
- Withdraw consent where processing relies on consent.
To exercise any of these rights, contact us at hello@creatorlighthouse.co.uk. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO): ico.org.uk.
Security
We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, disclosure or alteration. These measures include access controls, encryption where appropriate, and provider security reviews.
Cookies and analytics
We use one essential cookie to keep you signed in. This is strictly necessary for the service to work and does not require consent.
For privacy-friendly visitor statistics we use Cloudflare Web Analytics, which is cookieless and does not track you across sites.
With your consent, we also use two Google tools. Google Analytics tells us how the site is used so we can improve it. Google Ads conversion tracking tells us which of our adverts led to someone subscribing. Both set cookies, and the Google Ads cookies are advertising cookies. Both share usage data with Google, which may process it outside the UK under appropriate safeguards.
Neither loads at all unless you accept in our cookie banner, and you can change or withdraw your choice at any time using the Cookie settings link at the bottom of any page. We do not sell your data.
Changes
We may update this policy from time to time. We will post any changes here and update the date above.