LeakVoid Privacy Policy

Version 16 (October 27, 2026: early access wording updated now that LeakVoid is open, in Sections 2, 2C, 4 and 7). Effective date: October 27, 2026

Version 15 (October 27, 2026: refer-a-friend fraud checks, including the billing street address and ZIP code, in Sections 2, 2C and 3). Effective date: October 27, 2026

Version 14 (October 27, 2026: remaining agency wording in Sections 2, 3, 4, 7, 10 and 11 taken out, because we do not offer agency accounts). Effective date: October 27, 2026

Version 13 (October 27, 2026: Section 2D and the agency account row in Section 7 taken out, because we do not offer agency accounts). Effective date: October 27, 2026

Version 12 (October 26, 2026: plain wording in Sections 2, 5 and 10; Section 2E and the related rows in Sections 2, 4 and 7 taken out). Effective date: October 26, 2026

Version 10 (October 26, 2026: joining early access now also signs you up for our newsletter, and opting out stops all our marketing email, in Sections 2C, 3, 4 and 7; what we keep after you ask us to stop messaging you on Instagram, in Sections 7 and 8). Effective date: October 26, 2026

Version 9 (October 25, 2026: LeakVoid is not available in Utah, added everywhere this policy excludes Maine, including "notify me" requests in Sections 2C and 7). Effective date: October 25, 2026

Version 8 (October 25, 2026: messages and comments you send our Instagram account, in Sections 2, 3, 4, 7, 8 and 11; how to delete them, in Section 8 and at leakvoid.com/data-deletion; our hosting and email providers, in Section 4; how long backups are kept, in Section 7). Effective date: October 25, 2026

Version 7 (October 25, 2026: at launch we work only from the links you send us, with no searching, uploads, hash matching or reverse image search, in Sections 1, 2, 2A, 3, 4, 5, 7, 9, 11 and 12, and old Section 2B (reverse image search) removed; content that appears to show a minor in Section 10; when we tell you about legal requests in Section 4; "notify me" requests from Maine in Sections 2C and 7). Effective date: October 25, 2026

Version 6 (October 24, 2026: Stripe as our main payment processor and Segpay as our alternate in Sections 2 and 4; agency accounts in new Section 2D and in Sections 2, 3, 4 and 11; reporting fake accounts wording in Sections 3 and 6; ID check wording in Sections 1, 2A, 3, 4 and 11; marketing attribution, meaning campaign tags, referral codes and the optional "How did you hear about us?" answer, in Sections 2, 2A, 2C, 3, 7 and 11; a creator's confirmation of their agency in Sections 2D and 7; keeping your email address after you close your account or stop your agency, only to forward counter-notices, in Sections 2D, 7 and 8; opening your own account after you stop your agency in Section 2D; what we keep from the ID check, signature records and how long we keep records in Sections 1, 2, 2C, 2D, 3, 7, 8 and 10). Replaced by Version 7 before it took effect

This policy explains what Leak Void LLC, a Wyoming limited liability company ("LeakVoid," "we," "us") collects, why, who we share it with, and the choices you have. We know the information you trust us with is some of the most private information you have. We built the service to collect as little as we can, keep it for as short a time as we can, and never sell it.

1. The short version

• We collect what we need to act on the links you send us, prove you own your work, and send notices for you.
• We work only from links. You do not upload your images or videos to us, and we do not download or save images or videos from the links you send us.
• We do not sell your information. We do not share it for advertising. We do not use it to train AI for anyone else.
• Takedown notices are not private. A DMCA notice has to include contact details and identify the copyright owner. Platforms often pass notices on to the person who posted the content. Google shares many copyright notices with the Lumen database, which publishes them. You sign each notice yourself, with a stage name or legal name you choose. We send it with our contact details, not yours. Section 6 explains exactly what may be disclosed.
• We do not use facial recognition and we do not collect biometric data. Our ID check looks at your ID document only. There is no selfie, no liveness check and no face matching. We do not store the name, date of birth or ID number from your ID, only coded (hashed) forms made from them, and we use your date of birth only to work out your age.
• We use analytics, including session recordings on some public pages, only if you agree. We never record the pages where you complete the ID check, link accounts, sign notices or use your dashboard. See Section 2A.
• You can delete your account and your data at any time.
• LeakVoid is only for adults. We do not knowingly collect information from anyone under 18.

