GDPR & Your Data
Last updated: 2026-09-02
1. Your rights in short
If you are in the EEA, UK, or Switzerland, the GDPR gives you these rights over your personal data. Most apply to everyone who uses Ship & Shout, wherever you are.
- Access — get a copy of the data we hold about you.
- Rectification — correct data that is wrong or incomplete.
- Erasure — delete your account and data (“right to be forgotten”).
- Portability — receive your data in a machine-readable format.
- Restriction — ask us to pause certain processing.
- Objection — object to processing based on legitimate interest.
- Withdraw consent — for anything based on consent, such as publishing.
2. How to exercise each right
| Right | Do it yourself | Or ask us |
|---|---|---|
| Access / export | Settings → Account → Export data | Email privacy@shipandshout.com |
| Rectification | Edit your profile in Settings | Email us to correct anything you can't edit |
| Erasure | Settings → Danger zone → Delete account | Email us to request deletion |
| Portability | Use the data export | Email us for a copy |
| Restriction / objection | Disconnect a source in Settings | Email privacy@shipandshout.com |
| Withdraw consent | Turn off publishing / the public timeline | Email us and we'll disable it |
We respond to rights requests within one month, and may ask you to verify your identity first.
3. Export & portability
You can export your account data — your profile, metric summaries, and drafts — in a structured, machine-readable format from Settings → Account. This lets you keep a copy or move your data elsewhere.
4. Deleting your account
You are always in control. Deleting your account is self-serve and permanent.
Steps
- Go to Settings → Danger zone.
- Choose Delete account and confirm.
What happens, and when
- Immediately: your account, encrypted access tokens, drafts, metric summaries, and charts are erased from our live systems.
- Token revocation: the stored tokens for your connected sources are destroyed so we can no longer access them. You can also revoke access directly with each provider at any time.
- Within one hour: any public timeline page you enabled is taken offline.
- Within 30 days: your data is purged from encrypted backups as they rotate out.
Billing records held by our merchant of record (Lemon Squeezy) may be retained where tax and accounting law requires it.
5. Retention schedule
| Data | Kept while active | After deletion |
|---|---|---|
| Account & profile | Yes | Erased immediately; purged from backups within 30 days |
| Access tokens | Encrypted at rest | Destroyed immediately |
| Drafts & metric summaries | Yes | Erased immediately; purged from backups within 30 days |
| Charts (Supabase Storage) | Yes | Erased immediately |
| Public timeline entries | While you keep it on | Offline within one hour |
| Billing records | Yes | Retained by merchant of record per law |
6. Subprocessors
The providers that process your data on our behalf — Supabase, Vercel, Lemon Squeezy, Resend, our LLM providers, and the OAuth / source providers you connect — are listed with their purpose and region in the subprocessors table of our Privacy Policy.
7. Complaints
We hope to resolve any concern directly — email privacy@shipandshout.com. You also have the right to lodge a complaint with your local data protection supervisory authority (in the EEA, your national DPA; in the UK, the ICO).
8. Contact
For any data request or question, email privacy@shipandshout.com.