GDPR — Data Subject Rights Statement

This GDPR statement explains the rights available to individuals (“data subjects”) whose personal data is processed in connection with sassyfantasy.com and the related services (the “Service”), in accordance with Regulation (EU) 2016/679 (the “GDPR”), where applicable.

This statement should be read together with our Privacy Policy and Terms of Service.

1) Identity of the Data Controller

Data Controller: SassyFantasy

Privacy Contact: support@sassyfantasy.com

All inquiries regarding the exercise of GDPR rights may be directed to: support@sassyfantasy.com.

2) Your Rights Under the GDPR

(a) Right of Access (Article 15 GDPR)

You have the right to obtain confirmation as to whether personal data concerning you is being processed. Where such data is processed, you may request access to your personal data and the following information:

• the purposes of the processing;
• the categories of personal data concerned;
• the recipients or categories of recipients to whom the data has been or will be disclosed;
• the envisaged retention period or the criteria used to determine it;
• the existence of your other GDPR rights;
• where applicable, meaningful information about automated decision-making, including profiling.

(b) Right to Rectification (Article 16 GDPR)

You have the right to request correction of inaccurate personal data and completion of incomplete personal data without undue delay.

(c) Right to Erasure (“Right to Be Forgotten”) (Article 17 GDPR)

You have the right to request deletion of your personal data where one of the following applies:

• the data is no longer necessary for the purposes for which it was collected or processed;
• you withdraw consent (where processing is based on consent) and there is no other legal basis;
• you object to processing and there are no overriding legitimate grounds to continue;
• the personal data has been unlawfully processed;
• the personal data must be erased to comply with a legal obligation.

(d) Right to Restriction of Processing (Article 18 GDPR)

You may request restriction of processing where:

• you contest accuracy of the data (for a period enabling verification);
• processing is unlawful and you oppose erasure, requesting restriction instead;
• we no longer need the data, but you require it for legal claims; or
• you have objected to processing pending verification of overriding grounds.

(e) Right to Data Portability (Article 20 GDPR)

You have the right to receive personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit it to another controller where technically feasible. This applies where processing is based on consent or contract and carried out by automated means.

(f) Right to Object (Article 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. If you object, we will stop processing unless we demonstrate compelling legitimate grounds overriding your interests, rights, and freedoms, or the processing is needed for legal claims.

(g) Rights Related to Automated Decision-Making (Article 22 GDPR)

You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you, unless the decision is necessary for entering into or performing a contract, authorized by applicable law, or based on your explicit consent.

Where Article 22 applies, you may request human intervention, express your point of view, and contest the decision.

(h) Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

(i) Right to Lodge a Complaint (Article 77 GDPR)

You have the right to lodge a complaint with a competent supervisory authority if you believe that our processing infringes the GDPR. Typically, you may complain to the authority in your country of habitual residence, your place of work, or the place of the alleged infringement.

You may contact the supervisory authority in your country of habitual residence, place of work, or the place where you believe the alleged infringement occurred.

3) How to Exercise Your Rights

You may submit requests by email to: support@sassyfantasy.com.

Please include:

• the email address associated with your account (if any);
• the right you wish to exercise;
• sufficient details to help us locate the relevant data.

To protect your privacy, we may request reasonable proof of identity before acting on your request.

4) Response Time

We will respond to valid requests without undue delay and in any event within one (1) month of receipt. This period may be extended by up to two (2) additional months where necessary due to complexity or number of requests. If extended, we will inform you within one month and explain why.

5) Important Practical Notes (Service-Specific)

• Private service: User prompts/uploads/outputs are not published by us to a public feed/gallery within the Service.
• Payments: We accept payment through crypto invoices and Telegram Stars. Telegram and third-party card on-ramp or fiat-to-crypto providers process their own wallet, Stars, card, or fiat transactions under their own terms; we do not store full card details.
• Minimal retention: Temporary user uploads/outputs are typically retained for up to twenty-four (24) hours, while saved content, transaction records, security logs, and abuse-prevention records may be retained longer where required for service operation, security, accounting, dispute handling, or legal compliance.

If you have questions about this statement, contact: support@sassyfantasy.com.