Privacy Rights & "Delete My Data" Procedure

Last Updated: May 20, 2026

1. Who Can Use This Form

Axion Algo's services and mailing lists are offered only to adults aged 18 or older. If you are under 18 you must not exercise these rights yourself; ask a parent or legal guardian to do so on your behalf.

This page applies to data subjects globally. Whether you reside in the European Economic Area, the United Kingdom, the United States, Brazil, Canada, Australia, Singapore, Japan, South Korea, South Africa, or any other jurisdiction, you may submit a privacy rights request to Axion Algo and we will process it under the strictest applicable framework. Where a particular right is granted by your local law but not under another, we apply your local law standard to your specific request.

2. Your Statutory Privacy Rights

Depending on where you live and how we process your personal information, you may exercise some or all of the rights listed below. We comply with the EU/UK GDPR, ePrivacy/PECR, California CCPA/CPRA, Canada CASL, and similar laws worldwide.

Rights include, but are not limited to:

• Right to be informed – know why and how we process your data, which categories we collect, and from which sources.
• Right of access – ask for a copy of the data we hold about you.
• Right to rectification – correct inaccurate or incomplete data.
• Right to erasure ("delete my data") – request permanent deletion of personal data we no longer need.
• Right to restrict processing – have us limit use of your data in specific circumstances.
• Right to object / opt-out – stop marketing e-mails at any time and object to processing based on legitimate interest.
• Right to data portability – receive your data in a common, machine-readable format.
• Right to withdraw consent – revoke any consent previously given; this does not affect processing carried out before withdrawal.
• Do-not-sell / do-not-share (CCPA/CPRA) – Axion Algo does not sell or broker personal information, but you may formally opt out to reinforce this choice.
• Right to non-discrimination – we will never deny services, charge different prices, or provide a lesser experience because you exercised a privacy right.
• Right to limit use of sensitive personal information (CPRA) – instruct us to limit any non-essential use or disclosure of sensitive data categories.
• Right to opt-out of cross-context behavioural advertising – stop the cross-site profiling of your activity for targeted ads.
• Right to appeal – contest a denial of any of the above without cost and within statutory deadlines.

3. Request Types Available

Choose any one or more of the following request types when you contact us. You may combine multiple requests in a single message.

• Access — confirmation we process your data plus a copy.
• Correction — fix inaccurate or outdated fields.
• Deletion — erase personal data per legal grounds.
• Portability — export of your data in JSON, CSV or PDF.
• Restriction — pause processing pending a dispute.
• Objection — stop processing based on legitimate interest.
• Opt-out of sale or sharing — under CCPA/CPRA.
• Opt-out of cross-context behavioural advertising.
• Limit use of sensitive personal information — CPRA § 1798.121.
• Withdraw consent — revoke any consent given previously.
• Right to know specific pieces vs categories — choose level of detail.
• Appeal of a denial — see Section 18.

4. Submission Channels

You may submit a privacy rights request via any of the following channels. All channels receive equal treatment and are routed to the same internal queue.

• E-mail (preferred): our contact form — fastest acknowledgement; please include the subject line “Privacy Rights Request – [Your Full Name]”.
• Authenticated in-app submission: while logged in, navigate to Settings → Privacy → Submit Request. The session itself is treated as proof of identity for low and medium-risk requests (see Section 13).
• Web form: a public-facing web form is available at axion-algo.com/privacy-rights-request (this page) and will be expanded with a structured submission widget; for now, please use e-mail.
• Postal mail: requests in writing may be sent to our designated postal address, available on request via the privacy mailbox. Please include the e-mail associated with your account so we can route the request internally.
• Authorised agent: agents may submit on a consumer's behalf — see Section 8 for verification requirements.

5. Authenticated Request Submission via Logged-In Session

The fastest path to exercise your rights is from inside your Axion Algo account. Log in, then navigate to Settings → Privacy → Submit Request, choose the right(s) you wish to exercise, and confirm. Because we already authenticated you via your session cookie, MFA token and recent activity signals, we treat low-risk and medium-risk requests submitted this way as identity-verified and skip additional verification steps. High-risk requests (see Section 13) still require an additional verification factor.

6. How to Submit a Request by E-mail

We use a simple e-mail workflow—no account portal required.

1. Send an e-mail to our contact form with the subject line:
   Privacy Rights Request – [Your Full Name].
2. Copy/paste the template below into the body of your message and fill in every applicable field.
3. Send the e-mail from the same address that is linked to your Axion Algo account. (If you no longer control that address, explain why and supply verifiable proof of identity.)