2. What we collect

Account and contact information. Your legal name, email address, password (stored in hashed form), country and state, and the time zone you choose.

Proof that your creator accounts are yours. You choose one or more of these:

• Bio or post code. We give you a code to put in your bio or a post, and we check your public profile for it. We keep a record that the check passed.
• Account link. If you link an account through a platform's official sign-in (OAuth), we receive what the platform shares and you approve, such as your account ID and handle. We never receive your password.
• Document check. This check is not open yet. Until it opens, we don't ask anyone for a government ID and we send nothing to Persona. When it opens, it works like this. If you choose this way to prove your accounts, or when you claim our latest-month refund guarantee, you take or upload a photo of your government ID, and our ID verification provider, Persona, checks that the document is genuine and reads the details printed on it (such as your name, date of birth, ID number, address and expiration date). Like most IDs, the image includes your photo. There is no selfie, no liveness check and no face matching: we have set up the check so that Persona does not compare the photo on your ID with a selfie or with any other photo. We do not receive or create a face scan or any other biometric identifier. When a check is finished, our system gets the outcome from Persona and reads only these details from it: the result (pass or fail), the ID type, your name, date of birth and ID number, the country and state that issued the ID, and the state in the address on it. We keep the result, the ID type and the date of the check. We do not store your name, date of birth, ID number or address. Instead we keep two coded (hashed) forms: one made from your name and date of birth, and one made from your ID number and the country that issued it. A coded form does not show the details it was made from. We use the coded forms only for the once-per-person limit on the latest-month refund guarantee and to check for referral fraud (Section 2C). We use your date of birth only to work out your age (Section 10), and the issuing state and address state only to apply the Puerto Rico age rule in Section 10. Persona keeps the ID images and the details read from them until we ask it to delete them. When your check passes, we ask Persona to delete them as soon as we have saved the result. If a check does not pass, Persona keeps them under the retention setting on our Persona account, which does not yet delete them automatically after a set time. You can ask us at any time, by emailing hello@leakvoid.com, to have Persona delete your ID check records, and we will also ask Persona to delete them when you close your account. We keep a record of each of these requests (Section 7). If we ever receive the images ourselves, we delete them within 30 days.

Your creator profile. Your stage names and handles, links to your official pages (for example your OnlyFans, Fansly or social media pages), your allow list of sites you have licensed, and any copyright registration numbers you choose to give us.

Your Registered Works. The links to your own posted works and official pages that you give us, which our notices use to identify your original work. These works may be explicit. You do not upload image or video files to us. We do not use facial recognition. See Section 9.

Match and notice records. The links you send us and any note you add, the links to fake accounts you tell us about, why a link may be a copy (for example, you sent it to us and confirmed it) and the time we recorded it, the notices and reports we send, platform responses, counter-notices, and the outcome. We do not download or save images or videos from the links you send us.

Signature records. When you sign notices, we record the signing name you use, the time, your IP address, your browser details (the user agent your browser sends), the exact statement you signed and the notices it covered. This is the proof of your electronic signature. We record the same IP address and browser details when you confirm or dismiss a match and when you agree to sign electronically (your E-SIGN consent). Section 7 explains how long we keep these records.

Payment information. Our main payment processor, Stripe, Inc. (Stripe), collects your card details and your billing address on its payment form and processes your payments, refunds and renewals. We receive a token, the card brand, the last four digits, the expiration date, your billing address, and a card fingerprint (a code from Stripe that shows when the same card is used again without revealing its number). We use the country in your billing address to check that you live in the United States, since LeakVoid is offered only to US residents, except residents of Maine and Utah (Terms Section 3). Your billing address is also used to work out sales tax where it applies, to screen payments for fraud and to check for referral fraud (Section 2C). In our own systems we keep only the country from your billing address. Stripe keeps the full billing address with your payment records. We never see or store your full card number. Stripe processes payment data for us as our service provider, and also uses it for its own purposes, such as preventing fraud and meeting its legal duties, under its own privacy policy at stripe.com/privacy. Segpay is our alternate payment processor. If your payments go through Segpay, we tell you at checkout, Segpay collects your card details on its own payment form, and the same applies under Segpay's privacy policy: we never see or store your full card number.

