Privacy Policy

1. Introduction

This Privacy Policy explains how snily.com (“snily.com”, “we”, “us”) collects, uses, discloses and retains personal data when you visit snily.com, create an account, or use our copyright protection, content monitoring and DMCA takedown services (the “Service”).

The data controller for the processing described here is Welurim Ltd, Nikis 1, Anthoupoli, 2350 Nicosia, Cyprus (registration number HE 498252).

This policy applies to all users of snily.com, including visitors who use the public scan without registering. It does not apply to third-party websites that snily.com reports on or links to; those sites are governed by their own policies.

What snily.com deliberately does not keep

snily.com does not store the unaltered image of infringing material it locates. When the Service captures a page, the original frame is discarded and only a blurred rendering, the textual content of the page, and a SHA-256 hash of the original frame are retained. The hash allows the blurred copy to be shown to be a faithful record of what was found without snily.com holding a further copy of the material itself.

2. Information We Collect

We collect only the categories of data described in this section, and only for the purposes set out in section 3. Where a field is optional, that is stated at the point of collection.

2.1 Account Information

When you register we collect your email address, a password (stored only as a salted cryptographic hash and never in a readable form), and your selected plan and billing status. If you contact support, we retain the messages you exchange with us alongside your account so that the person handling your request has its history.

2.2 Protected Identity and Reference Material

To search for copies of your work, snily.com processes the names, stage names, handles and profile addresses you ask us to monitor, the pages you have identified as your own authorised channels, and the reference material you upload. Reference material is stored privately, is never served publicly, and is processed to derive perceptual hashes and image embeddings so that copies can be recognised after cropping, re-encoding or resizing.

2.3 Case and Enforcement Data

For each finding, snily.com records the address at which the material appeared, the evidence described in section 1, the notices sent, the recipients contacted, the dates of each step, and the responses received. This record is what substantiates a takedown notice, and it is retained as described in section 8.

2.4 Usage Data

We log how the Service is used: pages and screens requested, features invoked, searches initiated, timestamps, referring pages, and errors encountered. Usage data is used to operate, secure, debug and improve the Service.

2.5 Device Information

Our servers and infrastructure providers record technical data sent by your browser or device: IP address, user-agent string, browser and operating system version, language preference, and approximate location derived from the IP address at country level. This data is used for security, abuse prevention, fraud detection and diagnostics.

2.6 Cookies

snily.com sets a session cookie to keep you signed in. It is httpOnly, so it cannot be read by scripts running in the page, and it is scoped to the host that issued it. We do not operate advertising cookies and do not participate in cross-site tracking or advertising networks. Where any non-essential cookie is introduced, it will be set only with your consent, and this section will be updated before it is.

2.7 Analytics

We use aggregate, privacy-preserving analytics to understand which parts of the Service are used and where they fail. Analytics data is processed in aggregate, is not used to build advertising or marketing profiles, and is not sold or shared for cross-context behavioural advertising.

2.8 Payment Information

Subscriptions are processed by our payment provider. Card numbers, security codes and bank details are submitted directly to that provider and never reach snily.com’s systems. We receive and store only what is needed to operate the subscription and to meet accounting obligations: the subscription identifier, plan, currency, amounts, billing country, card brand, the last four digits of the card, and invoices.

3. How Information Is Used

We process personal data for the following purposes, and no others:

• to create and administer your account and authenticate your sessions;
• to search public sources for copies of the material you have asked us to protect, and to match candidates against your reference material;
• to capture, record and preserve evidence of infringement in the form described in section 1;
• to prepare, send and follow up takedown notices and escalations to search engines, hosting providers, registrars, network providers and platforms, as your authorised agent;
• to process payments, issue invoices and manage renewals and cancellations;
• to provide support and respond to your requests;
• to secure the Service, detect and prevent fraud, abuse and misuse, and enforce our terms;
• to comply with legal obligations and to establish, exercise or defend legal claims;
• to send service and administrative messages about your account.

snily.com does not sell personal data, does not share it for cross-context behavioural advertising, and does not use your reference material or case data to train models offered to other customers.

