Privacy Rights Request

Summary

Clothoff AI is a static review site with no accounts, no uploads, and no image processing, so the personal information it can hold about a visitor is limited to server logs, pseudonymous Google Analytics data, and emails you have sent. This page explains which rights apply, how to send a request, how identity is checked, and how fast we answer. It is informational, not legal advice; the data inventory itself is in the Privacy Policy.

• Channel: privacy@clothoff.ai. As a business that operates exclusively online, the site may offer email as the request method under Cal. Civ. Code §1798.130(a)(1)(A).
• Deadlines: confirmation within 10 business days, answer within 45 calendar days (CCPA); answer within 1 month (GDPR).
• Cost: free.
• Opt-out of sale or sharing: also available instantly through Global Privacy Control, see Do Not Sell or Share My Personal Information.

Your Rights

The table maps each right to its legal source and to what it means on this site. US rights are stated for the CCPA/CPRA; comprehensive laws in 18 other states grant similar rights, and we apply the same procedure to every visitor regardless of residence.

The California Attorney General summarizes the core right: “You have the right to request that businesses disclose what personal information they have collected, used, shared, or sold about you, and why” (California Attorney General, CCPA). Under the CCPA, disclosures cover the 12 months preceding your request; you may ask for information beyond 12 months for data collected on or after January 1, 2022, unless that proves impossible or disproportionate (§1798.130(a)(2)(B)). Our retention periods are shorter than 12 months for everything except correspondence, so the lookback rarely matters.

How to Submit a Request

Send an email to privacy@clothoff.ai, or use the pre-filled button below, which opens your email client with a template. There is no web form because the site has no server-side code that could receive one; email keeps the request under your control and gives you a timestamped copy. Include the items in the table. Missing items delay a request but do not invalidate it — we will ask for what is needed.

Send request

Do not attach photos or identity documents. The site never processes images, and identity documents are neither needed nor wanted; the California Privacy Protection Agency’s regulations require businesses to avoid collecting new personal information for verification where the request can be verified with data already held (CCPA Regulations §7060, cppa.ca.gov).

Verification and Authorized Agents

The CCPA lets a business “require authentication of the consumer that is reasonable in light of the nature of the personal information requested, but shall not require the consumer to create an account” (§1798.130(a)(2)(A)). Because the site holds so little, verification is proportionate and simple:

1. Correspondence. A request sent from the same email address as the correspondence is treated as verified. A request about another address gets a confirmation email to that address.
2. Analytics data. The _ga cookie value you provide is matched against the Google Analytics client ID. Nobody else can plausibly know that value, so no further proof is asked.
3. Server logs. Log lines contain only an IP address and user-agent; we can search them for an IP address you provide but cannot confirm that an address belonged to you. Where verification is impossible, we say so and delete the logs on schedule instead.

Authorized agents may submit requests to know, delete, or correct. Under CCPA Regulations §7063 we may require “proof that the consumer gave the agent signed permission” and may ask you to verify your identity or confirm the authorization directly with us. Requests to opt out of sale or sharing need no verification at all and may be sent by an agent or via a browser signal (§1798.135(c)).

Response Times and Appeals

CCPA/CPRA. We confirm receipt within 10 business days (CCPA Regulations §7021(a)) and respond within 45 calendar days of receiving a verifiable request; where reasonably necessary, that period may be extended once by a further 45 days with notice to you (§1798.130(a)(2)(A)). Opt-out requests are completed within 15 business days (Regulations §7026). If we do not act on a request, we tell you the reasons “without delay and at the latest within the time period permitted of response,” together with any right to appeal (§1798.145). You may make two free requests to know in any 12-month period.

GDPR and UK GDPR. Requests from EU, EEA, or UK residents are answered “without undue delay and in any event within one month of receipt of the request,” extendable by two further months where necessary given the complexity and number of requests (Regulation (EU) 2016/679, Article 12(3)). The ICO’s guidance mirrors this for the UK (ICO, A guide to subject access). If we refuse, we state the reasons and your right to complain to a supervisory authority (Article 77) or seek a judicial remedy.

Appeal. Reply to our decision with “Appeal” in the subject line. A different member of the editorial team reviews the case and answers within 45 days, explaining the outcome and, if it stands, how to complain to the California Privacy Protection Agency, the California Attorney General, your state’s attorney general, or your EU or UK supervisory authority. Several state laws — Virginia, Colorado, Connecticut, and others — require such an appeal route; we offer it to everyone.

Related Pages and Contact

What is collected and for how long: Privacy Policy. Cookie names and how to block them: Cookie Policy. Instant opt-out and Global Privacy Control: Do Not Sell or Share My Personal Information. Reports of non-consensual imagery involving a reviewed tool follow a separate, faster path: NCII report. General inquiries: Contact. Rules for the tools we review — your own photos or those of consenting adults 18+ only: Responsible AI.