Consent records. A record of when and how you agreed to automatic renewal, these policies and the Agent Authorization, including your typed signature (for the Agent Authorization), the time, your IP address, your browser details (user agent) and the version of the text you agreed to. The law requires us to keep proof of your consent to automatic renewal.

Device and usage information. Your IP address, browser type, and the pages you use in your dashboard, for security and to keep the service running. If you agree, we also collect analytics and session recordings on some public pages, as described in Section 2A. We do not use advertising cookies or cross-site tracking.

How you found LeakVoid. We collect the following only to measure which marketing channels bring us sign-ups and customers:

• Campaign tags. If you reach our site from an ad or a tagged link, the web address can include campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term and utm_id). Our site reads them from the web address and carries them in the links between our own pages while you move around the site, so each page you open also sends them to our website host, Netlify, as part of the page address. It does not save them in cookies or in your browser's storage, so they are not kept for a later visit. If you sign up during that visit, we save them with your sign-up. An ad network may also add a click ID to the web address (such as gclid or fbclid). We do not save click IDs or carry them to other pages.
• Referral codes. The code from a friend's share link or referral link, if you arrived through one, and the code we make for you to share (Section 2C). The code from a share link may also reach PostHog with your visit (Section 2A). Like campaign tags, the code from a share link is carried in the links between our pages, so our website host also receives it with each page you open.
• Website host logs. Like most websites, our host, Netlify, automatically logs each page request to run and secure the site. A log entry includes your IP address, browser type, the full page address (including any campaign tags, click ID or share code in it) and the page you came from. We do not copy these logs into our own systems or use them to identify you.
• Your answer to "How did you hear about us?" This question is optional. If you answer it, we save your answer with your sign-up.

We use this information to count which ads, links and other channels lead to sign-ups and paying customers. We do not use it to build an advertising profile of you or to show you ads, we do not send it back to any ad network, and we do not sell it or share it for cross-context behavioral advertising. We store it with your sign-up (with our website host, Netlify) or with your account (in our account database in the United States), and we keep it only as long as we keep that sign-up or account (Section 7). We may keep totals, such as the number of sign-ups from each campaign, that do not relate to any one person.

Sign-up list and newsletter. If you sign up with your email on our website, see Section 2C.

Information about other people in counter-notices. If someone sends a counter-notice about a notice you signed, it will include that person's name, address, phone number and signature, and their statements. Platforms send it to us because we sent the notice for you. We pass it to you, keep it with the notice record (Section 7), and use it only so you can decide what to do.

Messages. Emails and support requests you send us. If you send a direct message to our Instagram account, Meta gives us your Instagram-scoped ID (a number that identifies you only to our account), your message and links to any photos or files you send. If you comment on one of our Instagram posts, we also get the comment and the post it's on. We do not ask Meta for your profile details, and we do not download what you send. We use it only to answer you.

2A. Analytics, cookies and session recordings

We use PostHog, an analytics service run by PostHog, Inc., to understand how people use our website so we can make it easier to use. PostHog works for us as a service provider under a data processing agreement. PostHog may use the data only to provide its service to us, not to sell it or share it for advertising.

What runs before you choose, or if you decline. Until you make a choice in our cookie banner, PostHog collects nothing. If you click "Decline," we may still count your visit, the pages you view and the buttons you click, together with the code from a share link if you arrived through one, using a one-way code that PostHog calculates on its servers. In that case no cookies are set and your session is not recorded. Your browser keeps only a record of your choice, one saved by our site and one by PostHog, so the banner does not ask again and PostHog stays in this limited mode.

What runs if you click "Accept."

• Analytics cookies. PostHog sets a first-party cookie whose name starts with ph_ and uses your browser's local storage. These hold a random ID and session information so we can tell repeat visits apart. The cookie lasts up to 30 days.
• Usage events. Pages you view, buttons you click, the time, the type of device and browser, and the code from a share link if you arrived through one.
• Session recordings and heatmaps. On some public pages (such as our home page and pricing pages), PostHog records how you move through the page: clicks, scrolling, mouse movement and the layout of the page. We use these recordings to find confusing steps and broken pages. Heatmaps combine clicks from many visitors to show which parts of a page get attention.

