How we comply
Effective October 1, 2026. Blamewell is built for customers in the European Economic Area, the United Kingdom and the United States. This page summarises the rules we design around and what we do about each. It describes our efforts; it is not a certification or legal advice.
| Law / rule | What it asks | What we do |
|---|---|---|
| GDPR / UK GDPR (EU, UK) | Lawful basis, transparency, data-subject rights, security, breach notice, transfer safeguards, records | Documented legal bases and retention (Privacy Policy); self-service export, correction and deletion; a privacy-request queue with 30-day deadlines; encryption and access controls (Security); 72-hour breach procedure; SCCs for transfers (sub-processors); automatic data-retention clean-up |
| GDPR Art. 7 / 8 — consent and children | Consent must be explicit and recorded; valid digital-consent age up to 16 | Unticked checkbox with links to the documents, recorded with date and document version; we require you to be 16 or over |
| ePrivacy Directive / PECR — cookies | Prior consent for non-essential cookies; refusing as easy as accepting | Only strictly necessary cookies until you opt in; equal-prominence “reject”; granular categories; consent record; withdraw any time; Global Privacy Control honoured |
| CCPA / CPRA (California) and other US state privacy laws | Notice at collection, rights to know / delete / correct / opt out, no sale or sharing without opt-out, honour GPC, no discrimination | We do not sell or share personal information; rights available in-app and by email; Your privacy choices page; GPC honoured; 45-day maximum response (we work to 30) |
| COPPA (US) / age rules | No knowing collection from children under 13 without parental consent | Service is 16+, age confirmed at sign-up; data deleted if a child’s account is found |
| EU / UK consumer law — right of withdrawal | 14-day withdrawal right for distance contracts; exception once digital content or a service starts with your express agreement, which the trader must be able to prove | The API refuses a paid purchase without your express acknowledgement of immediate delivery and stores it per purchase (time, Terms version, IP, browser); subscriptions cancel at any time; unspent wallet money refundable within 14 days of a top-up on request (see the Terms) |
| Account deletion / erasure | Erasure without undue delay | Deletion deactivates the account at once; it stays recoverable for a fixed period (never under 60 days, set by a super admin and shown to you), then is permanently erased — we tell you this every step of the way |
| Storage limitation (GDPR Art. 5(1)(e)) | Do not keep personal data longer than needed | A daily job deletes expired sessions, old notifications, closed privacy requests and audit logs past their periods (Privacy Policy, section 5); financial records are kept as the law requires |
| CAN-SPAM (US) / ePrivacy (EU) — email | Truthful messages, identify sender, honour opt-outs; consent for marketing in the EU | We send service email only (no third-party marketing); every email carries our identity, postal address and a link to notification settings; alert emails can be switched off in Settings; security and billing notices are essential |
| Payment rules (PSD2 / SCA, PCI-DSS) | Strong customer authentication; protect card data | Cards are handled entirely by certified processors that perform authentication; we never see card numbers |
| Accessibility (ADA / EU Accessibility Act, WCAG 2.1 AA) | Usable by people with disabilities | Keyboard access, focus management, skip link, contrast checks in the build, reduced-motion support; tell us about any barrier you find |
| Automated decisions and AI (GDPR Art. 22, EU AI Act, NYC Local Law 144) | Human oversight; transparency for recruitment tools | Reports support a person’s decision and are never automated decisions; customers using candidate reports must inform candidates and are responsible for local rules — see Privacy Policy §11–12 |
Contact and complaints
Questions about any of this: see the contact details in the Privacy Policy. You always have the right to complain to your supervisory authority or state attorney general.