1. Who we are and how to reach us
This website and the Reddit removal service offered through it are operated by Joe Loya ("we", "us", "our"). For the purposes of data protection law, we are the controller of the personal data described in this policy.
Privacy questions and requests: privacy@joeloya.com. Legal notices: legal@joeloya.com. If you want to send us a Reddit URL or ask about a case, please use the case form on this site so your request is recorded against your reference number.
Our postal address is available on request to privacy@joeloya.com.
2. What this policy covers
This policy applies to personal data we collect through this website (joeloya.com), through the case and contact forms, through the client portal, and in emails and messages between you and us. It does not cover other websites that we link to, including Reddit, which have their own policies.
In short: we use your information to assess your case, talk to you about it, carry out the work, invoice you after removal, and keep the site secure. We share it only where that is needed to do those things or where the law requires it.
3. The personal data we collect
When you submit a case or use the contact form
- The Reddit link or links you want us to look at, and the service you select.
- Your name and email address. Your phone number and your company or brand, if you choose to give them.
- Anything you write in the message box.
- Technical information sent with the form: your IP address and the time of submission.
As a safeguard, a copy of each submission is also written to a private file on our server, so that nothing is lost if our database or email is unavailable. It is treated and deleted like the case record.
Email verification
We confirm that you own the email address before a case is recorded. We email you a six-digit one-time code. The code is stored only as a scrambled (hashed) value and expires after 15 minutes. While you are entering the code, your submission is held temporarily and is removed when it is confirmed, when it expires, or after too many wrong attempts.
The client portal
- Your email address, and the one-time codes used to sign you in (hashed, valid for 15 minutes).
- A device sign-in record: a random token (we keep only a hashed copy), the IP address and browser details of the device, and the dates you signed in and last used it.
- The messages you send us, the Reddit links you add, and the files you upload (images and PDF documents).
- Your case record: status, updates, our replies, invoices and payment status.
Emails and messages
If you write to us or reply to one of our emails, we keep the message and attach it to your case record so that everyone working on your case sees the same history.
Payments
When we invoice you, we record the amount, what it is for, the invoice number and whether it has been paid. We do not collect or store payment card numbers or bank log-in details. You pay through a payment link provided by a third-party payment provider, or by bank transfer, and that provider handles your payment details under its own privacy policy.
Information about other people
Reddit content you ask us to review often names or describes other people, for example the person who posted it or people mentioned in it. It may include usernames, public posts, screenshots and, sometimes, personal details. We handle that information only as far as needed to assess and pursue your request.
Website use and security
Like most websites, our server records technical information about requests: IP address, date and time, the page requested and browser details. We also keep short-lived counters, based on IP address or email address, that limit how many forms, codes or sign-in attempts can be made in an hour. These protect the site and our clients from abuse.
What we do not collect
- We do not use advertising, tracking or analytics cookies or scripts.
- We do not ask for special categories of personal data, such as health information, and we ask you not to send them unless your case genuinely requires it.
- We do not ask for your Reddit password, and you should never send it to us.
4. How and why we use your data
We use personal data only for the purposes below. Where data protection law requires a legal basis, we rely on the one shown.
- To assess your case, reply to you, agree a quote and carry out the work you ask for. Legal basis: performing a contract with you, or taking steps at your request before a contract.
- To verify your email address, sign you in to the client portal and keep the site, the portal and your case secure. Legal basis: our legitimate interest in protecting our clients, our systems and the integrity of our service.
- To send you messages about your case: confirmations, updates, invoices and receipts. These are service messages, not marketing. Legal basis: performing our contract with you.
- To invoice you, record payments and meet tax, accounting and other legal obligations. Legal basis: legal obligation, and performing our contract.
- To establish, exercise or defend legal claims, and to resolve complaints or disputes. Legal basis: our legitimate interest, and legal obligation where it applies.
- To respond to privacy requests and to keep records that show we have done so. Legal basis: legal obligation.
We do not use your case details in marketing. Client reviews and testimonials on this site are published only with the client's permission.
We do not make decisions about you by automated means that have a legal or similarly significant effect, and we do not build profiles of visitors.
5. Who we share it with
We do not sell personal data. We do not share personal data for cross-context behavioural advertising. We share it only in the following situations.
- Reddit and community moderators. Pursuing a removal request means sending Reddit, a subreddit's moderators or another decision maker the information they need to review it. We limit what we send to what the request requires.
- Service providers that host or deliver our systems: our web hosting provider, and the email service that sends and receives our messages. They process data on our behalf and only for those purposes.
- Payment providers that you choose to pay through. They act for themselves under their own privacy policies.
- Professional advisers, such as lawyers and accountants, where needed, under a duty of confidentiality.
- Courts, regulators, law enforcement and other authorities, where the law requires it or where we need to protect rights, safety or property.
