Privacy Rights & Data Request Policy
How to exercise access/correction/deletion/export/withdrawal/opt-out/complaint across all 23+ jurisdictions. Operative endpoints: POST /api/privacy/access|delete|correct|export|withdraw-consent|marketing-optout|complaint + POST /api/privacy/request, via /privacy-center (there is no public GET-by-id status endpoint; references are returned at submit time and status is tracked by the privacy team).
Draft for legal review
This document is an implementation draft written to match how the product actually behaves. It has not been reviewed by a qualified lawyer and must not be relied on as legal advice. Items marked or are unresolved.
1. Request types and channels
Access (what we hold + purposes/recipients/retention), correction (fix inaccurate/incomplete), deletion (erase + vendor propagation per deletion job), export (JSON + CSV/ZIP + originals, generated date/expiry/security/limits documented), withdraw-consent (purpose-specific, future processing stops), marketing-optout (channel-specific suppression, immediate), complaint (to us + regulator path). Channels: /privacy-center #request (PrivacyRequestForm), privacy@zdefence.com, /api/privacy/request. No account required; authorised agents accepted with permission + proof.
2. Identity verification (minimum necessary)
Email-ownership check for waitlist/auth requests; session binding where signed in. No government ID for ordinary requests; additional proof only where the law requires it or fraud is suspected, and deleted after verification. Never expose another user's data; never over-collect. Error messages are privacy-preserving (no 'User ID 99382 does not exist in California table').
3. Jurisdiction determination, rights mapping and workflow
Resolve jurisdiction (resolver hints + explicit selection, never discriminatory blocking); determine applicable rights + timelines (Section 18 of Privacy Policy: EU/UK 1 month, India 90 days, California 45 days, Canada 30, Brazil 15 for confirmation, NZ 20 working days, Mexico 20+15 working days, Philippines 15, etc.); discover data (primary + vendors via deletion_targets); apply legal exceptions (consent proof, legal hold, conflicting rights, trade secrets) with explanation + appeal; complete + respond + audit (privacy_requests → privacy_request_events → audit_events; vendor waits tracked as waiting_vendor).
4. Timelines, fees and appeals
We meet the strictest applicable deadline for your region. Fees only where the law permits (manifestly unfounded/excessive; Mexico first request/12m free). Denials cite the specific exception + basis + appeal to us and to your regulator (/legal/legal-contact). Non-discrimination for exercising rights.
5. Version
Version 0.9.0-draft, last updated 2026-10-02, LEGAL REVIEW REQUIRED. Backend: src/lib/compliance/privacy-handler.ts + /api/privacy/* + Supabase privacy_requests/privacy_request_events/data_export_jobs/deletion_* tables.
Sources
This document is derived from the following entries in our legal source registry: EU-GDPR, US-CA-CCPA, IN-DPDP, BR-LGPD, MX-LFPDPPP, PH-DPA, TH-PDPA. See for the full citations and the date each source was last verified.