Privacy Rights Request Template (Generic)

7. Per-State U.S. Privacy Request Templates

If you reside in a U.S. state with a comprehensive privacy statute (California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, New Jersey, Delaware, New Hampshire, Kentucky, Maryland, Minnesota, Rhode Island and others as they come into force) use the template below, substituting the statute that applies to your state.

U.S. State Privacy Rights Request — Copy & Paste

To: our contact form
Subject: U.S. State Privacy Rights Request — [Your Full Name]

== CONSUMER IDENTIFICATION ==
Full legal name:               ____________________________
Date of birth (mm/dd/yyyy):    ____________________________
State of residence (U.S.):     ____________________________
Mailing address (street):      ____________________________
City, ZIP:                     ____________________________
E-mail on file with Axion:     ____________________________
Phone number (optional):       ____________________________
Axion Algo account ID / user:  ____________________________
TradingView username:          ____________________________

== STATUTE INVOKED (check one) ==
☐ California — CCPA / CPRA (Cal. Civ. Code §§ 1798.100-1798.199.100)
☐ Virginia   — VCDPA (Va. Code § 59.1-575 et seq.)
☐ Colorado   — CPA   (Colo. Rev. Stat. § 6-1-1301 et seq.)
☐ Connecticut— CTDPA (Conn. Gen. Stat. § 42-515 et seq.)
☐ Utah       — UCPA  (Utah Code § 13-61-101 et seq.)
☐ Texas      — TDPSA (Tex. Bus. & Com. Code Ch. 541)
☐ Oregon     — OCPA
☐ Montana    — MCDPA
☐ Iowa       — ICDPA
☐ Tennessee  — TIPA
☐ Indiana    — INCDPA
☐ New Jersey — NJDPA
☐ Delaware   — DPDPA
☐ New Hampshire — NHDPA
☐ Kentucky   — KCDPA
☐ Maryland   — MODPA
☐ Minnesota  — MCDPA
☐ Rhode Island — RIDTPPA
☐ Other (specify):              ____________________________

== SPECIFIC RIGHT(S) EXERCISED (check all that apply) ==
☐ Right to know — categories of personal information collected
☐ Right to know — specific pieces of personal information collected
☐ Right to know — sources, business purposes, recipients
☐ Right to access / portability (machine-readable copy)
☐ Right to delete (specify scope below)
☐ Right to correct inaccurate personal information
☐ Right to opt-out of sale of personal information
☐ Right to opt-out of sharing for cross-context behavioural advertising
☐ Right to opt-out of profiling that produces legal or similarly
   significant effects (where applicable)
☐ Right to limit use and disclosure of sensitive personal information
   (CPRA Cal. Civ. Code § 1798.121)
☐ Right to non-discrimination
☐ Right to appeal a previous denial (cite denial reference if any)

Scope / details (free text):
______________________________________________________________
______________________________________________________________
______________________________________________________________

== IDENTITY VERIFICATION INFORMATION ==
(supply at least TWO matching data points)
☐ E-mail on file:              ____________________________
☐ Last 4 digits of payment card used: __ __ __ __
☐ Date of last login (approx): ____________________________
☐ Invoice number / order ID:   ____________________________
☐ Subscription start date:     ____________________________
☐ Other (specify):             ____________________________

== AUTHORISED AGENT (if applicable) ==
Are you submitting through an authorised agent?  ☐ Yes  ☐ No
If yes, attach: (a) written authorisation OR notarised power
of attorney AND (b) proof of agent identity.

== DECLARATION (REQUIRED) ==
I declare under penalty of perjury under the laws of the State
indicated above that the information provided in this request
is true and correct, that I am the consumer (or duly authorised
agent of the consumer) whose personal information is the subject
of this request, and that I am at least 18 years of age.

Signed:  ______________________________________________
Printed name: _________________________________________
Date:    ______________________________________________

California-specific note: under Cal. Civ. Code §§ 1798.130(a)(2) and 1798.140 we must respond within 45 calendar days with a single 45-day extension permitted when reasonably necessary, on prior notice to you. We provide access information for the 12-month period preceding the request, or longer where you specifically request it and we have retained the data.

8. Per-Country Request Templates

The templates below are tailored to specific legal regimes outside the United States. Use the template that matches your country of residence; if you are unsure, the EU/UK GDPR template is the most protective and acceptable in most jurisdictions.

