Privacy Policy

The controller for the processing described here is RM ECOM, sole proprietorship of Emile Moureau, 18 rue Goubet, 75019 Paris, France, contactable at emiledevcontact@gmail.com.

We are not required to appoint a Data Protection Officer and have not appointed one. The address above is the single point of contact for every request described in section 12; there is no separate privacy desk to be redirected to.

It covers the website, the web application, the account system, the reverse search itself, the social video downloader and the transactional emails we send you. It does not cover the third-party sites a search result links to: following a result takes you to a service we have no relationship with.

We do not sell personal data, we do not share it with data brokers, and we do not use it to build advertising profiles.

Each time you accept the Terms - at sign-up and again before every paid order - we store the version you were shown, the exact wording of the clauses displayed, a cryptographic hash of that wording, the date and time, the page you were on, the interface language, the truncated IP and hash from 3.3, the country and the user-agent.

This is deliberate and we would rather say so plainly than bury it: the purpose is to be able to prove, later, what you were told before you paid. It is the same record that protects you, because it also proves what we committed to. It is processed on the basis of our legitimate interest in establishing and defending legal claims, and it is one of the few categories we keep after you close your account (see section 10).

For the content you submit, we act as your processor: we process it on your instructions, to deliver the search you asked for. You are the controller of any personal data contained in it, including the faces, voices, locations and identifying details of anyone appearing in a video you did not create.

That is not a technicality we use to shift blame; it follows from the fact that you, not us, decide whose image gets searched and why. It means you are responsible for having a lawful basis for that processing, and for the consequences of using the results.

You must not use the service to identify, locate, monitor or expose a person against their interests. Uploading intimate images without the consent of the person depicted, or content involving minors, is prohibited outright, will be reported where the law requires it, and will get the account terminated. Section 12 of the Terms lists the prohibited uses in full.

We use the following service providers. Each receives only what it needs for its function, and none is authorised to use it for its own purposes.

We will also disclose data where a competent authority makes a valid legal demand, and to our advisers where necessary to establish or defend a legal claim. If the business is ever sold or transferred, account data may pass to the acquirer, who would remain bound by this policy.

Most of the providers above are established in the United States, so your data is transferred there. Those transfers rest on the European Commission's Standard Contractual Clauses, on the EU-US Data Privacy Framework where the provider is certified under it, or on the fact that the transfer is necessary to perform the contract you asked us to perform.

We will not pretend this is risk-free. US law gives US authorities powers over data held by US companies that EU law does not. If that is unacceptable for a particular video, the remedy is not to upload it - a reverse image search cannot be run without sending the image to the engines that hold the indexes.

• Account data: for as long as the account exists, then deleted or anonymised within 30 days of closure.
• Searches, frames and results: for as long as the account exists, or until you delete them. Deleting a search removes it and its frames from our storage; it cannot remove anything a search engine retained.
• Downloaded media: until you delete it, or until the account closes.
• Credit ledger and consent records: five years from the event, matching the general limitation period for a civil claim in France. Kept even after an account closes - a record proving what a former customer agreed to is worthless if it disappears with the account it concerns.
• Invoices and accounting records: ten years, as required by the French Commercial Code.
• Access events (truncated IP, hash, country, user-agent): thirteen months, the ceiling the CNIL applies to connection logs.
• Emails you send us: three years from our last exchange.

Passwords are stored only as bcrypt hashes and are never recoverable. Traffic runs over TLS. Access to the production database and to the object storage is restricted to the operator of the service. Card data never touches our servers. IP addresses are truncated and hashed before storage rather than kept in full.

No system is perfectly secure, and we would rather not claim otherwise. If a breach occurs that is likely to result in a risk to your rights, we will notify the CNIL within 72 hours and inform you where the law requires it.

Under the GDPR you may ask us to:

• confirm what we hold about you and give you a copy (access);
• correct anything inaccurate (rectification);
• delete your data (erasure), subject to the records we are legally obliged to keep;
• restrict or object to a processing based on our legitimate interest, including the consent and access records described in sections 3.3 and 5;
• receive your account data in a portable, machine-readable form;
• give directions on what should happen to your data after your death.

Write to emiledevcontact@gmail.com. We answer within one month, extendable by two months for a complex request, and we will tell you if we extend. We may ask for proof of identity where a request is not obviously coming from the account holder - it is the only way to stop an impersonator obtaining your data.

If our answer does not satisfy you, you may lodge a complaint with the French data protection authority: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at cnil.fr.

We use no advertising cookies, no analytics cookies and no third-party trackers. There is nothing here to consent to, which is why you are not shown a banner. The cookies the site sets are:

• access_token, access_token_expiration, refresh_token, refresh_token_expiration - keep you signed in. Strictly necessary; deleting them signs you out.
• rvs_ref - remembers the affiliate code you arrived with, so the affiliate is credited. Strictly necessary to perform our contract with the affiliate.
• NEXT_LOCALE, where set - remembers your interface language.

Your browser also stores some of your work locally (a draft search and its history). That never leaves your device unless you save the search to your account.

We take no decision producing legal effects about you by automated means alone. The search results and the optional location guess are outputs of statistical systems, presented as leads for you to evaluate; they are not judgements about a person, they are frequently wrong, and nothing on this site should be treated as an identification. Section 4 of the Terms says the same at greater length.

The service is not intended for anyone under 15, and accounts must be created by an adult. We do not knowingly collect data from children. If you believe a child has created an account, tell us and we will delete it.

We may update this policy. The date at the top always reflects the version in force. Where a change materially affects how we use data you have already given us, we will tell you by email before it takes effect.

Any question about this policy, and any request under section 12: emiledevcontact@gmail.com.