Privacy Policy

From reporters. When you file a report, we collect: a verified contact (email or phone, used for verification and never shown publicly), a public display name of your choice (which may be “Anonymous” or an alias), the report content you submit, and any evidence files you upload. We also store basic technical metadata (IP address, user agent, timestamps) for abuse prevention.

From people who claim a profile. If you claim an entity profile, we additionally collect: a business email or identity document, business registration details where applicable, and any rebuttal or counter-evidence content you submit.

From everyone else. Standard server logs (IP address, request path, user agent) and cookies essential to authentication. We do not run third-party advertising trackers on this site.

Reporter contact info is used for: identity verification (so we know you're a real person, not a bot), reaching you about moderation actions on your report, and responding to valid legal process as described in our DMCA / legal-request page. It is never sold and never shown on the public report page.

Public-facing content (the report body, the public display name, evidence you marked as publishable) is shown on the report page and on the entity profile page.

Server logs are used for rate limiting, abuse detection, and debugging. We do not build advertising profiles from them.

Active reports and their evidence are retained for the life of the platform. Removed reports are retained in a soft-deleted state internally for legal defensibility (audit log, repeat-offender pattern detection) but are not displayed publicly; see the methodology for the “Removed” status.

We may purge reporter contact info (not the report itself) after a defined period once the report is no longer subject to any open dispute or legal hold. The exact period will be set during legal review.

Anonymity to the public, not to the platform. Even if you display as “Anonymous” on the public report, we still hold your verified contact info. This is necessary for moderation, for responding to legal process, and for keeping the platform safe from serial abuse. It is not shared with the accused party under any circumstance except as compelled by a valid court order following our documented legal-request process.

Access and correction. You can request a copy of the personal data we hold about you, and request corrections to factual inaccuracies. Contact privacy@Lala LLC Report.example.

Deletion requests. If you ask us to delete your account, we will. The reports you filed remain on the platform (they belong to the public record, not to you), but we will detach them from your account record. Removal of a report itself follows the methodology, not an account-deletion request.

EU/UK residents. You may have additional rights under GDPR or local law, including the right to lodge a complaint with a supervisory authority. We will engage with those requests in good faith; the permanent-public-record nature of the platform does limit some erasure rights, which is one of the open questions flagged in PRD.md §9.

We rely on the following infrastructure providers. Each acts as a data processor on our behalf and is bound by a data-processing agreement:

• Supabase — Postgres database, authentication, and object storage (evidence files, private-by-default).
• Vercel — hosting and edge network for the Next.js application and API routes.
• Resend — transactional email (verification, notifications, moderator alerts) — to be added when transactional email is wired up.

We do not integrate third-party advertising, analytics, or social-tracking scripts on this site.

Privacy questions: privacy@Lala LLC Report.example. General contact on the contact page.