EU / UK — GDPR Data Subject Access Request (DSAR)

To: our contact form
Subject: GDPR Data Subject Request — [Your Full Name]

Dear Axion Algo Data Protection Team,

Pursuant to Articles 15–22 of Regulation (EU) 2016/679 (GDPR)
and, where applicable, the UK GDPR and Data Protection Act 2018,
I hereby exercise the following right(s):

☐ Article 15 — Right of access (copy of all personal data)
☐ Article 16 — Right to rectification
☐ Article 17 — Right to erasure ("right to be forgotten")
☐ Article 18 — Right to restriction of processing
☐ Article 20 — Right to data portability (machine-readable)
☐ Article 21 — Right to object (incl. direct marketing)
☐ Article 22 — Right not to be subject to automated decision-making
☐ Withdrawal of consent (Art. 7(3))

== DATA SUBJECT INFORMATION ==
Full legal name:           ____________________________
Country of residence:      ____________________________
E-mail on file:            ____________________________
Account identifier:        ____________________________
Date range requested
(if access/portability):   from __________ to __________

== PROOF OF IDENTITY ==
(attach scanned ID with non-essential fields redacted; we will
delete the document within 30 days of verification)

== DELIVERY PREFERENCE ==
☐ Encrypted ZIP (default)
☐ JSON       ☐ CSV       ☐ Human-readable PDF summary

I understand that you will respond within one calendar month
(extendable by two further months for complex requests under
Art. 12(3) GDPR) and that I have the right to lodge a complaint
with my national supervisory authority if I am dissatisfied.

Signature:  ____________________________
Date:       ____________________________

Brazil — LGPD ARCO Request (Lei Geral de Proteção de Dados)

Para: our contact form
Assunto: Solicitação LGPD — [Seu Nome Completo]

Prezada Equipe de Proteção de Dados da Axion Algo,

Nos termos da Lei nº 13.709/2018 (Lei Geral de Proteção de Dados
Pessoais — LGPD), notadamente o art. 18, venho exercer os
seguintes direitos:

☐ Confirmação da existência de tratamento (art. 18, I)
☐ Acesso aos dados (art. 18, II)
☐ Correção de dados incompletos, inexatos ou desatualizados (III)
☐ Anonimização, bloqueio ou eliminação de dados desnecessários (IV)
☐ Portabilidade dos dados (art. 18, V)
☐ Eliminação dos dados tratados com consentimento (art. 18, VI)
☐ Informação sobre entidades com as quais foram compartilhados (VII)
☐ Informação sobre a possibilidade de não fornecer consentimento (VIII)
☐ Revogação do consentimento (art. 18, IX, e art. 8º, §5º)

== IDENTIFICAÇÃO DO TITULAR ==
Nome completo:             ____________________________
CPF (opcional):            ____________________________
País / Estado:             ____________________________
E-mail vinculado à conta:  ____________________________
Identificador da conta:    ____________________________

== DECLARAÇÃO ==
Declaro, sob as penas da lei, ser o titular dos dados pessoais
indicados acima ou seu representante legal, e que as informações
prestadas são verdadeiras.

Assinatura: ____________________________
Data:       ____________________________

Em caso de descumprimento poderei apresentar reclamação à
Autoridade Nacional de Proteção de Dados (ANPD).

Australia — Australian Privacy Principles (APP) Request

To: our contact form
Subject: APP Privacy Request — [Your Full Name]

To the Axion Algo Privacy Officer,

Under the Privacy Act 1988 (Cth) and the Australian Privacy
Principles (APPs), I request the following:

☐ APP 12 — Access to my personal information
☐ APP 13 — Correction of my personal information
☐ APP 7  — Opt-out of direct marketing
☐ Erasure / deletion of my personal information
☐ Confirmation of cross-border disclosures (APP 8)
☐ Withdrawal of consent for any processing

== INDIVIDUAL DETAILS ==
Full name:                 ____________________________
State of residence:        ____________________________
E-mail on file:            ____________________________
Account identifier:        ____________________________

Description of the personal information sought / corrected /
deleted:
______________________________________________________________
______________________________________________________________

I understand that, where access is provided, you may charge a
reasonable cost-recovery fee (APP 12.8) but will not charge for
making the request itself. I may complain to the Office of the
Australian Information Commissioner (OAIC) if I am dissatisfied.

