This Privacy Policy explains how Whiteout Privacy LLC (“Whiteout,” “we,” “us,” or “our”) collects, uses, shares, and protects information when you use our website and services (the “Service”). It also explains your rights and choices.
Whiteout is a content-removal service for adult victims of non-consensual intimate imagery. The information you share with us is among the most sensitive a person can share. We have written this policy to be specific about what we do with that information, why, and for how long — not generic.
If you have questions, contact us at privacy@getwhiteout.com.
This is not a substitute for the full policy below, but here is the short version.
Account information. Email address and authentication identifiers from our authentication provider.
Intake information. First name, country of residence, the type of content involved (real, AI-generated, or both), the platforms or URLs where content was found, your description of the situation, and the full legal name you provide as an electronic signature on the consent and authorization disclosure.
Imagery and references. Images you upload to identify yourself and the content to be removed. We process these client-side where possible and store derivatives (cropped reference images, perceptual hashes, and embeddings) along with the source files necessary to substantiate removal demands.
Identity verification information. When you complete identity verification, our identity verification provider processes your government-issued ID and a selfie. Whiteout receives only the verification result and limited demographic confirmation (such as name and date-of-birth match). We do not receive or store copies of your ID documents or your selfie. Our verification provider's own privacy practices govern its processing of those materials.
Payment information. Payment is processed by our payment processor. We receive a customer identifier, the last four digits of your card, and transaction metadata. We do not receive or store full card numbers.
Communications. Messages you send us via email, in-app messaging, or support channels, and any documents or evidence you attach.
Case data. Records of the surfaces (URLs) discovered, the filings we have prepared and submitted on your behalf, the status and outcome of each filing, deadlines, evidence packages, and resolution reports.
Derived signatures. Perceptual hashes, embeddings, and other mathematical representations of imagery, used to match content and (for Protection subscribers) to monitor for re-appearance over time.
Technical and usage information. Standard log information such as IP address, browser type, device information, pages visited, and timestamps, used to operate and secure the Service.
Search results. When we run discovery, we receive search results from third-party reverse-image and web-search providers that may include URLs, page snippets, and image metadata.
Platform responses. When we submit takedown demands, platforms may respond with confirmations, denials, request IDs, or follow-up questions. We retain these as part of the case record.
The imagery you submit may qualify as “sensitive personal information,” “special category data,” or similar designation under various state laws and other jurisdictions. We treat it accordingly:
We use the information described above only for the following purposes:
Performing the Service. Verifying eligibility and identity; running discovery; preparing and submitting removal demands, statutory notices, and deindex requests under your authorization; generating and delivering resolution reports; monitoring for content re-appearance if you subscribe to Protection.
Account and case management. Creating and securing your account, displaying your case status, sending case-related notifications, processing payments and subscriptions, and managing renewals and cancellations.
Customer support. Responding to questions, troubleshooting issues, and handling refund requests.
Service operation and improvement. Operating, securing, debugging, and improving the Service. Where we use case data to evaluate accuracy or performance, we do so on aggregated or de-identified records that do not identify you, and we do not use your imagery for these purposes.
Legal and safety. Complying with applicable law; responding to lawful requests from government authorities; enforcing our Terms; protecting against fraud or abuse; and, where required by law, fulfilling reporting obligations applicable to us (including under 18 U.S.C. § 2258A if minor-depicting content is identified in error — see Section 10 of the Terms).
We do not use your information for advertising, ad targeting, or profile-based marketing. We do not use your imagery, case data, or communications to train AI models.
Whiteout uses third-party AI text-processing services to assist with intake processing, generating notice language, evaluating discovery results, and preparing resolution reports. When AI is used:
We share information only with the categories of recipients listed below, and only as needed for the purposes described.
We use service providers to operate the Service. Each provider is bound by contract to handle your information only on our instructions, only for the purposes described in this policy, and to maintain reasonable security. We engage providers in the following categories:
A current list of named subprocessors is available on request by emailing privacy@getwhiteout.com. We update the list as our infrastructure evolves and impose materially equivalent contractual protections on any successor provider in a given category.
To perform removal, we submit takedown demands, statutory notices, and deindex requests to platforms (such as Instagram, TikTok, Reddit, Twitter, Snapchat, Discord, YouTube, Facebook), to Google and Bing, and where applicable to hosting providers, registrars, and CDNs. These submissions include the information required by the recipient's process, which typically includes your name (as the depicted person or rights holder), the URLs at issue, reference imagery or perceptual hashes sufficient to identify the content, and a sworn statement made on your behalf under the authority described in our Terms.
We submit only the minimum information required by each recipient's process.
We may disclose information when required by law, subpoena, court order, or other legal process; to comply with a legal obligation that applies to us (including under 18 U.S.C. § 2258A); to enforce our Terms; or to prevent fraud, harm, or abuse. We will challenge overbroad requests and notify affected users where lawfully permitted.
If Whiteout is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred. We will notify you and you will have a meaningful opportunity to delete your data before any transfer.
We do not “sell” personal information as that term is defined in California, Virginia, or other state privacy laws. We do not “share” personal information for cross-context behavioral advertising. We do not use sensitive personal information for any purpose other than performing the Service.