What we never record. We turn recording off on the pages where you sign up with your details, complete the ID check or age check, link or verify your creator accounts, sign notices, and on your whole dashboard. Text you type into forms is hidden before anything leaves your browser. We hide page text, stage names, handles, links to matches and ID results. We do not send PostHog your name, email address, Registered Works or ID. We do not link a recording to your account. IP address capture is turned off in PostHog.

Your choices.

• You can decline in the banner. If you do, we do not set analytics cookies and do not record your session.
• You can change your mind at any time using the "Privacy choices" link at the bottom of every page.
• If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a "Decline" and do not run analytics cookies or recordings.
• You can also delete cookies in your browser settings.

Visitors in the EU, EEA and UK. PostHog stays fully off, including the count without cookies, unless you opt in.

Where it is stored and for how long. PostHog stores this data in the United States (PostHog US Cloud). We keep recordings for 30 days, and then they are deleted. We keep other analytics data for 1 year. After that it drops out of our analytics, and PostHog deletes it on its own schedule.

Other cookies. We also use cookies that are needed to keep you logged in and secure. Those do not need your consent and you cannot turn them off without logging out. We do not use advertising cookies, and we do not allow other companies to track you across other websites through our site.

2C. Sign-up list and newsletter

You can sign up with your email on our website. People who joined our early access list before launch are on the same list.

What we collect. Your email address, the time you joined, which version of the sign-up form you used, and, if you arrived through a friend's link or share your own, a short referral code. If you arrived from an ad or a tagged link, we also save its campaign tags (not the click ID), and if the form asks "How did you hear about us?" and you answer, your answer (Section 2). We do not ask for your name.

Where it is kept. The form is run by our website host, Netlify, Inc., in the United States, under Netlify's data processing agreement. Netlify checks each sign-up with its spam filter, Akismet, run by Automattic Inc. Akismet keeps most spam-check data for between 2 weeks and 90 days. We also copy your email address to Resend (run by Plus Five Five, Inc., in the United States), which keeps our newsletter list and sends the newsletter for us. Open and click tracking is turned off, so we do not see whether you open our emails or click their links. We also copy the sign-up list, including any campaign tags and referral codes saved with it, into our own account database in the United States, so we can email you about LeakVoid and link your sign-up to an account if you open one. The same retention applies to that copy.

What we use it for. We use your email address to send you our newsletter, which is marketing email about LeakVoid. Signing up on our website adds you to it. If you joined our early access list before launch, you also get one email telling you LeakVoid is open. If you joined before October 26, 2026 and did not tick the newsletter box, you get only that email. We never sell or share your email address. If you came through a friend's link or one of our tagged links, we use the referral code only to see who shared LeakVoid with you and which channels bring sign-ups. We use campaign tags and your answer to "How did you hear about us?" only as Section 2 describes. Referral codes saved with a sign-up give no one a reward, and they never carry over into the paid refer-a-friend program. The code from a share link may also be sent to PostHog with your visit (Section 2A). Nothing about referrals is stored in your browser. You can opt out at any time with the unsubscribe link in every email, or by emailing hello@leakvoid.com with the word "unsubscribe." When you opt out, we stop all our marketing email to you, including the launch email.

Refer a friend (paying customers). Once LeakVoid is open, customers who have paid at least once can share a personal referral link from their dashboard (Terms Section 9A). It is separate from the referral codes saved with sign-ups. For it we keep who referred whom, the dates of the friend's sign-up and payments, any refund, dispute or cancellation that decides whether a credit is added, and the credits added, used or removed. To prevent referral fraud, such as self-referrals and duplicate accounts, we compare account signals (the login email, creator accounts and signing names on each account) and payment signals (the card fingerprint from Stripe, and the street address and ZIP code in the billing address Stripe holds). We compare the email, card fingerprint and billing address as coded (hashed) forms that we make for the check, in memory, and do not store. We keep only the result of the check. If both people have already passed our document check, for the refund guarantee or to prove their accounts, we may also compare the coded (hashed) forms of the name and date of birth kept from that check (Section 2). We never keep the name, date of birth or street address itself. We never collect an ID just for a referral, and we never use face data or ID photos for this.