Signed: ____________________________
Date:   ____________________________

Canada — PIPEDA Access Request

To: our contact form
Subject: PIPEDA Access Request — [Your Full Name]

Dear Axion Algo Privacy Officer,

Pursuant to the Personal Information Protection and Electronic
Documents Act (PIPEDA), S.C. 2000, c. 5 (and, where applicable,
provincial statutes such as Quebec Law 25, Alberta PIPA, British
Columbia PIPA), I make the following request:

☐ Access to my personal information (PIPEDA Principle 9)
☐ Information about how my data is used and disclosed
☐ List of third parties to whom my data has been disclosed
☐ Correction of inaccurate personal information
☐ Withdrawal of consent (note: may end my service if essential)
☐ Deletion / de-indexing where supported by Quebec Law 25

== INDIVIDUAL ==
Full name:                 ____________________________
Province / Territory:      ____________________________
E-mail on file:            ____________________________
Account identifier:        ____________________________

I expect a response within 30 days as required by PIPEDA s. 8(3).
If you require an extension under s. 8(4) please notify me with
reasons. I may complain to the Office of the Privacy Commissioner
of Canada (OPC) if dissatisfied.

Signed: ____________________________
Date:   ____________________________

Singapore — PDPA Request

To: our contact form
Subject: PDPA Request — [Your Full Name]

Dear Axion Algo Data Protection Officer,

Pursuant to the Personal Data Protection Act 2012 (PDPA) of
Singapore, I hereby exercise the following right(s):

☐ Access request (s. 21 PDPA) — provide a copy of my personal
   data and details about how it has been used / disclosed in
   the 12 months preceding this request.
☐ Correction request (s. 22 PDPA) — correct an error or
   omission in my personal data.
☐ Withdrawal of consent (s. 16 PDPA).
☐ Right to data portability (s. 26H PDPA, once in force).
☐ Cease use / disclosure of my personal data.

== INDIVIDUAL ==
Full name:                 ____________________________
NRIC/FIN (optional, last 3 digits): ___
Singapore residency:       ____________________________
E-mail on file:            ____________________________
Account identifier:        ____________________________

Description of data sought / corrected / withdrawn:
______________________________________________________________

I understand you may charge a reasonable fee for access (s. 28
PDPA) and will inform me of the fee before processing. I may
escalate to the Personal Data Protection Commission (PDPC) if
dissatisfied.

Signed: ____________________________
Date:   ____________________________

9. Identity Verification — Tiered Methods

To protect your data we must verify each request. We apply a proportionate, tiered approach: the higher the privacy or fraud risk of the request, the stronger the verification required.

Tier 1 — Low-Risk Requests

Applies to: category-level “right to know” requests, opt-out of sale/share, opt-out of marketing, opt-out of cross-context behavioural advertising, withdrawal of marketing consent.

• Verification: matching e-mail on file plus confirmation click on a one-time link we e-mail you.
• Turnaround: usually completed within 24 hours.

Tier 2 — Medium-Risk Requests

Applies to: deletion, portability, restriction, correction, specific-piece access (single record), objection to processing.

• Verification: matching e-mail + one-time 2-factor code (delivered by e-mail or authenticator) + last four digits of the payment method on file or last invoice number.
• For account holders, an authenticated session counts as the e-mail + 2FA combination.
• Turnaround: usually completed within 7 business days.

Tier 3 — High-Risk Requests

Applies to: specific-piece access for large data sets, sensitive personal information, requests where the supplied identifiers do not match our records, requests from an alternative e-mail address, or any request raising fraud-risk signals.

• Verification: government-issued photo ID upload (passport, driver's licence, national ID) with non-essential fields redacted, plus a signed sworn statement under penalty of perjury.
• ID copies are stored in encrypted, access-restricted storage and deleted within 30 days of completing verification.
• We may also place a brief outbound call to a verified phone number on file or require a video-call identification session in cases of suspected impersonation.

When Verification Is Not Possible

If we cannot verify your identity even after these steps, we will explain the reason and offer at least one alternative — for instance, logging in to your account and confirming the request from inside the dashboard. We will never refuse a request without first telling you what additional information would allow us to proceed.

10. Authorised Agents — Detailed Verification

Several U.S. state laws and certain non-U.S. frameworks allow a consumer to designate an authorised agent to submit a privacy rights request on their behalf. Axion Algo accepts authorised-agent requests subject to the verification standards below, which are designed to comply with California Civil Code § 1798.140(d), 11 CCR § 7063, and equivalent provisions in Virginia, Colorado, Connecticut, Utah, Texas and other states.