We retain different categories of information for different periods, calibrated to operational need and to minimize the time we hold the most sensitive material.
| Category | Retention |
|---|---|
| Reference imagery | Resolution-only customers: retained for the duration of active casework and deleted at case closeout (typically within 30 days of resolution), or earlier on request. Protection subscribers: retained for the duration of your active subscription to support ongoing re-appearance monitoring, and deleted when you cancel your subscription, delete your account, or request earlier deletion. |
| Perceptual hashes and embeddings | Retained as long as you have an active Protection subscription, or for up to 12 months after Resolution closeout for non-subscribers, to support re-appearance checks. Deleted on account deletion. |
| Identity verification result | Retained for the life of the account plus the period required to substantiate that the Service was provided to a verified adult. The underlying ID documents and selfie are processed by our identity verification provider and not retained by us. |
| Case records (intake metadata, surfaces, filings, resolution reports) | Retained as long as the account is active and for up to 7 years after closeout to substantiate the legitimacy of submissions and to respond to platform or legal inquiries. |
| Evidence packages | Retained for 12 months after case closeout in encrypted storage. Earlier deletion on request unless we have an active legal obligation to preserve. |
| Payment records | Retained as required by tax, accounting, and anti-fraud obligations (generally 7 years). |
| Communications | Retained as long as needed for support and audit purposes. |
| Account and authentication data | Retained until account deletion. |
| Logs and operational telemetry | Retained for up to 90 days. |
| Backups | Encrypted backups are retained on a rolling 60-day window. When you request deletion or your account is deleted, your data is removed from active systems immediately and from backup archives within 60 days. |
We may extend retention where required by law or for the limited purposes of responding to an active legal claim or regulatory inquiry. We will minimize what we retain in those circumstances.
You may request earlier deletion at any time, subject to limited exceptions described in Section 9.5.
We implement administrative, technical, and physical safeguards to protect your information, including:
No security program is perfect. If we discover a security incident that affects your personal information, we will notify you consistent with applicable law and our breach-notification obligations.
You may request a copy of the personal information we hold about you in a structured, machine-readable format.
You may request correction of inaccurate personal information.
You may request deletion of your personal information. On a verified deletion request, we will:
Some records — such as payment receipts required for tax purposes, or filings already sent to platforms — cannot be recalled or deleted from third-party systems we do not control.
You may withdraw consent and revoke the agency grant described in Section 4 of the Terms at any time by emailing privacy@getwhiteout.com. We will stop new submissions on your behalf. Revocation does not affect prior submissions.
We may decline a request if:
We will tell you the reason if we decline a request.
Email privacy@getwhiteout.com with the subject line “Privacy Request” and a description of your request. We may ask you to verify your identity. We will respond within the time required by applicable law (typically 45 days under most U.S. state laws, with one extension where allowed).
We will not retaliate against you for exercising any privacy right.
If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey, Tennessee, or another state with a comprehensive privacy law, you have specific rights under the law of your state. The rights described in Section 9 cover the substantive rights available under those laws.
California (CCPA/CPRA). Categories of personal information we collect, sources, purposes, and disclosures are described above. We treat the imagery you submit as “sensitive personal information” and use it only for the purposes described in this policy. You have the right to limit our use of sensitive personal information; our default operational use of imagery is limited to performing the Service, which is the only use for which it is collected. We do not sell or share personal information for cross-context behavioral advertising. You may submit a request through privacy@getwhiteout.com or through any “Do Not Sell or Share” or “Limit Use of Sensitive Personal Information” link we provide.
California “Shine the Light” (Civil Code § 1798.83). California residents may request information about personal information a business has disclosed to third parties for those third parties' own direct marketing purposes. Whiteout does not disclose personal information to any third party for that third party's direct marketing purposes. You may confirm this position in writing by emailing privacy@getwhiteout.com with the subject “Shine the Light Request.”
Authorized agents. You may designate an authorized agent to submit requests on your behalf. We will require written verification of the agent's authority and may require you to verify your identity directly.
Appeals. If we deny your request and you are a resident of a state that provides an appeal right, you may appeal by replying to our response with the subject “Privacy Appeal.”
The Service is offered only to U.S. residents. We do not knowingly accept information from individuals outside the United States, and the Service is not designed to comply with foreign data-protection regimes. Do not use the Service if you are not a U.S. resident.
The Service is intended only for adults 18 or older. We do not knowingly collect personal information from anyone under 18. We do not provide a removal service for imagery depicting any person under 18; see Section 10 of the Terms for what happens if such imagery is identified. If you believe a person under 18 has provided us with personal information, contact privacy@getwhiteout.com and we will delete it.
We use a limited set of cookies and similar technologies necessary to operate the Service (such as authentication and session management) and for privacy-respecting analytics. We do not use advertising cookies or cross-site tracking. We do not currently respond to “Do Not Track” browser signals because there is no consistent industry standard, but we honor the Global Privacy Control (GPC) signal where it applies under state law.
We may update this Privacy Policy. If we make material changes, we will notify you by email or in-product notice at least 30 days before the change takes effect, unless an earlier change is required by law. The “Last Updated” date at the top of the policy reflects the current version.
For privacy questions, requests, or concerns:
Whiteout Privacy LLC
30 N Gould St STE R Sheridan, WY 82801
Privacy: privacy@getwhiteout.com
Legal: legal@getwhiteout.com