Privacy Policy

This Policy applies to all information collected through the Platform, including when you browse the site, submit a claim, upload evidence, use demand letter tools, file or respond to a dispute, communicate with us, or otherwise interact with any Platform feature or service.

This Policy does not apply to third-party websites, services, or applications linked from the Platform. We encourage you to review the privacy policies of any third-party services you access.

2.1 — Information You Provide

• Claim submissions: the Subject's name, business name, location, relationship type, incident date, claim amount, narrative description, and any supporting materials you upload.
• Claimant identity: your name and email address, collected at the time of claim submission for moderation and correspondence purposes.
• Dispute submissions: name, email address, stated reason for dispute, supporting statement, and any evidence uploaded by a party disputing a claim.
• Demand letter requests: name, contact details, and claim-related information entered into the demand letter generation tool.
• Communications: messages you send us via email, contact forms, or other channels.
• Payment information: where applicable, payment processing is handled by third-party processors. We receive only limited metadata such as transaction status, amount, and a tokenized payment reference — never raw card numbers.

2.2 — Information Collected Automatically

• Device and usage data: IP address, browser type, operating system, referring URL, pages viewed, timestamps, and interaction data collected via server logs and analytics tools.
• Cookies and session data: used for session management, security, and analytics (see Section 7).

2.3 — Information from Third Parties

• Infrastructure providers: our hosting, database, and automation infrastructure (including Cloudflare, HostGator, Supabase, and n8n) may generate logs and metadata as part of normal service operation.
• Public sources: we may review publicly available information when conducting moderation reviews or evaluating identity and fraud concerns related to a claim.

The core function of the Platform is the publication of approved claim profiles ("Deadbeat Pages") on dedicated public subdomains under didnotpay.me. Once published, a Deadbeat Page is publicly accessible on the internet and may be indexed by search engines including Google, Bing, and others.

Public content on a Deadbeat Page may include, depending on claim content submitted:

• The Subject's full name or business name;
• The Subject's city, state, or general location;
• The relationship type between Claimant and Subject;
• The incident date and claim amount;
• The Claimant's narrative description of events;
• Any evidence materials the Claimant has chosen to make public.

Claimants are solely responsible for the accuracy and legality of all submitted content. Content cached or republished by search engines or third parties after publication may persist beyond any removal action taken on the Platform.

If you believe a Deadbeat Page contains unlawful content, a privacy violation, or inaccurate information, contact us at [email protected] with the page URL and a description of your concern. Subjects of claims may also use the Platform's formal dispute process.

• Performance of a contract: processing necessary to provide the Platform services you request.
• Legitimate interests: operating, securing, and improving the Platform; preventing fraud and abuse; enforcing our Terms of Service.
• Legal obligation: processing required to comply with applicable law or respond to valid legal requests.
• Consent: where required for non-essential cookies or marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

We engage third-party service providers that process data on our behalf in connection with the operation of the Platform. Current infrastructure and service providers include:

We may also disclose information in the following circumstances:

• Legal process: where required by law, subpoena, court order, or lawful government request;
• Protection of rights: to protect the safety of users, third parties, or the integrity of the Platform;
• Business transfers: in connection with a merger, acquisition, asset sale, or reorganization, in which case information may be transferred as part of that transaction;
• With your authorization: where you have explicitly requested or directed us to share information.

The Platform uses cookies and similar technologies for the following purposes:

• Strictly necessary: session management, authentication state, CSRF protection, and core Platform functionality. These cannot be disabled without impairing the Platform.
• Analytics: aggregate usage data to understand Platform performance and user behavior. No personally identifiable profiles are built from analytics data alone.
• Preferences: storing display or locale preferences across visits.

You may control cookies through your browser settings. Disabling strictly necessary cookies will impair Platform functionality. We do not sell cookie data or use it for third-party behavioral advertising.

We retain information for as long as necessary to fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, enforce agreements, and maintain the integrity of the Platform.

• Active claims: retained for the duration of Platform operation and for a minimum of 24 months following any removal, consistent with the recovery fee survival period in our Terms of Service.
• Dispute records: retained for a minimum of 24 months following resolution.
• Claimant identity data: retained for a minimum of 24 months following claim closure or removal.
• Server and access logs: retained for up to 90 days in the ordinary course, or longer where required for security investigations or legal purposes.
• Email correspondence: retained for up to 3 years or as required by applicable law.

Published Deadbeat Pages, once indexed by search engines, may persist in search engine caches or third-party archives beyond any removal action taken on the Platform. We do not control third-party caching or archiving.

We implement reasonable administrative, technical, and physical safeguards to protect information against unauthorized access, disclosure, alteration, and destruction. Specific measures include:

• Encrypted data transmission via TLS/HTTPS across all Platform endpoints;
• Role-based access controls limiting data access to authorized personnel;
• OTP-based email verification for dispute submissions;
• Audit logging of moderator and system actions within the Platform;
• Service role key authentication for all database operations via Supabase.

No method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security and encourage users to take appropriate precautions, including using strong email passwords and reporting suspected unauthorized access promptly.

Depending on your jurisdiction, you may have the following rights with respect to personal data we hold about you:

• Access: request confirmation of whether we process your personal data and obtain a copy;
• Correction: request correction of inaccurate or incomplete data;
• Deletion: request deletion of your personal data, subject to legal retention obligations and the legitimate interests of third parties whose claims may be affected;
• Objection / restriction: object to or request restriction of certain processing activities;
• Portability: receive your data in a structured, machine-readable format where applicable.

To submit a rights request, email [email protected]. We may require verification of your identity before processing your request. We will respond within 30 days or the applicable statutory period.

The Platform is not directed to, and we do not knowingly collect personal data from, children under the age of 18. If you believe a minor has submitted information through the Platform, contact us at [email protected] and we will take appropriate action.

The Platform is operated by DidNotPayMe, LLC, organized under the laws of the Republic of Panama. If you access the Platform from outside Panama, your information may be transferred to, stored in, and processed in Panama, the United States, or other jurisdictions where our service providers operate. These jurisdictions may have data protection laws that differ from those in your country.

By using the Platform, you consent to such transfer, storage, and processing. Where required by applicable law, we will implement appropriate transfer mechanisms to ensure adequate protection of your information.

We may update this Policy from time to time. Updated versions will be posted to this page with a revised "Last Revised" date. Material changes that affect your rights or obligations will be communicated via notice on the Platform or by email where an address is on file. Your continued use of the Platform following any update constitutes acceptance of the revised Policy.

For privacy-related questions, access requests, or content removal inquiries:

• Entity: DidNotPayMe, LLC
• General privacy inquiries: [email protected]
• Legal notices: [email protected]
• Platform: didnotpay.me