Accepted Proofs

The authorised agent must provide one of the following:

• Notarised Power of Attorney executed under California Probate Code §§ 4000–4465 (or the equivalent statute in the consumer's state or country), specifically naming Axion Algo or generally authorising privacy-rights actions; or
• Written authorisation signed by the consumercontaining (i) the consumer's legal name, (ii) the consumer's contact information matching our records, (iii) the agent's legal name and contact details, (iv) the scope of the authorisation, (v) the date of the authorisation, (vi) the consumer's signature. The authorisation should not be older than 12 months.
• Sworn declaration under penalty of perjury(CCPA-style) from the agent affirming the authenticity of the written authorisation and the agent's authority to act, referencing California Civil Code § 1798.140(d)(1)(D) or the equivalent state provision.
• Agent business credentials where the agent is a business: business name, registered address, business registration / EIN number, contact person, applicable state registration if any (e.g. data-broker registration in California, Vermont, Texas, Oregon).

Independent Consumer Verification

Regardless of the agent's submission, we will independently verify the consumer's identity directly. This is achieved by contacting the consumer at a contact channel we already have on file (e-mail and, if necessary, phone) and asking them to confirm or deny the authorisation. Where the consumer cannot be reached after reasonable attempts (at least two over a 14-day window), we will reject the agent request and ask the consumer to submit directly.

California-Specific Agent Rules

Per Cal. Civ. Code § 1798.140(d) and the implementing regulations at 11 CCR § 7063, we may deny a request from an agent that does not: (i) submit written permission from the consumer that complies with the regulation, (ii) verify their own identity directly with us, and (iii) where required, provide proof that the consumer has given the agent signed permission to submit the request on their behalf. If the agent is a business entity registered as a data broker, the data-broker registration number must also be supplied.

11. Right to Limit Use & Disclosure of Sensitive Personal Information (CPRA)

California residents have the right, under California Civil Code § 1798.121 (CPRA), to direct a business that collects sensitive personal information (“SPI”) to limit its use and disclosure to that which is necessary to perform the services or provide the goods reasonably expected by an average consumer.

How to Invoke

• Send an e-mail to our contact form using the U.S. state template above with the “Limit use of sensitive personal information” checkbox ticked, or
• Use the “Limit Use of My Sensitive Personal Information” link that appears in the website footer (provided when the request is technically applicable to Axion's processing), or
• Submit via your logged-in session at Settings → Privacy.

What We Limit Upon Request

• Use of SPI to infer characteristics about you.
• Use of SPI for any purpose other than those explicitly permitted by § 1798.121(a) (see below).
• Disclosure of SPI to service providers/contractors for uses other than the strictly necessary ones.

What We Still Permit (Statutorily Allowed Uses)

• Performing the services or providing the goods reasonably expected by you.
• Preventing, detecting and responding to security incidents.
• Resisting malicious, deceptive, fraudulent or illegal actions and prosecuting those responsible.
• Ensuring the physical safety of natural persons.
• Short-term, transient use including non-personalised advertising shown as part of your current interaction.
• Performing services on behalf of the business, such as maintaining accounts, providing customer service, processing orders and transactions, or verifying customer information.
• Activities to verify or maintain the quality or safety of a service or device.

Note: Axion Algo's default operating model does not use sensitive personal information for cross-context behavioural advertising, profiling for legal effects, or sale. Submitting a Limit Use request therefore typically results in a written confirmation rather than a configuration change — but we honour the request in all cases.

12. Right to Correct

Available under California Civil Code § 1798.106 (CPRA), Virginia VCDPA § 59.1-577(A)(2), Colorado CPA § 6-1-1306(1)(b), Connecticut CTDPA § 4(a)(2), Utah UCPA § 13-61-201(2), Texas TDPSA, and equivalent provisions in EU/UK GDPR (Art. 16), Brazil LGPD (Art. 18, III), Australia APP 13, Canada PIPEDA Principle 9, and Singapore PDPA s. 22.

Correction Process

1. You submit a correction request stating the field(s) you wish to correct and the corrected value(s). Supporting documentation is welcome (e.g. an updated invoice address, a corrected name spelling), but not always required.
2. We verify your identity per the tier appropriate to the data being corrected (Section 9).
3. We review the accuracy of the correction by considering: (a) the nature of the personal information, (b) the documentation you provide, (c) the source of the original information, (d) the likelihood that the new information is more accurate than what we hold.
4. We either: (i) make the correction within the statutory deadline; or (ii) notify you of refusal with a written explanation citing the specific reason (e.g. the value is sourced from a third-party that we cannot unilaterally amend).
5. If we refuse the correction, you may submit an appeal under Section 18 free of charge.
6. Where we correct your data, we use commercially reasonable efforts to notify recipients of the data of the correction (GDPR Art. 19) unless this proves impossible or involves disproportionate effort.

