Data Deletion Request Workflow

This section provides the user-facing form and the internal/external communication plan for handling data deletion requests, specifically addressing the Web3/immutability conflict.

  1. User-Facing Data Deletion Request Form

    2. This template should be made available on the platform's "Privacy Centre" or provided upon request. It can be submitted via a web form or as an email to privacy@megastars.ai.

    Subject: Data Deletion Request (GDPR Art. 17 / CCPA Right to Delete)

    To the Megastars Data Protection Officer,

    I am writing to formally request the deletion of all personal data associated with my account, in accordance with applicable data protection regulations (e.g., GDPR, CCPA).

    Please find my account details below to help you locate my data:

    • Full Name: [User's Full Name]
    • Email Address (associated with account): [User's Email]
    • Account Username / ID (if applicable): [User's Username]

    I understand that for security purposes, you will need to verify my identity before processing this request.13 Please let me know what steps are required for verification.

    Please confirm once my data has been deleted.

    Thank you,

    [User's Full Name]

  2. Internal Process and External Communication (Deletion Workflow)

    3. Step 1: Receive and Verify Request

    1. Acknowledge Receipt: Send an immediate, automated reply confirming receipt of the request.
    2. Verify Identity (Mandatory): Send a manual or automated follow-up to verify the user's identity. This is required for deletion/access requests under both GDPR and CCPA.
      • Verification Method: The most secure method is to require the user to log in to their account to confirm the request ("re-authenticate"). If they cannot log in, require them to reply from the verified email address associated with the account.
      • Do not ask for new sensitive personal information (e.g., a copy of a driver's license) unless absolutely necessary for high-risk accounts. The data collected for verification can only be used for that purpose.

    Step 2: Internal Audit and Deletion (Off-Chain)

    1. Process Request: Once verified, the legal clock starts (e.g., 30 days for GDPR, 45 days for CCPA).
    2. Locate Data: Audit all controllable (Web2) systems for the user's Personal Data:
      • Main application database (user profile, settings, etc.)
      • CRM (e.g., Salesforce, HubSpot)
      • Support/ticketing system (e.g., Zendesk)
      • Analytics platforms (e.g., Google Analytics - use User Deletion API)
      • Email marketing service (e.g., Mailchimp)
    3. Execute Deletion: Permanently delete the user's Personal Data from all these systems.
    4. Notify Third Parties (if applicable): If data was shared (e.g., with a Company), you must inform them of the erasure request, unless this involves disproportionate effort.
    5. Check Exceptions: Review if any exceptions apply (e.g., data must be kept for legal compliance, such as tax records).

    Step 3: Anonymization (On-Chain)

    1. Identify On-Chain Records: Locate any on-chain records (e.g., transaction hashes) associated with the user's account ID.
    2. Confirm No PII: Re-confirm that no Personal Data (name, email) was ever written to the chain, per the platform's "privacy-by-design" architecture.
    3. Sever the Link: The deletion of the user's account in Step 2 (the off-chain database) should automatically sever the link between their identity and the anonymous on-chain hash. If encryption keys are used to link the data, those keys must be "burned" (destroyed). This action renders the on-chain data functionally anonymous.

    Step 4: Send Final Confirmation Response

    This response is legally critical. It must be transparent, clear, and perfectly aligned with the Privacy Policy (Part I, Section 10).

    Subject: Confirmation of Your Data Deletion Request

    Dear [User's Full Name],

    We have successfully processed your data deletion request.

    In accordance with our legal obligations, we have permanently deleted your personal information (such as your name, email address, profile data, and other identifiable information) from our controllable databases and systems.

    Important Information Regarding Blockchain Data:

    As explained in our Privacy Policy, our platform utilizes blockchain technology to ensure the integrity and verification of transactions.

    By design, data written to a blockchain is immutable and cannot be technically erased. To protect your privacy from the outset, we never store your personal data directly on the blockchain.

    We have now completed the final step of your deletion request by permanently severing all links between your personal data (which has been deleted) and any anonymized records on the blockchain. This action renders that on-chain data non-personal.

    Please note that while we have fulfilled your right to be forgotten by deleting and anonymizing your data, we cannot literally erase the immutable, anonymized, on-chain record. We may not be able to comply with a request for literal erasure of this specific record for this technical and legal reason.

    Your account is now deleted, and your personal data has been erased from our systems to the fullest extent possible.

    - The Megastars Team