Privacy Policy

Version: 2026-10-16.1 Effective: 2026-10-16

The short version

• You stay in control. Little Collie Shepherd acts on your channel or site only under the moderation policy you approved and turned on. Shepherd never posts comments or replies, and you can revoke our access at any time, from your platform's own settings or from ours.
• We don't sell your data, we don't use advertising trackers, and we don't train AI models on your data. Our analytics are cookieless.
• The AI never learns who wrote a comment. We send comment text and context, never the commenter's name, ID, email address, or IP address, and our software refuses to send a request that carries them.
• We keep commenter records for 24 months so that a returning harasser is still recognised. Harassment comes back seasonally and around anniversaries; a shorter window would forget the person the product exists to stop. You can choose a shorter period for your workspace.
• Everyone gets the same rights, wherever they live: access, correction, export, and deletion.

The rest of this policy is the detail behind those five points.

This policy explains how Little Collie LLC ("Little Collie", "we") handles personal data when you use Little Collie Shepherd, our comment-moderation service (the "Service"). It covers two very different relationships, and it is honest about the difference:

1. Your data — account, billing, and usage data about you and your team, which we process as a controller. That is what most of this policy is about.
2. Your commenters' data — the comments and commenter details from the channels and sites you connect, which we process on your instructions as a processor. That relationship is governed by the Data Processing Agreement (DPA) between you and us; section 6 below summarises it in plain language.

1. Who we are

The provider of the Service is Little Collie LLC, a limited liability company formed in the State of Oregon, United States. Our address for correspondence and service is 7325 NE Imbrie Dr #513, Hillsboro, OR 97124, USA. Contact: [email protected].

2. What we collect about you

• Account data: your name (if given) and email address. There are no passwords: you sign in with a code we email you or with a passkey. For a code we store only a keyed hash of it (never the code itself), and it stops working once used or expired. If you add a passkey, we store its public key — this cannot be used to identify you elsewhere. If your account was created before we retired passwords on 30 September 2026, we still hold a hash of the password you set then (never the password itself); nothing reads it, and we will delete it.
• Workspace data: workspace name, team memberships and roles, the settings and moderation policies you configure, and the record of which Terms of Service version your workspace accepted and when.
• Connected-platform credentials: when you connect a YouTube channel or WordPress site, we store the access token that platform issues so Shepherd can act on your behalf. Tokens are encrypted at rest and are never included in an export. See section 10 for what we access on YouTube and how to revoke it.
• Billing data: your plan, subscription status, and payment state. Paid plans are sold through Link, Stripe's merchant of record service. Link is the seller of record for your payment and handles your card and payment details under its own privacy policy; Little Collie never sees or stores your full card number.
• Referral data: if you sign up with a referral code or share your own, we record which workspace referred which, the code used, when the referral was made and when it qualified, how many paid months it has counted, any reward credited, and the reason if a referral was voided.
• Email records: for each email we send you, we record the recipient, the subject, which kind of message it was, and whether it was delivered or bounced. We do not store the body of the messages we send.
• Usage and security data: sign-in events, action logs (who did what in the workspace), and technical logs needed to run and secure the Service, which include IP addresses and browser details of people signing in.

We do not buy data about you, and we do not use advertising trackers.

3. Why we process it (legal bases)

• To provide the Service — operating your workspace, moderating your connected sources on your instructions, support (contract, Art 6(1)(b) GDPR).
• To bill you (contract; legal obligation for tax/accounting records).
• To run the referral program — crediting referrals, issuing and reversing rewards, enforcing the program's limits, and investigating abuse of it (contract; legitimate interest in preventing referral fraud).
• To resolve billing disputes — where a payment is disputed or charged back, we provide the records of your account's sign-ins, activity, and the moderation the Service performed to Link and to your bank or card network, to show that the Service was delivered (legitimate interest in defending a claim; Art 6(1)(f)).
• To secure the Service — authentication, abuse prevention, audit logs (legitimate interest, Art 6(1)(f), in keeping the Service safe for all customers).
• To tell you things that matter — service, security, and billing notices (contract). Anything promotional is opt-in, and every non-essential email carries an unsubscribe link.

4. How long we keep it

Why commenter records are kept for 24 months. The person harmed by a short retention period is the creator whose returning abuser is no longer recognised. Harassment recurs seasonally and around content anniversaries, so a twelve-month period would forget exactly the record that identifies someone coming back in month thirteen. Twenty-four months covers a full annual cycle with a margin. You can choose a shorter period for your own workspace; you cannot choose a longer one.