13. Right to Portability — Available Formats

When you request a portable copy of your data, we provide it in a structured, commonly used and machine-readable format. You may choose:

• JSON (default) — schema-stable export with field labels documented in a README file.
• CSV (on request) — one CSV per logical entity (account, invoices, support tickets, login history). Best for spreadsheet processing.
• Human-readable PDF (summary) — a printable summary suitable for personal record-keeping; not a complete export.

We deliver the export as an encrypted ZIPdownloadable through a secure link. The download link expires after 7 calendar days and may be opened a maximum of three times for download integrity. The decryption password is sent via a separate communication channel (for example, SMS to a verified phone number, or an alternative e-mail address you provide), never in the same e-mail as the download link, to reduce risk of unauthorised access in case the e-mail account is compromised.

14. Right to Know — Specific Pieces vs Categories

Under CCPA/CPRA and several state laws you may request either category-level information (categories of personal information collected, sources, business or commercial purpose, third parties with whom it is shared) or the specific pieces of personal information collected about you. Axion Algo provides both, and you may specify your preference at the time of submission.

For each requested item we include, where reasonably available:

• Source — where we obtained it (e.g. you, TradingView OAuth, Stripe webhook, third-party verification service).
• Business purpose — why we collected it (e.g. provide service, fraud prevention, billing, legal compliance).
• Retention period — how long we expect to keep it.
• Recipients — categories of service providers or contractors who receive it (e.g. Supabase as data host, Stripe as payment processor, Resend as e-mail provider).
• Cross-border transfers — where applicable, the destination country and applicable transfer safeguard (e.g. Standard Contractual Clauses).

For specific-piece requests covering sensitive personal information or large data sets, we apply Tier-3 verification (Section 9) and may deliver the file via the encrypted-ZIP workflow described in Section 13.

15. Sensitive Personal Information Request Handling

We operate a distinct internal flow when a request concerns sensitive personal information (SPI) as defined by Cal. Civ. Code § 1798.140(ae) or equivalent (e.g. government IDs, account log-in credentials, racial or ethnic origin, religious or philosophical beliefs, union membership, genetic data, biometric data for identification, health data, sex life or sexual orientation, precise geolocation).

• Higher verification standard: Tier 3 (Section 9) is required regardless of channel.
• Access requests: SPI is delivered exclusively via the encrypted-ZIP workflow described in Section 13; never in plain e-mail.
• Deletion of SPI: deleting your SPI does not affect the operation of your account in the vast majority of cases, because Axion Algo only collects SPI in narrow contexts (e.g. KYC where mandatorily applicable, or an uploaded ID copy for verification). Where SPI deletion would prevent us from continuing to provide a regulated service, we will tell you so before action and offer the option to close the account.
• Logs and audit trails: we keep a tamper-evident record of every SPI request and its handling for at least 6 years to demonstrate compliance.

16. Consumer Health Data Specific Rights — Washington MHMDA

Residents of the State of Washington (and similarly situated residents under Nevada SB 370 and Connecticut's CTDPA health provisions) may invoke additional rights under the My Health My Data Act (RCW 19.373) with respect to “consumer health data”. Axion Algo does not currently process consumer health data in the ordinary course; however, where you provide such information (e.g. in a support conversation), the following additional rights apply:

• Right to confirm what consumer health data has been collected, shared or sold (Axion does not sell or share consumer health data).
• Right to know the source from which the data was obtained.
• Right to know the recipients (third parties or affiliates) to whom such data has been disclosed.
• Right to delete consumer health data, including from any service-provider or processor systems where we have shared it.
• Right to revoke consent for the collection, sharing or sale of consumer health data, with effect prospectively.
• Right to file a complaint with the Washington Attorney General at atg.wa.gov if dissatisfied with our handling.

17. Children's Data Requests

Axion Algo is not directed at children under the age of 18 and we do not knowingly collect personal information from minors. If you are a parent or legal guardian and believe we hold personal information of a minor under 13 (COPPA threshold) or under 16 (GDPR Art. 8 default and several state laws), please submit a request on the minor's behalf with the following documentation:

• Proof of parental authority — copy of a birth certificate, court order, or other legal document establishing parental or guardianship status.
• Identification of the minor — the e-mail used to register, any account identifier, or other reasonably specific identifying information.
• Identification of the parent/guardian — government-issued photo ID with non-essential fields redacted.
• Signed declaration under penalty of perjury that you are the parent or legal guardian and that the request is made in the minor's best interest.

Upon verification we will delete the minor's account and all associated personal data within the statutory deadlines.

