How it worksFor agenciesSecurityPricingContactLoginGet started →

Legal · Privacy

Privacy
policy.

Last updated: October 9, 2026

Medusa is operated by Medein LLC, a Pennsylvania domestic limited liability company (Pennsylvania entity number 15413224, initially filed April 28, 2026). In this policy, “Medusa,” “we,” and “us” mean Medein LLC. This policy covers the Medusa website at mymedusa.org and the Medusa dashboards and services.

What we collect

  • Account information: name, email address, and sign-in credentials and settings (including two-factor settings), and, if you use an organization account, your organization membership and role. Some accounts also carry a school name or an organization display name.
  • Reference photos you upload, and liveness frames captured when you verify your identity.
  • Biometric identifiers derived from those images: a numeric face embedding (“faceprint”) generated from reference photos, liveness frames, and from faces detected in images we discover. See also our biometric consent disclosure.
  • Images and page information found by our discovery and search processes: image files, their source page URLs, perceptual hashes, similarity scores, and the model version used to compute them.
  • Your decisions and takedown records: which matches you marked unauthorized, the signed authorization and statement you agreed to, notices sent, recipient responses, and evidence PDFs.
  • Billing information: a Stripe customer record, subscription, and invoice data. Card details are handled by Stripe; we do not store full card numbers.
  • Technical and security data: session records (including IP address and user agent), audit records of requests to our API, and error reports. Audit records are designed to exclude request bodies, cookies, authorization headers, and query strings.
  • Messages you send to us at our contact addresses.

How we use it

  • To provide the service: verify your identity, match your likeness against images we find, and show you possible matches.
  • To prepare and send takedown notices and platform reports, but only after you review and authorize them.
  • To run billing, send transactional email (such as sign-in links, alerts, and reports), and provide support.
  • To secure and operate the service, prevent abuse, debug problems, and meet legal obligations.

How discovery works

Medusa looks for images and pages that may use your likeness or name without permission. Based on our code and configuration, discovery uses an operator-curated list of target sites that our crawlers visit, and search-engine API queries (we use Serper, a Google search results API) built from subject names. We may also use proxy services for some requests. We plan to expand discovery with AI-assisted interpretation of web pages and forms. Before introducing new processing of personal or biometric data, we will update the applicable disclosures and obtain any required consent. You review the match and authorize the takedown before it is filed.

Who we share data with

We do not sell your personal information or biometric data. We share data as follows:

  • Recipients of takedown notices you authorize: websites, hosting providers, and platforms. Notices and evidence PDFs can include your name, contact details, the matched image, and your reference image or excerpts, as needed to support the claim.
  • Service providers that help us run Medusa, including payment processing (Stripe), email delivery, cloud and object storage and compute infrastructure, search (Serper), proxy services, and error monitoring. These providers handle data to support those purposes.
  • Authorities or other parties when required by law or to protect rights and safety.
  • A successor, if Medusa’s business is reorganized or transferred.

Biometric data

We treat face embeddings, reference photos, and liveness frames as sensitive. Our dashboard asks you to acknowledge the biometric disclosure, and the service requires that acknowledgement before it captures liveness frames. When you delete your account, our system purges stored reference photo files, thumbnails, liveness frames, and faceprint vectors for that account; related metadata records may be kept, marked deleted, for audit and dispute handling. Evidence already sent in takedown notices cannot be recalled from recipients. The biometric consent page has the full disclosure.

Retention

We keep account and biometric data while your account is active and delete the biometric items described above when you delete your account. API audit records are pruned on a scheduled basis. Other retention periods, including for takedown records, evidence, and backups, are being finalized and will be stated here.

Cookies and analytics

Our dashboards use cookies to keep you signed in. We do not run third-party advertising trackers on this marketing site. Error reports from our services go to our own error-monitoring instance.

Your choices

  • Update your profile and settings in your dashboard.
  • Delete your account from the dashboard, which triggers the biometric purge described above.
  • Email privacy@mymedusa.org to ask about access, correction, or deletion, or to raise a concern. Rights available to you depend on where you live, and we will respond as the law requires.

Security

We use technical and organizational measures intended to protect your data. No system is completely secure, and we cannot guarantee absolute security. To report a vulnerability, email security@mymedusa.org.

Children

Medusa is not directed to children under 13, and we do not knowingly collect their data without appropriate authorization.

Changes

We will update this page when our practices change and revise the date above. We will not use biometric data in ways materially different from the disclosure you acknowledged without asking you again.

Contact

Medein LLC, Centre County, Pennsylvania. Privacy: privacy@mymedusa.org. General: hello@mymedusa.org. Copyright: dmca@mymedusa.org. See also our Terms of Service.