Ask IH: Competitor stole my data. What should I do?

Update

The offending site is now offline. I filed several DMCA takedown notices with their service providers and have been in direct contact with the individuals involved, including finding their real-life identifies. They agreed to take down the offending site. I decided to mask their personal information in this post. I'm probably being too lenient in doing so but, even though they did something really stupid, I don't want to permanently mess up their employment prospects. That said, I have to confess to feelings of regret for being so lenient since they got off with less consequences than they deserve. The next time this happens, I'll be far better equipped to respond and I'll be much less likely to be lenient.

TL;DR

A competitor has blatantly stolen my data and started reselling it. Help me decide what to do about it.

Background

I first came across Ecomidata on Quora when I was thinking about building Store Leads. In February 2018, they claimed that Shopify had 330k live stores. At the time, Shopify had well over 700k live stores. I didn’t know where they were sourcing their data but the quality was clearly poor.

(Note: the Quora link is now dead. I sent a copyright infringement notice to Quora and they decided to ban the account and remove all content.)

I launched Store Leads in November 2019 and, shortly thereafter, the Ecomidata site went blank. They left a shell of a marketing site powered by Wordpress, complete with a “START FREE TRIAL” button that did nothing. The link for that button was simply “javascript:void()” which, to those less technical, means do nothing. Ecomidata stayed that way for about 7 months. I would occasionally check their site along with the sites of other competitors.

Then suddenly, in late June 2019, there were signs of life. They posted a message stating that the new Ecomidata would be launched on July 1st. They slipped that scheduled by a couple days, but launched their new site on Sunday July 6th. The new site offered free access to the top 1000 Shopify domains.

The Shock

Imagine my surprise when I created a free account on Ecomidata only to be greeted by an exact copy of Store Leads data.

How did it happen? Store Leads offers a feature that allows users to export data via CSV. Ecomidata has clearly just taken that CSV and started reselling it as if it was their own.

It should be clear to anybody who spends 5 minutes on each site that the data is identical. They list their domains in the exact same order as Store Leads and the data provided is identical. It should also be clear that I’ve spent a lot more time on user experience with a custom site built entirely from scratch. They’ve cobbled something together using a Wordpress template, fake user reviews, outsourced user management to memberful, etc. This is a clear hack job. They stole my most valuable asset (data) and are passing it off as their own.

The Culprits

Person of Interest #1: PERSON A (name redacted)
If you search for Ecomidata on Google, you’ll find that there are only 2 “people” promoting Ecomidata. One is an individual on Quora who goes by the name “**** *******”. He links to Ecomidata in several answers on Quora.

At first, he used terminology that suggested he was not connected to Ecomidata. In his early posts, he states that he “found” Ecomidata to be the best solution in the space. But after the site came back online after 7 months, he posted “Website is working fine” on the exact same day that they relaunched. Clearly this individual is running the site.

I strongly suspect that PERSONA A is an alias since I can’t find any other references to this person online. That, coupled with the fact that he misrepresented his affiliation with the site, seems to be a clear violation of Quora’s Real Name Policy.

Person of Interest #2: PERSON B
The second individual linked to Ecomidata is “** ****”, who reviewed the site on his blog. It’s quite possible that he is not directly affiliated with Ecomidata and that he just links to the site in exchange for affiliate revenue.

But this is where it gets interesting. On May 3rd 2019, when Ecomidata had already been offline for several months, PERSON B emails me asking if I have an affiliate program for Store Leads. He suggested a 40-50% revenue share, which is far too generous by industry standards. I suspected that he was connected to Ecomidata and, since their marketing site implied their would relaunch soon, I was wary. I never answered the email and it sunk to the bottom of my inbox.

But on June 24th, 2019, PERSON B becomes a paying user of Store Leads. Over the next 12 days, he uses his account to export data on 23 separate occasions. There was a flurry of exports done on July 6th, the exact same day that PERSON A announced that the new version of Ecomidata was live.

That’s a mighty big coincidence. But there’s more.

• Ecomidata’s terms of service state that they follow the local consumer laws in Australia. According to Stripe, the payment that PERSON B made to Store Leads came from a device in Australia.
• Ecomidata.com is a WordPress site hosted on lightningbase.com. And it just so happens that PERSON B' blog is also hosted on lightningbase.com (and he wrote a review of it)

To summarize, there are only 2 individuals that are linked to Ecomidata online. They have geographical, temporal and technological overlap. It’s hard not to assume that PERSON B is either working directly with PERSON A or is, in fact, the same person. PERSON B does not provide his full name and neither individual uses a real photo, which makes things even more suspicious.

What can I do?
My terms of service forbid reselling the data but these are clearly people that don’t care about respecting terms of service.

The stolen data is a mix of public facts (e.g., urls, company names) and derived data (e.g., estimated monthly app spend, industry categories). The derived data is based on algorithms (that I wrote) which take public facts as inputs.

I don’t think the public facts can be copyrighted but I suspect there’s something I can do to protect the derived data. As a next step, I intend to determine if the algorithms can be patented (though, in general, I’m not a huge fan of patents) and if the derived data can be protected. If so, then I suspect that I can send them a DMCA takedown.

But that sounds like a lot of effort, and could be costly if I engage a lawyer. I’d much rather spend the time and energy on my product.

What should I do?
It’s not clear to me exactly how to proceed and I’d love your advice. Here are some options:

• Lawyer up and go the DMCA route. With a DMCA takedown order, I could approach their hosting company and their registrar and have their site taken offline. I suspect this will be expensive and slow, leaving them to profit from their theft in the meantime.
• Downvote all Quora answers linking to Ecomidata along with a link to this post. Quora seems to be their primary marketing channel. They are ranked highly on a few influential posts. I could also approach Quora support with my complaint but I suspect they’d need a DMCA takedown order to act.
• Reach out directly to the individuals involved with a link to this post. My concern is that this will just cause them to start covering their tracks.
• Inject incorrect data into future CSV exports done by PERSON B so that, if they don’t notice, their site is full of embarrassingly wrong content.

I would love to hear from anyone who has experience in this area or has been through a similar experience. It’s gut wrenching to pour your heart and soul into a product only to have it stolen by unscrupulous people.