Your Privacy Rights

Overview

Vassbrekke AS respects privacy rights worldwide. Depending on where you live, you may have the rights below. Most requests can be completed instantly in Settings; email us for anything else.

Right to access (know what we have)

You may request a copy of the personal information we hold about you. Signed-in users can download a complete portable export at any time:

• Settings → Privacy data export: JSON bundle with account data, devices, alerts, score history, DSAR letters, vault metadata, and encrypted vault files
• Or email privacy@privydeck.com with subject "Access request". We respond within 30–45 days

Open Settings

Right to delete

You may request deletion of your account and associated personal information:

• Settings → Delete account: type DELETE to confirm permanent erasure
• Or email privacy@privydeck.com with subject "Deletion request"

Deletion removes score history, devices, alerts, vault files on our servers, DSAR requests, push subscriptions, household membership, and cancels active subscriptions we manage through Stripe. This cannot be undone. Some records may remain for a short backup window or where law requires retention (for example tax records with our payment processor).

Right to correct (rectification)

Update your name and profile image through your sign-in provider (Google, GitHub, Apple, or email). For other corrections, contact privacy@privydeck.com.

Right to portability

Export your data in a structured, machine-readable JSON format via Settings → Privacy data export. Vault ciphertext is included so you can decrypt files locally with your passphrase.

Right to object, restrict, and withdraw consent

Where processing is based on legitimate interests, you may object. Where processing is based on consent (cloud AI tips via xAI, email digests, Web Push, breach checks, VPN IP storage), withdraw consent anytime in Settings → Privacy preferences without affecting prior lawful processing. You may also email privacy@privydeck.com.

Right to opt out of sale or sharing

We do not sell personal information and do not share it for cross-context behavioral advertising. See our Do Not Sell or Share page. We honor Global Privacy Control (GPC) browser signals.

Right to limit use of sensitive personal information (CPRA)

We do not ask for or collect sensitive categories (health, financial account numbers, etc.) directly. If you choose to store such files in your encrypted vault, we hold only ciphertext we cannot read, used solely for storage, never for advertising or profiling. To limit processing: do not upload those files, leave optional features off (defaults), or delete your account. Enable xAI coaching, digests, push, or breach checks in Settings → Privacy preferences only if you want them.

Non-discrimination notice

We will not discriminate against you for exercising your privacy rights. We will not deny service, charge different prices, provide a different quality of service, or suggest that you will receive different treatment because you exercised rights under CCPA, CPRA, or other applicable privacy laws. Paid plans charge for product features, not for declining sale or sharing of personal information (which we do not do).

United States state privacy rights

Residents of US states with comprehensive consumer privacy laws generally have rights to access, delete, correct, and opt out of sale, sharing, and/or targeted advertising, depending on the statute. Examples include:

• California (CCPA / CPRA): access, delete, correct, opt out of sale/sharing, limit sensitive PI, non-discrimination
• Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MTCDPA), Iowa, Delaware, New Jersey, New Hampshire, Maryland, Minnesota, Tennessee, Indiana, Kentucky, Rhode Island, and similar laws as they take effect
• We do not sell personal data or use it for targeted advertising; the Do Not Sell page and GPC cover opt-out formalities

Some states provide a right to appeal a denied request. If we deny a request, email privacy@privydeck.com with subject "Privacy appeal" and we will review within the period required by your state law.

Submit requests via Settings or privacy@privydeck.com. Opt-out page: Do Not Sell or Share My Personal Information.

European Union / UK / Switzerland / Norway (GDPR, UK GDPR, ePrivacy, FADP)

See our Privacy Policy for legal bases, retention, and subprocessors. Cookie details: Cookie Policy. Swiss residents have equivalent rights under the FADP.

You may lodge a complaint with a supervisory authority. As a controller established in Norway, the Norwegian Data Protection Authority (Datatilsynet) is relevant for us; you may also contact your local EU/EEA/UK authority.

Canada (PIPEDA)

Canadian residents may access personal information we hold, challenge its accuracy, and withdraw consent where processing is consent-based. Our privacy contact acts as privacy officer. Lodge complaints with us first at privacy@privydeck.com, then with the Office of the Privacy Commissioner of Canada if unresolved.

Brazil (LGPD)

Brazilian residents may request confirmation of processing, access, correction, anonymization or deletion, portability, and information about sharing, subject to LGPD. Contact privacy@privydeck.com.

Japan (APPI)

We specify purposes of use in our Privacy Policy. You may request disclosure, correction, suspension of use, or deletion. Cross-border transfers use appropriate safeguards with subprocessors.

South Korea (PIPA)

You may access, correct, delete, or suspend processing of personal information. Contact privacy@privydeck.com to exercise rights or withdraw consent for optional features such as xAI coaching.

Australia (Privacy Act)

We collect personal information only for stated purposes (see Privacy Policy). You may request access and correction. Complaints: contact us first; you may also contact the Office of the Australian Information Commissioner (OAIC).

Authorized agents

You may designate an authorized agent to submit requests on your behalf where your local law allows. We may require written proof of authorization and verify your identity directly.

Response times

• Self-service (export, delete, optional-feature opt-out): immediate in Settings
• Email requests: within 30 days (GDPR / most laws) or 45 days (CCPA/CPRA, extendable once)
• We may verify identity before fulfilling sensitive requests

Contact

Privacy requests: privacy@privydeck.com
Full policy: Privacy Policy