Last updated: 2026-10-24
1. Who is responsible for your data
The controller is Miguel Garcia, an individual based in Portugal, trading as Copyspot. Copyspot is the name of the service; it is not a company or any other registered legal entity. Contact: contact@getcopyspot.com. We reply within one month (see section 7). We have not appointed a data protection officer.
2. What we collect from you, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Your email address, the link to the alleged copy, the link to your original work, the platform | To answer your request and prepare and send your kit | Article 6(1)(b): steps you ask for and providing the free service |
| Your name, only if your notice needs it (we may ask for it later by email) | To fill in the template | Article 6(1)(b) |
| Your declarations (ownership, exceptions, responsibility) | To provide the kit and to keep a record that you gave them | Article 6(1)(b) to provide the kit. After that, we keep only your signed declaration under Article 6(1)(f), our legitimate interest in being able to establish or defend legal claims if a seller disputes the case. |
| Your answer to "Would you pay for a kit like this? If so, how much, and why?" (optional; in the form, or by replying to us by email after you get the kit) | To learn whether the kit is worth building | Article 6(1)(f): our legitimate interest in knowing whether the kit is worth building. We do not use it for marketing. Leaving it blank does not affect your kit. |
You must give your email and the links, otherwise we cannot prepare the kit. The survey question is optional.
The pilot is free: we do not collect payment or card details.
We do not use your email to send you newsletters, news or offers.
We do not make decisions about you based solely on automated processing, and we do not profile you.
3. Seller data (information under Article 14 GDPR)
To prepare your kit, we may process information about the seller of the alleged copy. Where the seller is an individual, this is personal data.
- What: only the listing URL, screenshots of the listing and of the shop page as published, the shop name and the platform.
- Source: the artist who asked for the kit, and the public listing on the platform.
- Purpose: to document the alleged copy in the artist's kit, so the artist can decide whether to report it.
- Legal basis: Article 6(1)(f), the legitimate interest of the artist and of Copyspot in protecting the artist's copyright and preparing the exercise of a legal right. We documented a balancing test: the data is already public, the use is limited to the kit, and the impact is low.
- What we do not do: we do not look for the seller's address, social media, real identity or any data outside the platform. We do not combine cases about different sellers into profiles. We do not send anything to the seller or to the platform.
- Retention: the same as the kit (section 6); the screenshots are then deleted.
- Your rights as a seller: you can ask us for access or object to this processing using the contact in section 1. While a case is active, the interest in defending a copyright may prevail over an objection.
We publish this section instead of informing each seller individually, because individual notice would be disproportionate and would defeat the purpose of the request (Article 14(5)(b) GDPR).
4. Who receives your data
- Tally (form tool), Tally BV, Ghent, Belgium, processes form answers as our processor under its data processing agreement. Tally stores form data in Europe. Tally uses sub-processors (for example for hosting); its current list is at https://tally.so/help/gdpr. We have switched off Tally's email notifications, AI assistant and file uploads for this form.
- Zoho Mail (email service), with our account in Zoho's EU data centre, stores our emails as our processor under Zoho's data processing addendum. This includes the emails you send us, any survey answer you send by email, and the email with your kit attached.
- We prepare your kit on our own computer and send it to you as a PDF attached to an email. It is not shared by link and is not stored in a cloud drive.
- We do not sell your data or share it with sellers or platforms.
- When you submit your notice: the kit and the notice are yours. When you submit the notice to a platform, your details (name, contact) go to that platform and, often, to the seller. That is processing by you and by the platform, not by Copyspot.
5. Transfers outside the EEA
Tally stores form answers in Europe. Under Tally's data processing agreement, any transfer outside the EEA to a country without an EU adequacy decision is covered by the EU standard contractual clauses (Decision (EU) 2021/914) or another lawful mechanism.
Zoho stores our emails in its EU data centre. Zoho says that, in rare cases, staff of its group company in India may access the data to give technical support, under the EU standard contractual clauses, without the data being moved out of the EU.
You can ask us for more detail using the contact in section 1.
6. How long we keep data
- Form answers in Tally: deleted once your request is moved to the kit, and at the latest after 30 days. Deletions leave Tally's backups within 90 days.
- Your kit, the screenshots and our correspondence (on our computer and in our mailbox): 12 months after delivery, for questions or repeats of the same case; then deleted or anonymised. Survey answers sent by email follow the survey rule below.
- Your signed declaration only (with its date, your email and the case reference): 3 years after we deliver your kit, as evidence if a seller disputes the case. It is stored separately from the rest. The rest of the kit is deleted after 12 months.
- Declined requests, or requests with no follow-up: 30 days.
- Answers to the survey question, in the form or by email: linked to your email only until the end of the pilot. We then keep only aggregated, anonymised results. If you answered by email, we delete that email at the end of the pilot, unless it also contains other correspondence about your kit, which we keep for 12 months as above without using your survey answer again.
- At the end of the pilot we review everything and delete what we no longer need under this section.
7. Your rights
You can ask us for access, correction, deletion, restriction or portability of your data, and you can object at any time to processing based on our legitimate interest (including the survey question and seller data). Write to contact@getcopyspot.com. We reply within one month. This can be extended by two further months for complex requests, and we will tell you if so.
You can also complain to a supervisory authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD), https://www.cnpd.pt. You can also complain to the authority of the country where you live or work.
8. Security
Our email and form accounts are protected with two-factor authentication. Kits are kept in an encrypted folder on our own computer, not in a cloud drive, and third-party add-ons have no access to them. Each kit is sent only to you.
9. If you live in the UK
You have the same rights described in section 7. You can also complain to the UK Information Commissioner's Office (https://ico.org.uk).
10. Changes
We will publish any change to this notice here, with a new date.