How long we keep it. We keep your sign-up until 12 months after launch, and your email address for as long as you get our newsletter, if that is longer. When you opt out, we keep only your email address on our do-not-email list (Section 7), so we don't email you again. If you sign up for LeakVoid, your email becomes part of your account and Section 7 applies. You can ask us to delete your sign-up sooner at any time by emailing hello@leakvoid.com.

Launch notice for people outside the US or in Maine or Utah. If you live outside the United States or in Maine or Utah and ask us to tell you when LeakVoid opens where you live (for example, by replying "notify me" to our support reply or our account-closing email), we keep only your email address, where you live (your country, or Maine or Utah) and the date you asked, and use them only to send that one email. We delete them as soon as that email is sent, or 24 months after you asked if it hasn't been sent by then, or sooner if you ask. We rely on your request (your consent), and you can withdraw it at any time by emailing hello@leakvoid.com.

Optional updates after the launch email. The launch email may include an optional, unticked choice to get occasional LeakVoid updates by email. If you actively opt in, we keep your email address and your country, a record of when you opted in and the wording you agreed to, and use them to send you LeakVoid updates until you unsubscribe. Every update has a working unsubscribe link. If you don't opt in, nothing changes: we delete your details after the launch email as described above.

3. Why we use it

We use your information to:

• confirm that the creator accounts you list are yours, check your ID and age if you use the document check, and stop people from filing takedowns in someone else's name;
• check the links you send us against your own pages and your allow list, and prepare reports for fake accounts you tell us about (we do not search for copies of your work or for fake accounts);
• prepare DMCA notices and send the ones you sign, prepare search engine removal requests for you to submit yourself on the search engine's own form, and prepare reports of fake accounts for you to file yourself;
• show you results, forward counter-notices (including the sender's contact details) to you, and send you service emails;
• bill you, check, using the state you give us at signup and the country and state in your billing address, that you live in the United States and not in Maine or Utah (we keep only the billing country, not the billing state), work out sales tax where it applies, screen payments for fraud, and keep records the law requires (for example, proof of your consent to automatic renewal, and tax records);
• apply the once-per-person limit on our latest-month refund guarantee. While our document check is not open, you can claim without it, and we check that each person uses the guarantee once by comparing your account and coded (hashed) forms of your email address and of your card fingerprint from Stripe with earlier guarantee claims. Once the document check opens, claims need it, and we also use coded (hashed) forms made from the details on your ID (your name and date of birth, and your ID number). We do not keep the name, date of birth or ID number itself, and we never use face data or your photo for this;
• run the refer-a-friend program and prevent referral fraud, using referral records, account and payment signals (including your login email and the street address and ZIP code in your billing address) and, only for people who have already passed the document check, the coded forms of their name and date of birth (Section 2C). We do not ask for an ID check for referrals;
• if you signed up on our website, send you marketing email (our newsletter and, if you joined early access before launch, one email telling you LeakVoid is open) until you opt out, or, if you live outside the US and asked us to, send one email when LeakVoid opens in your country and, only if you opt in, occasional updates (Section 2C);
• if you agree, understand how visitors use our public pages and sign-up steps so we can improve them (see Section 2A);
• measure which marketing channels, such as ads, tagged links, referral links and the places people tell us they heard about us, bring sign-ups and paying customers (Section 2);
• answer messages and comments you send our Instagram account, and honor your request to stop;
• detect fraud, abuse and false claims, and enforce our Terms of Service; and
• meet legal duties, such as answering valid legal process or reporting suspected child sexual abuse material.

We do not use your information for any other purpose without asking you first.

4. Who we share it with

We do not sell your personal information. We do not "share" it for cross-context behavioral advertising, as California law uses that term. We have not done so in the past 12 months.

We disclose information only in these cases:

Platforms, hosts and search engines that receive notices. This is how the service works. See Section 6.

