Your data, your call

Use this form to exercise your rights under GDPR, UK GDPR, CCPA, the Australian Privacy Principles, or similar laws.

What you can ask for

• Access — we email you a copy of every record tied to your address (certificate number, country, currency, score, share token, dates, processor order ID).
• Anonymize — the display name on your certificate is changed to “Anonymous” within 30 days, the cert artifacts are regenerated, and your email + email hash are deleted from our database. The certificate URL stays public (with no name on it).
• Delete — the entire purchases row is deleted. The public counter and country aggregates are unaffected (they only know the row went away, not whose).

How it works

1. Submit your email below and pick an action.
2. We send a confirmation email with a one-time link that expires in 24 hours (HMAC-signed; only you can use it).
3. You click the link to confirm the request.
4. We complete the action within 30 days and email you when it’s done.

Questions or escalation

Need to ask a human first? Email us via /contact. If you believe we’re mishandling your data, you have the right to complain to your country’s data protection authority.