Deleting your workspace

A workspace administrator can delete the workspace at any time from Settings → Account; no need to contact us. As soon as you request deletion, the workspace is paused: Shepherd stops reading from your sources and stops moderating. You then have 30 days to export your data or undo the deletion with one click — a protection for a creator deleting in the middle of a harassment wave. We email every administrator when the deletion is scheduled, seven days before it runs, and when it completes.

When the 30 days end, the deletion runs and is irreversible: any active subscription is cancelled, every stored platform token is revoked and deleted, every record the workspace owns is deleted, and we re-count to verify that nothing remains. Referral and billing records described above are kept with the link to your workspace removed. Residual copies in encrypted backups age out within 30 days after that. You can also revoke our access to your YouTube data at any time from Google's security settings (see section 10), which immediately stops Shepherd from reading or moderating your channel.

Requests from law enforcement

Sometimes it is an authority asking for data rather than a person asking about themselves.

We comply with valid legal process. Where we receive a subpoena, a court order or a warrant that is validly issued and properly served, we comply with it. We check first that a request is genuine, using contact details we establish independently rather than the ones printed on the request. We do not act on an informal request — an email, a phone call, or a letter asking us to "look into" an account or a commenter — because an informal request is not legal process. We disclose where we are required to, not where we are merely permitted to.

We tell you. Where we are legally permitted to, we notify the customer whose workspace a request concerns, before we produce anything, and with enough time for them to respond. Sometimes we will not be permitted to: a court order or statute may prohibit us from disclosing the request (a "gag" order), the request may be sealed, or an emergency involving a risk of death or serious physical injury may make prior notice impracticable. Where notice is prohibited we ask, where we can, for the prohibition to be time-limited, and we notify you once it lapses. If a request concerns one of your commenters rather than you, you are still the person we notify — you are the controller of that data, and how to respond to your own user is your decision.

You can ask. Any customer may ask us whether their own workspace has ever been the subject of a request, and we will answer honestly where we are legally permitted to.

What can be produced is bounded by what we hold. Section 4 above and section 6 below describe what we keep and for how long. Most commenter records are automatically redacted 24 months after they were last relevant and cannot be recovered afterwards; comments assessed as credible threats are kept for 6 years. We hold no full IP addresses for commenters, no browsing history, no location data, and no advertising or tracking profiles, because the Service does not collect them. And as section 6 explains, nothing held by our AI provider connects a comment to the person who wrote it.

Where to send a request. Requests must be in writing, addressed to Little Collie LLC at [email protected] or by post to 7325 NE Imbrie Dr #513, Hillsboro, OR 97124, USA. Please include the legal authority you are relying on, the specific data sought, the time period, and a contact we can verify you by independently.

Using your own data in a harassment or stalking complaint

If you are pursuing a matter of your own — harassment, stalking, or something similar — you do not need to ask us and you do not need legal process to get at your own workspace's records.

A workspace admin can export the workspace at any time from Settings → Account. The export is a JSON file containing the workspace's data, including comment text, commenter display names and platform identifiers, your allow, watch and deny list entries with any notes you wrote on them, and the moderation action log. It is a whole-workspace export rather than a file about one person, and only an admin can run it.

What it contains is bounded by the retention periods in this section. If a matter looks like it may become a complaint, export sooner rather than later — once a record has been redacted we cannot restore it for you.

5. Who else touches it

We do not sell, rent, or trade personal data. We use a small number of service providers (sub-processors) to run the Service. Each receives only what it needs for its function and is bound by contract to process data only on our instructions:

Two other parties handle your data as independent controllers under their own policies rather than as our sub-processors:

• Link (Stripe) — the merchant of record for paid plans, as described in section 2.
• Google LLC — YouTube and Google sign-in, for the channels you connect (see section 10).

We give notice before adding or changing a sub-processor, and this list is updated when one changes.

If the business changes hands. If Little Collie is involved in a merger, acquisition, reorganisation, or sale of assets, personal data may transfer as part of that transaction, and this policy continues to apply to it. We will tell you by email and with a notice on this page before your data becomes subject to a different privacy policy.

6. Your commenters' data — the plain-language version

When you connect a YouTube channel or WordPress site, Little Collie processes the comments on it — including commenter names, IDs, and comment text — on your behalf and on your instructions. In that processing you are the controller and Little Collie is the processor; the DPA between us governs it, including security, sub-processing, assistance with data-subject rights, and deletion. Ask us for the DPA at any time.

What we hold about a commenter. The comment text they wrote and a normalised form of it used for matching; their display name and the platform-issued identifier their platform assigns them (a YouTube channel id; for WordPress, a hashed form of their email address); the moderation record of what was decided, when, under which rule and why; any entry you have made about them on your own allow, watch or deny list, including notes you wrote; and counts of how many comments they have left and how many were removed. For WordPress comments only, we also hold the author's email address encrypted at rest, and their website URL.

