Data Subject Access Request

Last updated: May 28, 2026

Use this page to exercise your data protection rights against She Affirms. We honor rights under the GDPR (Arts. 15–22), CCPA/CPRA (California), LGPD (Brazil), PIPEDA and Quebec Law 25 (Canada), DPDP Act (India), PIPA (South Korea), APPI (Japan), LFPDPPP (Mexico), Privacy Act 1988 (Australia, APP), and the various US state consumer-privacy laws listed in our Privacy Policy § 16.

1. Your rights

  • Access — a copy of your personal data we hold.
  • Correction — fix inaccurate or incomplete data.
  • Deletion ("right to be forgotten") — erase your data.
  • Portability — receive your data in a structured, machine-readable format.
  • Restriction of processing.
  • Objection to processing based on legitimate interests.
  • Opt-out of sale/sharing (CCPA/CPRA, Texas, others) — we do not sell or share personal information for cross-context behavioral advertising.
  • Withdraw consent previously given.
  • Lodge a complaint with a supervisory authority.

2. Find your anonymous user ID

Because She Affirms does not collect names or emails, we identify your account by the anonymous user ID generated by RevenueCat. To find it, open the App and go to Settings → About → User ID, then tap to copy.

3. Submit your request

The form below opens your email client and pre-fills a request addressed to contact@sheaffirms.app. We do not store your input on this page.

If your email client is not configured, send a message manually to contact@sheaffirms.app with the same information.

4. Service level

  • We acknowledge receipt within 5 business days.
  • We respond substantively within 30 days (GDPR Art. 12(3) / LGPD), or within 45 days for CCPA/CPRA requests.
  • A one-time 30-day extension may apply for complex requests; we will notify you of any extension and the reasons.
  • No fee for your first request in any 12-month period. Repetitive or manifestly unfounded requests may incur a reasonable fee or be refused (GDPR Art. 12(5)).

5. Authorized agents

California residents may designate an authorized agent to submit a request on their behalf (CCPA § 1798.130(a)(3)(B)). We will require (a) written, signed permission from you, and (b) verification of your identity to act on the request.

6. Verification

Because we do not collect names or emails, we verify requests by matching the anonymous user ID you provide. For deletion, we may ask you to confirm the request a second time from the same email address. We will not require you to create an account to exercise a right.

7. Appeal

If you are dissatisfied with our response, you may appeal to your supervisory authority:

  • Germany (lead authority): Die Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).
  • EU/EEA: your national Data Protection Authority (list at edpb.europa.eu).
  • UK: Information Commissioner's Office (ICO).
  • California: California Privacy Protection Agency (CPPA), Attorney General.
  • Brazil: Autoridade Nacional de Proteção de Dados (ANPD).
  • Canada: Office of the Privacy Commissioner (OPC); Quebec: CAI.
  • Australia: Office of the Australian Information Commissioner (OAIC).
  • Other jurisdictions: your national data protection authority.

8. Non-retaliation

We will not retaliate against you for exercising any of your rights, including by denying service, charging different prices, or providing a different quality of service.