18. Appeal Process & Timelines

If we deny your request in whole or in part, you have the right to appeal that decision. The right of appeal is mandatory under Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Texas TDPSA, Oregon OCPA, Montana MCDPA, Tennessee TIPA, New Jersey NJDPA, Delaware DPDPA, New Hampshire NHDPA, Indiana INCDPA, Kentucky KCDPA, Maryland MODPA, Rhode Island RIDTPPA and Minnesota MCDPA, and we voluntarily extend the same right to residents of all other jurisdictions including the EU/UK.

• Initial response window: 45 calendar days from receipt of a verified request (CCPA), or 30 calendar days under GDPR. A single extension of an equal period is permitted, with prior written notice and reasons.
• Appeal mechanism: free of charge for the consumer. Reply to the denial e-mail within 30 days using the subject line “Appeal — [State or Country]” and clearly explain why you believe the decision was incorrect, including any new information.
• Appeal decision deadline: 45 calendar days from receipt of the appeal (most U.S. state laws). We will respond in writing with our final determination and the reasons.
• If your appeal is denied, we will inform you of your right to lodge a complaint with the relevant state Attorney General, the EU/UK DPA of your country of residence, or other applicable supervisory authority, and provide the contact information.

See Section 22 for the full list of relevant supervisory authorities and their contact details.

19. Refusal Reasons — Catalogued

We may, under applicable law, refuse a request in whole or in part. Whenever we refuse, we will explain the reason in writing and inform you of your right of appeal (Section 18). The permissible refusal grounds we apply are:

• Cannot verify identity after reasonable steps and a clear opportunity for you to supply additional information.
• Request is manifestly unfounded or excessive (e.g. repetitive or designed to overload our systems), per GDPR Art. 12(5) and state-law equivalents.
• Exempt records — records that are subject to a legal claim, ongoing fraud investigation, litigation hold, or that fall under specific statutory exemptions (e.g. journalism / free expression exemptions, attorney-client privilege).
• Would compromise another person's privacy or fundamental rights (e.g. data that mentions a third party and cannot be redacted without losing meaning).
• Technical impossibility — data that has already been deleted in line with our retention schedule, or that we never collected.
• Conflict with law — where complying would violate another statutory obligation (e.g. AML record-keeping mandated for 5–7 years).
• Trade secrets — to the limited extent disclosure would reveal trade secrets or proprietary business logic; we will still provide all information you are entitled to in non-secret form.

20. Cost of Requests

The first two privacy rights requests submitted by the same individual within any rolling 12-month period are processed free of charge. For subsequent requests from the same individual within the same 12-month period, where the applicable law permits, we may charge a reasonable, cost-based administrative fee that reflects the actual labour involved in processing the request. We will always provide an estimate before proceeding, and you may withdraw the request without obligation.

No fee is charged for opt-outs (sale/share, marketing, sensitive PI limitation), for withdrawals of consent, or for appeals — these are always free, regardless of how many times you exercise them.

21. Our Response Timeline

Requests are free of charge subject to Section 20. If a request is clearly unfounded, repetitive, or excessive we may (i) refuse it with explanation or (ii) charge a reasonable administrative fee, as permitted by law.

DSAR Workflow — Internal SLA

Internally, we operate the following service-level agreement to ensure consistent and timely processing:

• Triage within 3 business days — classify request, assign owner, log in ticket system.
• Identity verification within 7 business days — collect any additional information and complete verification.
• Data compilation within 21 business days — extract data from production systems, redact third-party data where required, package the export.
• Delivery within 45 calendar days from receipt of the verified request, extendable to 90 calendar days for complex requests with prior written notice and reasons.

22. Supervisory Authorities & How to Complain

You may lodge a complaint with the supervisory authority of your country or state of residence, place of work, or alleged infringement. We strongly encourage you to contact us first via our contact form so we can address the issue quickly — most disputes are resolved within days when raised directly. The list below is non-exhaustive.