Service providers (processors). Companies that help us run LeakVoid, under contracts that limit their use of your data to serving us. They are:

We will keep this list current. If we add a provider that will see your Registered Works or ID, we will email you first.

Legal reasons. When the law requires it, such as a valid subpoena or court order. When we can, we will tell you before we respond so you can object. We will not tell you if the law or a court order forbids it, or if telling you could put a child at risk or harm an investigation. We report suspected child sexual abuse material to the National Center for Missing and Exploited Children (NCMEC), as federal law allows or requires.

A sale of our business. If another company acquires LeakVoid, your information may transfer to it, but only under the same promises in this policy. We will email you before that happens.

5. How we protect it

• You do not upload image or video files to us, and we do not download images or videos from the links you send us.
• Your hashes, account data and ID results are encrypted in storage and in transit.
• We limit access to your data to what's needed to run the service. Only a small number of authorized people can access your data, and only for a specific task such as a support, billing or legal request. Actions they take on your account through our tools are logged.
• Access to our systems requires multi-factor authentication.

No system is perfectly secure. If a breach affects your information, we will notify you and the authorities as the law requires.

6. What takedown notices disclose

This section matters, so please read it.

What the law requires. A DMCA notice must include the signature of a person authorized to act for the copyright owner (you sign each of ours yourself), a description of the work, the location of the infringing copy, contact information for the person sending the notice, and two required statements. You can read the rule at 17 U.S.C. 512(c)(3).

How we limit what is exposed. You sign each notice with the signing name you choose, which can be a stage name. We send it with our address and email as the contact details. We do not put your home address, phone number or personal email in a notice.

The copyright owner's name. A notice also has to identify the copyright owner. By default, we identify you by the stage name or business name you choose in your dashboard, not your legal name. If you own your content through a company (such as your own LLC), you can list that company. Some platforms may ask us for your legal name or proof of ownership before they act. If that happens, we will ask you before we give it to them.

Platforms may pass notices on. Many platforms send a copy of the notice to the person who posted the content. That person may see the owner name and the works listed.

Hosts, network providers and domain registrars. If a website does not respond, we may send a notice you sign to the company that hosts the site, the network provider above it, or the company the domain is registered with. They may pass it on to the website owner.

Google and the Lumen database. Google shares copies of many legal removal notices with Lumen, an independent research project run by the Berkman Klein Center at Harvard. For copyright notices, Google says it generally shares the name of the person who made the request, the rights holder's name, the reported links, the country, the date, any attachments, the explanation in the form, and a quote of the content. Google says it does not share the contact information fields, such as email address. Lumen may publish the notice, and Google may show a link to it at the bottom of affected search results. This means the name you sign with and the name listed as the rights holder may become public. That is another reason we let you choose a stage name or business name. The same applies to a search engine removal request you submit yourself on Google's form: Google may share it with Lumen.

Reports of fake accounts. We do not report fake accounts for you. We prepare the reports and you file them yourself, so you decide what to share with the platform, including any ID it asks for. We never send your ID to a platform.

Counter-notices. If someone sends a counter-notice, the law requires the platform to send it to the notice sender. We forward it to you, including the sender's name, address and phone number, which the law requires a counter-notice to contain. If you decide to sue to keep the content down, your legal name will likely appear in court filings. We will not file anything in court for you.

7. How long we keep it

Our backups are kept for up to 7 days, so deleted data can stay in a backup for up to 7 days after it is deleted from our systems. We use backups only to restore our systems.

8. Deleting your data and your other choices

You can delete individual Registered Works and stage names from your dashboard at any time. You can close your account at Account > Privacy > Delete my account. You can also email hello@leakvoid.com.

Instagram messages. To delete what we hold from your Instagram messages or comments, send the word "delete" in a message to @leakvoidhq, or email hello@leakvoid.com and we'll ask you to send that message from your account so we know it's you. We delete it within 7 days and reply to confirm. If you write to us again after that, we'll answer, unless you asked us to stop. Full steps are at leakvoid.com/data-deletion.

When you delete your account, we stop all matching and new notices, and delete your data on the schedule in Section 7. We keep your email address only to forward counter-notices about notices already sent, for as long as we keep those notice records: 3 years after the last notice we sent for you, or longer if a counter-notice, reply or dispute about one of them comes later (Section 7). We cannot recall notices that have already been sent, and we cannot delete copies held by platforms, search engines or Lumen.