Two minimisation facts that are properties of the software rather than promises about our conduct: a commenter's IP address is truncated to a /24 network at the moment it arrives, so we never store a full IP address for a commenter; and we hold no browsing history, no location data, no device fingerprints, and no advertising or tracking profiles, because the Service does not collect them.

Two design facts worth stating plainly, because they are what most people actually want to know about an automated moderation service.

What we send to classify a comment. Automated moderation sends the comment to an AI model operated by Anthropic PBC (United States). What we send is deliberately narrow: the comment text, the title and a short excerpt of the video or post it was left on, and — where the reply structure is available — the text of the comment it replies to. Optionally, and only if you have switched them on, a per-source "this content features people on camera" flag and a short, throwaway summary of recent activity on that source.

What we never send. We do not send the commenter's name, their channel or user id, their email address, their IP address, their avatar, or any score or reputation Little Collie has built up about them. The AI model is not told whose comment it is reading, and cannot be: our software refuses to send a request that carries any of those fields, and that refusal is a tested guarantee rather than a policy we ask our engineers to remember.

The provider is contractually barred from using anything we send to train its models, and we pin the exact model version we use so its behaviour cannot change underneath your moderation settings without us deciding to change it.

When a commenter asks us to delete their data. A commenter can ask you directly, or write to us at [email protected]. When they write to us, we first verify that they control the account the comment was posted from, using that platform — for example, by signing in with Google, or by confirming a link sent to the email address left with the comment. We never ask for an identity document. If the requester cannot show that they control the account, we do not act on the request and we tell them why.

Once a request is verified, we pass it to you as the controller and give you 14 days, counted from verification, to act on it or tell us why it should not be honoured — for example, because the comment is a credible threat, or is evidence you need for a possible legal claim. If we do not hear from you within 14 days, we erase that commenter's data from your workspace. Your moderation rules stay in place either way; only the personal details in them are removed. Requests for a copy of a commenter's data are verified the same way. We carry out this verification on your behalf, as part of the assistance with data-subject requests that the DPA describes.

Abusive comments are kept as evidence. Erasing a record is not a way to escape moderation. When a verified request covers comments that Shepherd classified as abusive — threats, dehumanising language, slurs, calls for harm against a group, sexual harassment, unwanted sexual advances, posting someone's personal information, or intimate-image abuse — we keep those comments, their classification, and the moderation decision, because they may be needed to establish or defend a legal claim and because protecting you and your audience from abuse outweighs the requester's interest in erasing them. We still erase the requester's display name, avatar, and any notes about them, and everything else about them that is not needed as evidence. You can ask us to keep other comments for the same reasons, or to erase ones we would otherwise keep. Either way, your moderation rules stay in place, so the account remains blocked or held exactly as before. We tell the requester which comments were kept, why, and that they may complain to a data-protection authority.

We keep a record of each request, our correspondence with the requester, and how we verified their account for 3 years, to show that we handled it properly. We disclose that record only as described in "Requests from law enforcement" in section 4.

7. International transfers

• Your data (account, billing, workspace) is processed where our infrastructure runs, which is the United States. Every request to the Service also passes through Cloudflare's network edge; a request from the EEA/UK is normally handled at a Cloudflare location in that region, but Cloudflare's aggregate traffic analytics are processed in the United States. Cloudflare is certified under the EU-U.S. Data Privacy Framework and its UK extension, and its data processing addendum incorporates the Standard Contractual Clauses for any leg those do not cover.

• Comment content and Anthropic (United States). The Service sends comment content to Anthropic PBC in the United States in two places, and nowhere else:

• Automated moderation. Every comment that reaches the AI classification stage is sent, as described in section 6 — comment and context text only, with no commenter identity attached.

• Rule Workshop. When a moderator in your workspace deliberately starts a Rule Workshop session (a human-initiated tool for drafting moderation rules), the comment examples that moderator chooses to work with are sent, to power the assistant in that session.

Both are covered by the DPA's transfer terms (see our international-transfers documentation; SCCs/DPF mechanics to be executed before launch). They are separate paths in our software with separate controls, and we describe them separately here because they are different in kind: the first is automatic and identity-free, the second happens only on a moderator's explicit action and carries whatever examples that moderator chose.