• EU / EEA Data Protection Authorities: directory maintained by the European Data Protection Board at edpb.europa.eu.
• United Kingdom — Information Commissioner's Office (ICO): ico.org.uk.
• California — Office of the Attorney General & California Privacy Protection Agency (CPPA): oag.ca.gov/privacy.
• Virginia — Office of the Attorney General: oag.state.va.us.
• Colorado — Office of the Attorney General: coag.gov.
• Connecticut — Office of the Attorney General: portal.ct.gov/ag.
• Texas — Office of the Attorney General: oag.texas.gov.
• Utah — Division of Consumer Protection / Attorney General: dcp.utah.gov.
• Oregon — Office of the Attorney General: doj.state.or.us.
• Washington — Office of the Attorney General (MHMDA complaints): atg.wa.gov.
• Brazil — Autoridade Nacional de Proteção de Dados (ANPD): gov.br/anpd.
• Australia — Office of the Australian Information Commissioner (OAIC): oaic.gov.au.
• Canada — Office of the Privacy Commissioner (OPC): priv.gc.ca.
• Switzerland — Federal Data Protection and Information Commissioner (FDPIC): edoeb.admin.ch.
• Singapore — Personal Data Protection Commission (PDPC): pdpc.gov.sg.
• Japan — Personal Information Protection Commission (PPC): ppc.go.jp.
• South Korea — Personal Information Protection Commission (PIPC): pipc.go.kr.
• South Africa — Information Regulator: inforegulator.org.za.

23. Possible Legal Exceptions

We will honour your request unless retaining the data is strictly necessary to:

• complete an ongoing transaction you initiated;
• detect or prevent security incidents, fraud, or illegal activity;
• comply with statutory obligations (e.g., tax or bookkeeping laws that require us to keep invoices for up to seven years);
• defend or enforce legal claims.

If any data must be retained for these reasons, we will isolate it from routine use and delete it as soon as the retention period ends.

24. Records of Requests Retained

For audit, legal-compliance and accountability purposes, we retain the following records of each privacy rights request:

• The request itself (e-mail, web form submission, or scanned letter).
• The identity-verification evidence collected (with sensitive data redacted or pseudonymised after verification).
• Our decision (granted in whole, granted in part, denied) and the reasoning.
• The substantive response delivered to you.
• Any communications exchanged in the course of processing.
• The internal handling timeline (triage, verification, compilation, delivery).

These records are retained for 6 years in support of compliance audits and regulatory inquiries, and stored in encrypted form with access limited to authorised privacy personnel. After the retention period they are securely deleted.

25. Annual Privacy Metrics Report

In the spirit of accountability and per California Civil Code § 1798.130(a)(5) (where applicable to our scale), each year in the first quarter (Q1) we publish a Privacy Metrics Report at a dedicated URL such as axion-algo.com/privacy-metrics-2027(replace 2027 with the relevant year). The report covers the preceding calendar year and includes, at a minimum:

• Number of requests received, broken down by type (access, deletion, correction, opt-out of sale/share, opt-out of sensitive PI use, portability, etc.).
• Number of requests complied with in whole or in part.
• Number of requests denied, with categorical reasons (unverified identity, statutory exemption, manifestly unfounded, etc.).
• Median substantive response time, in days, from receipt of a verified request to delivery of the outcome.
• Longest open request in days, with high-level reason for the duration.
• Number of appeals received and number granted.

The report is anonymised and aggregated; no personal data of any requester is disclosed.

26. Right to Non-Discrimination & Right of Access Special Cases

Right to non-discrimination: exercising any privacy right does not result in any retaliation, denial of service, price change, or reduction in service quality. The only practical limitation is that some requests (e.g., full erasure) are incompatible with continuing your subscription, in which case your account will be closed at your request and a pro-rata refund issued where applicable under our Refund Policy.

Right to opt-out of sale or sharing: we do not sell personal information. Cookies used by Meta Pixel or TikTok Pixel when you accept marketing cookies may, however, be classified by regulators as “sharing” for cross-context behavioural advertising — you can opt out by rejecting marketing cookies in the cookie banner, by sending a GPC (Global Privacy Control) signal from your browser, or by submitting the opt-out checkbox in any of the templates above.

27. Modification of this Document

We may amend this Privacy Rights Request page from time to time. For material changes — for example, changes to the verification standard, the cost of requests, or the rights we recognise — we will provide at least 30 calendar days' prior notice by updating this page and, where reasonable, e-mailing registered users at the address on file. For minor edits such as clarifications, typo corrections, or updated contact addresses, the change is effective immediately on posting and the “Last Updated” date at the top of the page is incremented.

Historical versions of this page are available on request via our contact form so that you can compare the current text with previous versions.

28. Questions, Complaints & Contact

For any question, concern or complaint regarding this Privacy Rights Request page or the handling of a request, e-mail our contact form. If you believe we have not handled your request lawfully, you may lodge a complaint with the supervisory authority of your country or state of residence (see Section 22), or, if you are a California resident, with the California Privacy Protection Agency (CPPA). We nevertheless encourage you to contact us first so we can address the issue quickly and at no cost to you.