This GDPR statement explains the rights available to individuals (“data subjects”) whose personal data is processed
in connection with sassyfantasy.com and the related services (the “Service”), in accordance with
Regulation (EU) 2016/679 (the “GDPR”), where applicable.
All inquiries regarding the exercise of GDPR rights may be directed to:
support@sassyfantasy.com.
2) Your Rights Under the GDPR
(a) Right of Access (Article 15 GDPR)
You have the right to obtain confirmation as to whether personal data concerning you is being processed. Where such data is processed, you may request access to your personal data and the following information:
the purposes of the processing;
the categories of personal data concerned;
the recipients or categories of recipients to whom the data has been or will be disclosed;
the envisaged retention period or the criteria used to determine it;
the existence of your other GDPR rights;
where applicable, meaningful information about automated decision-making, including profiling.
(b) Right to Rectification (Article 16 GDPR)
You have the right to request correction of inaccurate personal data and completion of incomplete personal data without undue delay.
(c) Right to Erasure (“Right to Be Forgotten”) (Article 17 GDPR)
You have the right to request deletion of your personal data where one of the following applies:
the data is no longer necessary for the purposes for which it was collected or processed;
you withdraw consent (where processing is based on consent) and there is no other legal basis;
you object to processing and there are no overriding legitimate grounds to continue;
the personal data has been unlawfully processed;
the personal data must be erased to comply with a legal obligation.
Limitations
This right does not apply where processing is necessary for compliance with a legal obligation, the establishment/exercise/defense of legal claims, or other lawful grounds permitted under the GDPR.
Note on content retention (Service-specific)
The Service is designed to minimize retention of temporary user uploads/outputs and typically retains them for up to twenty-four (24) hours before deletion,
subject to technical, security, dispute-handling, and legal exceptions.
Saved characters, Company-created samples, account records, payment records, security logs, and abuse-prevention records may remain longer where needed.
(d) Right to Restriction of Processing (Article 18 GDPR)
You may request restriction of processing where:
you contest accuracy of the data (for a period enabling verification);
processing is unlawful and you oppose erasure, requesting restriction instead;
we no longer need the data, but you require it for legal claims; or
you have objected to processing pending verification of overriding grounds.
(e) Right to Data Portability (Article 20 GDPR)
You have the right to receive personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit it to another controller where technically feasible.
This applies where processing is based on consent or contract and carried out by automated means.
(f) Right to Object (Article 21 GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests.
If you object, we will stop processing unless we demonstrate compelling legitimate grounds overriding your interests, rights, and freedoms, or the processing is needed for legal claims.
(g) Rights Related to Automated Decision-Making (Article 22 GDPR)
You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you,
unless the decision is necessary for entering into or performing a contract, authorized by applicable law, or based on your explicit consent.
Where Article 22 applies, you may request human intervention, express your point of view, and contest the decision.
Service note
The Service may use automated systems for security, abuse prevention, content policy enforcement, and Welcome Bonus Scoring.
Welcome Bonus Scoring may analyze challenge-specific signals such as typing cadence, pointer/touch activity, focus/visibility changes, browser/device indicators,
paste/drop/reload/integrity events, derived risk scores, and similarity to recent challenge profiles.
These systems may approve, reduce, deny, or route promotional free credits for review, but they do not by themselves remove purchased Credits or close your account.
You may contact support to request human review of a Welcome Bonus decision.
(h) Right to Withdraw Consent
Where processing is based on consent, you have the right to withdraw consent at any time.
Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
(i) Right to Lodge a Complaint (Article 77 GDPR)
You have the right to lodge a complaint with a competent supervisory authority if you believe that our processing infringes the GDPR.
Typically, you may complain to the authority in your country of habitual residence, your place of work, or the place of the alleged infringement.
You may contact the supervisory authority in your country of habitual residence, place of work,
or the place where you believe the alleged infringement occurred.
the email address associated with your account (if any);
the right you wish to exercise;
sufficient details to help us locate the relevant data.
To protect your privacy, we may request reasonable proof of identity before acting on your request.
4) Response Time
We will respond to valid requests without undue delay and in any event within one (1) month of receipt.
This period may be extended by up to two (2) additional months where necessary due to complexity or number of requests.
If extended, we will inform you within one month and explain why.
5) Important Practical Notes (Service-Specific)
Private service: User prompts/uploads/outputs are not published by us to a public feed/gallery within the Service.
Payments: We accept payment through crypto invoices. Third-party card on-ramp or fiat-to-crypto providers may process card or fiat transactions under their own terms; we do not store full card details.
Minimal retention: Temporary user uploads/outputs are typically retained for up to twenty-four (24) hours, while saved content, transaction records, security logs, and abuse-prevention records may be retained longer where required for service operation, security, accounting, dispute handling, or legal compliance.