Privacy and Data Requests

1. Rights that may apply

• Access personal data and information about processing.
• Correct inaccurate data and complete incomplete data.
• Delete data subject to lawful exceptions.
• Restrict or object to processing and withdraw consent prospectively.
• Receive portable data where applicable.
• Opt out of sale, sharing, targeted advertising or eligible profiling and limit qualifying sensitive-data uses.
• Appeal a denied request and complain to a privacy regulator or attorney general.

2. How to submit

Use available account controls or email [email protected] with the subject 'Privacy Request'. State the right requested, account email, country and state of residence and enough detail to locate the data. Do not send passwords, full card numbers or unnecessary identity documents.

3. Identity verification

We verify proportionately using account access, email confirmation, transaction references or information already held. We ask only for information reasonably necessary to prevent disclosure, deletion or alteration of another person's data.

4. Authorised agents

An authorised agent must provide reliable proof of authority. We may verify the agent and directly confirm the instruction with the user unless law provides otherwise. An agent request does not require the user to disclose an account password.

5. Timing, fees and extensions

We respond within the period required by applicable law. EU/UK privacy-rights requests are normally answered within one month, subject to lawful extensions. Where California law applies, we normally confirm receipt of requests to know, delete or correct within 10 business days and provide a substantive response within 45 calendar days, with notice of any lawful extension. Requests are normally free; manifestly unfounded, excessive or repetitive requests may be refused or charged only where law allows.

6. Deletion scope and exceptions

Deletion removes or de-identifies active profile, sessions, uploads and generated media through the account-deletion process. Limited transaction, consent, fraud, security, complaint and legal records may remain where necessary or permitted. Independent controllers such as Creem handle their own records and requests.

7. Appeals and complaints

A denial or limitation states the main reason and any appeal route available under applicable law. Send an appeal or data-protection complaint to [email protected] with the original request reference and supporting information. For UK data-protection complaints, we provide an electronic channel, acknowledge receipt within 30 days, investigate appropriately, keep the complainant informed where needed and communicate the outcome without undue delay. You may also contact the supervisory authority, California Privacy Protection Agency, attorney general or other regulator responsible for your location.

8. No sale and regional contacts

We do not sell personal data or share it for cross-context behavioural advertising and do not unlawfully discriminate for exercising rights. The controller's contact details are on the Contact Support page. Any legally required EEA or UK representative details will be published there after verified appointment.