- A successor to the business, if the business or its assets are transferred, who would be bound by this policy.
6. Transfers outside your country
Our providers may store or process data in the United States, the European Economic Area, the United Kingdom or other countries. Reddit, Inc. is based in the United States. Where personal data is transferred from the UK or the European Economic Area to a country without an adequacy decision, we use appropriate safeguards such as standard contractual clauses where they are required.
7. How long we keep it
We keep personal data for as long as we need it for the purposes above, and then delete or anonymise it. Typical periods:
- Case records, messages and uploaded files: for the life of the case and typically up to three years after it closes, so that we can answer follow-up questions and defend or bring legal claims.
- Invoices and payment records: for as long as tax and accounting law requires, which is often up to seven years.
- Email verification codes and held submissions: 15 minutes.
- Portal device sign-in records: up to 12 months after the device was last used, or until you sign out.
- Abuse-prevention counters and server logs: short periods, generally no more than a few weeks.
- Cases that never start, such as unanswered enquiries: typically deleted within 12 months.
We may keep information for longer where the law requires it, where a legal claim or complaint is pending, or where you have asked us to keep it. You can ask us to delete your data sooner, subject to these exceptions.
8. How we protect it
- The whole site uses HTTPS (encrypted connections).
- One-time sign-in codes and device tokens are stored only as hashed values.
- Files you upload are stored outside the public web folder, checked by content type, given random names and served only to you and to our team through an authorised request.
- The client portal shows each client only their own cases. Staff access is limited to people who need it and requires a password.
- Forms are protected against forgery and abuse, and sign-in attempts are rate limited.
No system is completely secure. If a personal data breach affects you and the law requires us to tell you, we will do so without undue delay.
9. Your rights
Depending on where you live, you may have some or all of the following rights over your personal data. You can exercise any of them by emailing privacy@joeloya.com.
- Access: to be told whether we hold your data and to receive a copy.
- Correction: to have inaccurate or incomplete data put right.
- Deletion: to ask us to delete your data, where we have no legal reason to keep it.
- Restriction and objection: to ask us to limit how we use your data, or to object to uses based on legitimate interests.
- Portability: to receive data you gave us in a commonly used format, where the law provides for it.
- Withdrawing consent: where we rely on your consent, you can withdraw it at any time.
- Not to be discriminated against for using your privacy rights.
We may need to confirm your identity before acting on a request, and we will not release your data to someone who has not proven they are you or your authorised agent. We will normally respond within one month (or the period your local law sets), and we will tell you if we need more time or cannot fully act on a request, and why.
If you are in the UK or the European Economic Area and are not satisfied with our response, you can complain to your data protection supervisory authority. We would like the chance to put things right first, so please contact us.
10. Privacy notice for residents of the United States
This section supplements the rest of this policy for residents of California and other US states whose laws give specific privacy rights.
- Categories we collect: identifiers such as name, email address, phone number and IP address; commercial information such as the services you request and invoices; internet activity such as pages requested and sign-in records; and the content of messages and files you send us.
- Why we collect them: for the purposes set out in "How and why we use your data".
- Who we disclose them to: the recipients listed in "Who we share it with", for business purposes.
- We do not sell personal information and we do not share it for cross-context behavioural advertising. We have not done so in the past 12 months.
- We do not knowingly collect sensitive personal information as defined by state law, and we use the limited identifiers we hold only to provide the service.
You may ask us to tell you what personal information we hold about you, to delete it, or to correct it, and you may appoint an authorised agent to do so. Write to privacy@joeloya.com. We will verify your identity and respond within the time your state's law requires, which is usually 45 days. We will not treat you differently for making a request.
11. If you appear in someone else's case
Because our work concerns Reddit content, you may be named in a case that another person has brought to us, for example as the person who posted something. If you believe we hold personal data about you in that way and you want to ask about it, write to privacy@joeloya.com. We will consider your request under this policy, and we will balance it against the rights of our client and the need to handle any legal matter properly.
12. Children
Our service is for adults. It is not directed at anyone under 18 and we do not knowingly collect personal data from children. If you believe a child has sent us personal data, tell us and we will delete it.
13. Emails we send you
We send email that you need in order to use the service: verification codes, sign-in codes, confirmations, replies, updates, invoices and receipts. We do not send marketing newsletters, and we do not add you to a mailing list.
14. Cookies
We use only a small number of essential cookies, for example to protect our forms and to keep a client signed in to the portal on a device they choose. There are no advertising or analytics cookies. The details are in our Cookie Policy.
15. Links to other sites
This site links to other websites, including Reddit, government sources and court records. We are not responsible for their content or privacy practices.
16. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top shows when it last changed. If a change is significant, we will say so on the site or tell you by email if you have an open case.
17. Contact
Privacy questions and requests: privacy@joeloya.com. Legal notices: legal@joeloya.com.