9. We do not use facial recognition

We do not use facial recognition. We do not create face templates, faceprints or any other biometric data from your photos, your ID, your Registered Works or the links you send us. Our ID check does not use a selfie, a liveness check or face matching, and we have turned off the provider's features that compare the photo on an ID with other photos. We match content by link only: the links you send us and the links to your own posted works. We do not use image hashes or reverse image search. If we ever want to add face matching, we will update this policy and ask for your consent first.

10. Children

LeakVoid is only for adults aged 18 and over (21 and over if you live in Puerto Rico or your ID or billing address is from Puerto Rico). Every customer must confirm their age when they sign up. When you use the document check, we work out your age from the date of birth on your ID, without storing it. You must be 21 or older if your ID was issued in Puerto Rico or shows a Puerto Rico address, if your billing country is Puerto Rico, or if you told us you live in Puerto Rico; otherwise you must be 18 or older. If the check shows you are under that age, we do not accept it to prove your accounts. If you took the check to claim the latest-month refund guarantee, we still pay the refund, and we then close your account. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it. If we learn that someone under 21 signed up while living in Puerto Rico, or with an ID or billing address from Puerto Rico, we close the account and delete their data as Section 7 explains.

If we learn of content that appears to show a minor in a sexual way, we do not open, download or view it further, and we do not save it. We report it to NCMEC with the link and the details we have. Please never send us such content, even to report it; send the link only. Federal law requires us to keep the report and related records for one year. We keep them in restricted storage and delete them after that unless law enforcement asks us to keep them longer.

11. Your privacy rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and get a copy;
• correct it;
• delete it;
• limit our use of sensitive personal information;
• opt out of sale, sharing, targeted advertising or profiling (we do none of these); and
• appeal if we turn down your request.

We will not treat you differently for using these rights.

How to make a request. Email hello@leakvoid.com or use Account > Privacy. We will confirm that the request comes from you before we act, usually by asking you to log in. You may use an authorized agent; we will ask for proof that you gave them permission. We respond within 45 days. If we need more time, we will tell you why. If we deny your request, you can appeal by replying to our answer with the word "Appeal." We will answer your appeal within 60 days. If we deny your appeal, we will tell you how to contact your state attorney general.

California. If you live in California, you have the rights listed above under the California Consumer Privacy Act. In the past 12 months we collected these categories: identifiers; customer records (including your billing address); characteristics of protected classifications (age); commercial information (including your plan and payments, and how you heard about us if you tell us); internet or other electronic network activity (pages used in your dashboard, how you reached our site, such as campaign tags and the web address you arrive on, and, if you agree, analytics and session recordings on our public pages); and sensitive personal information (government ID if you use the document check, account login, and content about sex life). We collected them from you (including the web address you arrive on, and messages you send our Instagram account through Meta), our payment processors, your ID verification provider, platforms you link, public websites, and our analytics provider (if you agree), for the purposes in Section 3. We disclosed them to the service providers and recipients in Section 4. We use sensitive personal information only to provide the service you asked for, so we do not offer a "limit" link. We do not sell or share personal information.

Texas and other states with comprehensive privacy laws. If you live in Texas or another state with a similar law, we process sensitive data (such as data about sex life) only with your consent. We do not sell your sensitive personal data.

12. Where we process data

We store your account data in the United States. Some providers may process data elsewhere: Persona, our ID verification provider, is based in the United States and says it mainly uses data centers in the United States and Germany, so your ID check may be processed in Germany; and Stripe may process payment data outside the United States under its own privacy policy. LeakVoid is offered only to people who live in the United States, except Maine and Utah. If you visit our website from outside the United States, the information we collect about your visit is processed in the United States. The same applies to a "notify me" request (Section 2C).

13. Changes to this policy

If we make a material change, we will email you at least 30 days before it takes effect and post the new version here. We will ask for your consent if a change would let us use your information in a new way.

14. Contact us

Leak Void LLC 30 N Gould St, Ste R, Sheridan, WY 82801 Privacy questions and requests: hello@leakvoid.com