4. Legal Bases for Processing (GDPR)

Where the EU or UK General Data Protection Regulation applies, snily.com relies on the following legal bases under Article 6(1):

• Performance of a contract (Art. 6(1)(b)) - operating your account, running scans, filing notices on your instruction, and providing support.
• Consent (Art. 6(1)(a)) - processing the reference material you upload, including the derivation of perceptual hashes and embeddings from it. You may withdraw consent at any time by deleting the material, which ends that processing for the future.
• Legitimate interests (Art. 6(1)(f)) - retaining evidence in order to establish, exercise and defend legal claims; securing the Service; preventing fraud and abuse; and improving reliability. Where we rely on this basis we have assessed that our interest does not override your rights.
• Legal obligation (Art. 6(1)(c)) - retaining invoices and accounting records, and responding to lawful requests from competent authorities.

Where processing concerns special categories of data because of the nature of the material you ask us to protect, that processing is carried out on the basis of Article 9(2)(f) - establishing, exercising or defending legal claims - and, for material you upload, on your explicit consent under Article 9(2)(a).

5. Data Sharing

snily.com discloses personal data only in the circumstances described below. We do not sell personal data and we do not disclose it for anyone else’s marketing purposes.

5.1 Disclosure inherent in a takedown notice

A takedown notice necessarily identifies the address complained of and the rights holder on whose behalf it is filed, and includes the statements the applicable law requires. By instructing snily.com to file notices you accept that these details are disclosed to the recipient, and that a recipient may forward the notice to the person who posted the material or publish it in a transparency report. This is a feature of the notice-and- takedown process rather than a choice made by snily.com.

5.2 Legal disclosure

We may disclose data where required by law, court order or a valid request from a competent authority, and where necessary to establish, exercise or defend legal claims.

5.3 Corporate transactions

If snily.com is involved in a merger, acquisition or transfer of assets, data may be transferred as part of that transaction, subject to the receiving party being bound to this policy or a policy no less protective, and subject to notice being given to affected users.

6. Third-Party Service Providers

snily.com uses a small number of processors to run the Service. Each acts on our documented instructions under a written data processing agreement, is bound to confidentiality, and may not use the data for its own purposes. The categories are:

• cloud hosting and compute, for the application and its background workers;
• object storage, for reference material, blurred renderings and generated reports;
• managed database and cache providers;
• transactional email delivery, for sign-in, notices and service messages;
• search data providers, used to query public search indexes for candidate addresses;
• payment processing and invoicing;
• error monitoring and aggregate analytics;
• messaging platforms used for support and case notifications.

A current list of processors, naming each provider and the country in which it processes data, is available on request from [email protected].

7. International Data Transfers

snily.com operates globally and some of the providers described in section 6 process data outside the country in which you live, including in the United States. Where personal data is transferred out of the European Economic Area, the United Kingdom or Switzerland, the transfer is made on one of the following grounds:

• an adequacy decision covering the destination country;
• the European Commission’s Standard Contractual Clauses, with the UK International Data Transfer Addendum where the UK GDPR applies;
• a derogation under Article 49 GDPR, where a transfer is necessary for the establishment, exercise or defence of legal claims - which is the case when a notice must be sent to a recipient in another jurisdiction.

Transfer mechanisms are supported by technical and organisational measures, including encryption in transit and at rest. A copy of the clauses relied on for a particular transfer is available on request.

