Data Deletion Request Workflow

This section provides the user-facing form and the internal/external communication plan for handling data deletion requests.

  1. User-Facing Data Deletion Request Form

    2. This template should be made available on the platform's "Privacy Centre" or provided upon request. It can be submitted via a web form or as an email to privacy@megastars.ai.

    Subject: Data Deletion Request (GDPR Art. 17 / CCPA Right to Delete)

    To the Megastars Data Protection Officer,

    I am writing to formally request the deletion of all personal data associated with my account, in accordance with applicable data protection regulations (e.g., GDPR, CCPA).

    Please find my account details below to help you locate my data:

    • Full Name: [User's Full Name]
    • Email Address (associated with account): [User's Email]
    • Account Username / ID (if applicable): [User's Username]

    I understand that for security purposes, you will need to verify my identity before processing this request.13 Please let me know what steps are required for verification.

    Please confirm once my data has been deleted.

    Thank you,

    [User's Full Name]

  2. Internal Process and External Communication (Deletion Workflow)

    3. Step 1: Receive and Verify Request

    1. Acknowledge Receipt: Send an immediate, automated reply confirming receipt of the request.
    2. Verify Identity (Mandatory): Send a manual or automated follow-up to verify the user's identity. This is required for deletion/access requests under both GDPR and CCPA.
      • Verification Method: The most secure method is to require the user to log in to their account to confirm the request ("re-authenticate"). If they cannot log in, require them to reply from the verified email address associated with the account.
      • Do not ask for new sensitive personal information (e.g., a copy of a driver's license) unless absolutely necessary for high-risk accounts. The data collected for verification can only be used for that purpose.

    Step 2: Internal Audit and Deletion (Off-Chain)

    1. Process Request: Once verified, the legal clock starts (e.g., 30 days for GDPR, 45 days for CCPA).
    2. Locate Data: Audit all controllable (Web2) systems for the user's Personal Data:
      • Main application database (user profile, settings, etc.)
      • CRM (e.g., Salesforce, HubSpot)
      • Support/ticketing system (e.g., Zendesk)
      • Analytics platforms (e.g., Google Analytics - use User Deletion API)
      • Email marketing service (e.g., Mailchimp)
    3. Execute Deletion: Permanently delete the user's Personal Data from all these systems.
    4. Notify Third Parties (if applicable): If data was shared (e.g., with a Company), you must inform them of the erasure request, unless this involves disproportionate effort.
    5. Check Exceptions: Review if any exceptions apply (e.g., data must be kept for legal compliance, such as tax records).

    Step 3: Records From the Earlier Blockchain Feature

    1. Find linking records: If the user made a payment through the closed blockchain feature, find the records in our systems that link the user's account to a wallet address or transaction hash.
    2. Confirm no name or contact detail: Confirm that no name, email or other contact detail was written to the chain.
    3. Delete the link: Delete those linking records in our systems. If a key links the data, destroy it. The on-chain record stays public and cannot be erased.

    Step 4: Send Final Confirmation Response

    This response is legally critical. It must be transparent, clear, and perfectly aligned with the Privacy Policy (Part I, Section 10).

    Subject: Confirmation of Your Data Deletion Request

    Dear [User's Full Name],

    We have successfully processed your data deletion request.

    In accordance with our legal obligations, we have permanently deleted your personal information (such as your name, email address, profile data, and other identifiable information) from our controllable databases and systems.

    Records from the earlier blockchain feature:

    An earlier version of our platform used the Base blockchain for payments. That feature is closed. If you made a payment through it, a record of the transaction (wallet addresses, amount and time) stays on the public blockchain. We never wrote your name or contact details there.

    We have deleted every record in our systems that linked a wallet address to you. We no longer hold anything that connects you to that record. Nobody, including us, can erase a record on a public blockchain. This is the only part of your request we cannot carry out, for this technical reason.

    Your account is now deleted, and your personal data has been erased from our systems to the fullest extent possible.

    - The Megastars Team