Legal and trust
Data Rights Center
A practical GDPR and California rights matrix, plus one place to submit and track a request.
Effective 29 August 2026 / Version 1.0
Rights matrix
| Request | GDPR / UK GDPR | California | YouSaid workflow |
|---|---|---|---|
| Know or access | GDPR Art. 15 | CCPA/CPRA categories, sources, purposes, recipients, and specific pieces | Verify identity, search scoped systems, respond securely |
| Correct | GDPR Art. 16 | Correction of inaccurate personal information | Validate correction and propagate to active systems |
| Delete | GDPR Art. 17 | Deletion subject to statutory exceptions | Delete or de-identify across D1, Durable Objects, R2, Vectorize, and integrations |
| Portability | GDPR Art. 20 | Access in portable form where applicable | Provide structured JSON and attachment export |
| Restrict or object | GDPR Arts. 18 and 21 | Limit use of sensitive data where applicable | Apply processing hold or document overriding basis |
| Opt out | Consent withdrawal and direct marketing objection | Opt out of sale or sharing and targeted advertising | Honor request and browser Global Privacy Control |
| Appeal | Complaint to supervisory authority | Appeal under applicable state privacy laws | Independent review and written outcome |
Timing and verification
We acknowledge requests promptly. GDPR requests are normally completed within one month, with a lawful extension for complex requests. California requests are normally completed within 45 days, with a lawful extension where needed. We verify identity proportionately and never request more data than needed. Authorized agents must provide proof of authority.
No discrimination
You will not receive unlawful discriminatory treatment for exercising a privacy right. Some service features may require data that is necessary to provide them.