8. Data Retention

We keep personal data no longer than is necessary for the purpose it was collected for, applying the following periods:

• Account data - for as long as the account is open, and deleted when the account is closed, subject to the invoice exception below.
• Reference material - until you delete it, or until the account is closed, whichever is earlier.
• Case records and evidence - while the account is open and for 2 years after it closes. A notice that has been filed and cannot afterwards be evidenced exposes both you and us, which is why this period is longer than the account’s.
• Invoices and accounting records - retained as required by applicable tax and accounting law, currently 7 years, irrespective of account closure.
• Security and access logs - retained for a rolling period appropriate to investigating incidents, and then deleted or aggregated.
• Support correspondence - retained for as long as the account is open and for a limited period afterwards to handle follow-up questions and disputes.

Where data must be retained for one purpose but not another, it is restricted to that purpose rather than kept generally available.

9. Security Measures

snily.com applies technical and organisational measures appropriate to the sensitivity of the data it holds, including:

• encryption of traffic in transit (TLS) and of stored data at rest;
• passwords stored only as salted cryptographic hashes, and session cookies that are httpOnly and host-scoped;
• discarding of original captured frames, so that the most sensitive artefact in the pipeline is not retained at all;
• private storage for reference material, never served from a public address, with access limited to the account it belongs to and to the processes that act on it;
• least-privilege access for personnel, credentials held encrypted and rotated, and administrative access logged;
• network isolation between public interfaces, the API and background workers;
• monitoring, error reporting and backups of the primary datastore.

No system is perfectly secure. Where a personal data breach is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours of becoming aware of it and will inform affected users without undue delay where the law requires.

10. Your Rights

10.1 Rights under the GDPR

If the EU or UK GDPR applies to you, you have the right to request access to the personal data we hold about you; to have inaccurate data corrected; to have data erased; to restrict processing; to object to processing carried out on the basis of legitimate interests; to receive the data you provided in a portable, machine-readable form; and to withdraw consent where processing is based on consent. You also have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you: candidate matches produced by our systems are reviewed by a person before any notice is filed.

10.2 Rights under the CCPA and CPRA

If you are a California resident you have the right to know what personal information is collected, used, disclosed and, if applicable, sold or shared; to request deletion; to request correction; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. snily.com does not sell personal information and does not share it for cross-context behavioural advertising, so no “Do Not Sell or Share” mechanism is required. An authorised agent may submit a request on your behalf with proof of authorisation.

10.3 Exercising your rights

Send requests to [email protected]. We respond within one month of receipt, extendable by a further two months for complex requests, with notice to you. We may ask for information sufficient to verify that the request comes from you or from someone authorised to act for you; this is a safeguard, not a precondition designed to discourage the request. Requests are free unless they are manifestly unfounded or excessive.

Some rights are qualified. Evidence supporting a notice that has already been filed may be retained despite an erasure request, because it is needed for the establishment, exercise or defence of legal claims, and invoices are retained where accounting law requires. Where we refuse a request in whole or in part, we say which exemption we rely on.

10.4 Complaints

If you are not satisfied with our response you may lodge a complaint with Office of the Commissioner for Personal Data Protection, Cyprus. You may also seek a judicial remedy.

11. Children's Privacy

The Service is not directed to children. You must be at least 18 years old to hold a snily.com account, and we do not knowingly collect personal data from anyone under that age.

If we learn that an account has been created by a minor, the account is closed and the associated data deleted. If you believe a minor has provided data to snily.com, write to [email protected] and we will act on it.

Reports concerning material depicting a minor are treated as a matter of the highest priority and are escalated to the relevant platforms and authorities rather than handled as an ordinary case.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in the Service, in our processors, or in the law. The revised policy is published on this page and the “Last updated” date above is changed. Where a change materially affects how we process your personal data, we will notify you by email to the address on your account, or by a notice inside the Service, before it takes effect. Continued use of the Service after a change takes effect constitutes acceptance of the updated policy.

13. Contact Information

Privacy enquiries and rights requests: [email protected]. General enquiries: [email protected].

Postal correspondence should be addressed to Welurim Ltd, Nikis 1, Anthoupoli, 2350 Nicosia, Cyprus.

The Terms & Conditions govern the rest of your relationship with snily.com.