8. Your rights

The same rights for everyone, wherever you live. You can:

• Access and export your data. A workspace administrator can download the whole workspace at any time from Settings → Account.
• Correct your account details in your settings, or ask us to correct anything else.
• Delete your workspace yourself from Settings → Account (see section 4), or ask us to do it for you.
• Object to or restrict processing, and withdraw consent to anything you opted in to.
• Unsubscribe from any non-essential email with the link in the email itself.
• Revoke our access to a connected platform at any time (see section 10).

Depending on where you live, these rights are also guaranteed by law — for example the GDPR in the European Economic Area and the UK GDPR in the United Kingdom, and the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act, in California. We honour access, correction, deletion, and portability requests from every user regardless of location.

For California residents: we do not sell or share personal information, as the CCPA defines those terms, and we do not use or disclose sensitive personal information for any purpose that would give you a right to limit it. We will not treat you differently for exercising a privacy right. You may use an authorised agent to make a request on your behalf.

How to make a request. Write to [email protected] from the email address on your account; we verify a request against that address before acting on it. We answer within one month, or within the shorter deadline your local law sets. If you are in the EEA or the UK, you can also complain to your local data-protection supervisory authority.

For commenter data on a connected source, we support you in answering your commenters' requests, as the DPA describes and as section 6 sets out.

9. Cookies

We set only cookies that are necessary to run the Service (sign-in sessions and security), and none for advertising or cross-site tracking. The Cookie Policy lists every cookie by name, and the in-app consent control governs any optional category we may ever introduce — optional cookies stay off unless you turn them on.

We measure how the Service is used with Cloudflare Web Analytics, which is cookieless: it sets no cookie, writes nothing to your browser's storage, does not fingerprint your device, and does not retain your IP address. It tells us which pages are visited and roughly from where, in aggregate, and nothing about you individually. Because it stores nothing on your device it needs no consent under the ePrivacy rules, and we rely on our legitimate interest in understanding whether the Service works (section 3). If we ever replace it with something that does set a cookie, that cookie goes in the optional Analytics category and stays off until you turn it on.

10. Google and YouTube data

Little Collie Shepherd uses YouTube API Services to moderate the YouTube channels you connect. By connecting a YouTube channel, you agree to be bound by the YouTube Terms of Service, and Google's handling of your data is governed by the Google Privacy Policy.

What we access. With the permission you grant when you connect a channel, Shepherd reads your channel's basic details, your videos' titles and descriptions, and the comments on your videos, including those your channel's own settings hold for review. Shepherd changes a comment's moderation status when your approved moderation policy calls for it, or when you or someone you authorized decides in Review: it holds a comment for review so it is hidden until someone decides, removes a comment, or publishes one that was held. Shepherd never posts comments or replies, and never changes anything else on your channel.

How we use, store, and share it. We use this data only to provide the moderation features you have turned on, as described in sections 2, 4, and 6. Your channel's access token is stored encrypted. Comment text is shared with our AI provider only as section 6 describes, without the commenter's identity. We do not use YouTube data, or anything derived from it, to train generalised AI or machine-learning models, to build advertising profiles, or for any purpose other than providing the Service to you, and we never sell it. Our staff do not read your YouTube data except with your permission, to investigate a security incident or abuse, or where the law requires it.

Limited Use. Little Collie Shepherd's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access. You can disconnect a channel at any time from Settings → Sources, or revoke our access from Google's security settings at https://security.google.com/settings/security/permissions. Revoking stops Shepherd from reading or moderating your channel straight away. To have the data we already hold deleted as well, delete your workspace (section 4) or write to [email protected].

11. Security

All data is encrypted in transit (TLS) and at rest. The most sensitive fields — platform access tokens, commenter email addresses, and classifier reasoning — carry an additional layer of encryption with keys specific to your workspace. Each workspace's data is isolated from every other workspace's at the database level. Access to production systems is limited to authorised Little Collie staff, requires multi-factor authentication, and is audit-logged.

No method of storage or transmission is completely secure. If we become aware of a security breach affecting your personal data, we will notify you without undue delay, and notify regulators where the law requires it.

12. Children

The Service is not directed to children. Administrators, and anyone who pays, must be 18 or older. A workspace administrator may invite a moderator aged 13 to 17 if the administrator is the moderator's parent or legal guardian, or has their consent, and a parent may connect a channel that belongs to their child. For a moderator under 18 we collect only what any account needs: an email address, any passkey they add, and a record of what they do in the workspace. We do not knowingly collect personal data from anyone under 13, or under the higher minimum age for online services set by local law where one applies. If you believe a child under that age has given us personal data, contact [email protected] and we will delete it.

13. Changes

We version this policy. Material changes are announced by email and in-product before they take effect, and the version and effective date above always identify what you are reading.