Privacy Policy

This policy explains how Creator Lighthouse Ltd collects, uses and protects your personal data when you use our website and app. Please read it alongside our Terms of Service.

Controller details

Creator Lighthouse Ltd is the data controller for the personal data described in this policy. Creator Lighthouse Ltd is a company registered in the United Kingdom (company number 17311446), with its registered office at 128 City Road, London, EC1V 2NX, United Kingdom. We are registered with the UK Information Commissioner’s Office (ICO) under registration number ZC187070. You can contact us at hello@creatorlighthouse.co.uk.

Who can use Creator Lighthouse

Our service is intended only for individuals aged 18 or over. We do not knowingly collect personal data from anyone under 18. If we become aware that an account belongs to a person under 18, we may suspend or delete the account and remove associated data.

What we collect

• Account data: your email address and, optionally, your name.
• Protection data you provide: the stage names, aliases, official links and reference images you add so we can search for leaks on your behalf.
• Service data: the discoveries, cases, notices and settings generated as you use the app.
• Usage data: basic technical information such as scan history and activity, used to run and improve the service.
• Payment data: handled by our payment processor. We do not store your card details.

Reference images and identity data

Reference images, aliases, stage names, official links and similar information are processed solely for the purpose of providing the protection services you request. Where image-based matching or identity verification is used as part of the service, we process such information only as necessary to provide the service and in accordance with applicable data-protection requirements. We do not use customer reference images to train public AI models.

Special category data

Because we protect content for adult and independent creators, some of the information you give us, or that we process to protect you, may amount to special category data under UK GDPR, in particular data that could reveal information about your sex life (for example your creator niche, the content we search for on your behalf, or an intimate-image protection case you choose to track). We only process this to provide the protection and related services you ask for.

Our lawful basis for processing this special category data is your explicit consent (UK GDPR Article 9(2)(a)), which we ask for separately when you create your account. You can withdraw that consent at any time by deleting your account (Account → Delete account), which erases your associated data; withdrawal does not affect processing carried out before you withdrew. We never require you to upload explicit content, and for intimate-image protection the image is fingerprinted on your own device and never reaches us or StopNCII.

How and why we use it, and our lawful bases

We process personal data for the following purposes:

• To create and manage your account and subscription.
• To provide content-protection services, including monitoring, case management and takedown assistance.
• To prepare and send notices and requests that you authorise us to submit on your behalf.
• To provide customer support.
• To maintain the security, reliability and performance of the service.
• To improve our products and services.

Depending on the activity, we rely on one or more of the following lawful bases under UK data protection law:

• Performance of a contract with you.
• Your consent, where required.
• Our legitimate interests in operating, securing and improving the service.
• Compliance with legal obligations where applicable.

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.

AI-assisted processing

We use third-party AI service providers to assist with analysis, classification, drafting, support functions and related service operations. Data shared with these providers is limited to what is reasonably necessary to provide the requested functionality. We require contractual data-protection commitments from these providers and do not permit them to use customer personal data to train public models.

Search, indexing and matching providers

To identify potential infringements and assist with content-protection activities, limited data may be processed through third-party search, indexing, computer-vision and related technology providers. Where possible, we minimise the personal data shared and avoid transmitting unnecessary identity information.

Other providers we share data with

We also use the following providers to run the service. They process data only on our instructions and under data processing terms:

• Cloud infrastructure and data hosting: your account details and service data are stored on cloud infrastructure and encrypted database platforms located within the European Economic Area (EEA).
• Communications infrastructure: email delivery, including system notifications and the legal notices you authorise, is routed through enterprise transactional email infrastructure.
• Reddit: only if you choose to connect your account for posting and subreddit suggestions. This is a direct, user-authorised connection you control.
• Paddle: our payment processor and merchant of record (when billing is enabled). When you check out you are buying from Paddle, who handle payment and tax; we do not store your card details.

As part of the service, takedown notices you authorise are sent to the relevant website hosts and to search engines. These are filed under an authorised agent (Creator Lighthouse Ltd) so that your real identity is not disclosed to the infringing site.

International transfers

Some of our service providers may process personal data outside the United Kingdom, including in the United States. Where personal data is transferred internationally, we rely on appropriate safeguards, including adequacy regulations, the UK Extension to the EU-US Data Privacy Framework where applicable, or the International Data Transfer Agreement (IDTA) and/or Standard Contractual Clauses with the UK Addendum. We implement additional technical and organisational safeguards where appropriate.

How long we keep it

We retain personal data only for as long as necessary for the purposes described in this policy.

• Account data: while your account remains active.
• Reference images, aliases and protection data: until deleted by you or until account deletion.
• Service records, cases and notices: for as long as reasonably necessary to provide the service and to manage legal, audit and dispute-resolution requirements.
• Security and operational logs: for a limited period appropriate to security, fraud-prevention and operational needs.

You can delete your reference images and identities at any time, and you can permanently delete your entire account and all associated data yourself from the Account page (Delete account). When data is no longer required, it is deleted or anonymised where reasonably practicable.

Automated decision-making

We do not make decisions about users based solely on automated processing that produce legal effects or similarly significant effects.

Your rights

Subject to applicable law, you have the right to:

• Access your personal data.
• Correct inaccurate personal data.
• Request deletion of your personal data.
• Restrict certain processing activities.
• Object to certain processing activities.
• Request portability of data that you have provided to us.
• Withdraw consent where processing relies on consent.

To exercise any of these rights, contact us at hello@creatorlighthouse.co.uk. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO): ico.org.uk.

Security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, disclosure or alteration. These measures include access controls, encryption where appropriate, and provider security reviews.

Cookies and analytics

We use one essential cookie to keep you signed in. This is strictly necessary for the service to work and does not require consent. We do not use advertising cookies.

For privacy-friendly visitor statistics we use Cloudflare Web Analytics, which is cookieless and does not track you across sites. With your consent, we also use Google Analytics to understand how the site is used and improve it; this sets analytics cookies and shares usage data with Google (which may process it outside the UK under appropriate safeguards). Google Analytics only loads if you accept analytics cookies in our cookie banner, and you can change or withdraw your choice at any time using the Cookies link at the bottom of the page.

Changes

We may update this policy from time to time. We will post any changes here and update the date above.