GDPR Rights

Last updated: February 5, 2026

If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with comparable data-protection laws, you have specific rights over your personal data. GlobalLeadSuite has made every one of these one click away.

1. Right of access (Art. 15)

You may request a copy of every piece of data associated with your account.

How: Settings → Data → Download my data → "Request export". A background job packages every collection under your user id into a single ZIP with a JSON per collection. When it's ready (usually under 30 seconds) you'll get an in-app notification and, if RESEND_API_KEY is configured, an email with the download link. The link is valid for 48 hours.

2. Right to rectification (Art. 16)

Most of your profile data (name, picture) is refreshed on each sign-in from your Google account. To update your username: PATCH /api/civilization/username. For anything else, contact support.

3. Right to erasure — "right to be forgotten" (Art. 17)

You may hard-delete your account at any time.

How: Settings → Data → Delete my account. A 3-step confirmation dialogue:

Tick "I understand this action is permanent and cannot be undone".
Type DELETE in the input field (case-sensitive).
Re-enter your account email.

On submit we:

Cancel any active Stripe subscription (best effort).
Cascade-delete every user-owned record across ~30 collections.
Preserve a deleted_users_audit record with a SHA-256 hash of your email (no reversible PII) for our own compliance trail.
Sign you out and redirect to the landing page.

There is no grace period. Deletion is instantaneous. If you change your mind, you must create a new account — we cannot recover the deleted one.

4. Right to data portability (Art. 20)

Your ZIP export is a machine-readable, structured format (JSON) suitable for importing into another provider. No proprietary blobs.

5. Right to restriction (Art. 18) and objection (Art. 21)

You can:

Set civilization_public: false to opt out of the public leaderboard and shareable profile.
Reject "Analytics" and "Marketing" cookie categories in the cookie banner.
Unsubscribe from marketing emails using the one-click link in every marketing message.

For anything more surgical (e.g. "stop processing my leads for X reason"), contact support.

6. Right to withdraw consent (Art. 7.3)

You can withdraw any consent (analytics, marketing, chat AI history) without affecting the lawfulness of processing that occurred before withdrawal. Contact support for withdrawal requests not exposed in the UI.

7. Right to complain (Art. 77)

You have the right to lodge a complaint with your local supervisory authority. In Italy this is the Garante per la Protezione dei Dati Personali (garanteprivacy.it). In the UK it is the ICO (ico.org.uk). We take DPA complaints seriously and will cooperate fully.

8. Contact

Data controller: GlobalLeadSuite (jurisdiction: placeholder — to be filled by operator). Data protection: privacy@globalleadsuite.example (placeholder — replace before commercial launch). Support: support@globalleadsuite.example

We respond to GDPR requests within 30 days as required by law. For most cases (export, delete) the answer is: use the UI, it's automated.