Your Data & Rights

1. Who is responsible for your data

The Herpegram operator is intended to act as controller for personal data it determines the purposes and means of processing. The operator's final legal identity, postal service address and privacy contact must be inserted before public commercial launch.

2. How to make a rights request

You may make a valid data-rights request without using legal terminology or quoting a specific UK GDPR article. Herpegram will provide a dedicated privacy request route before launch and should recognise requests received through other appropriate contact channels.

We may ask for information reasonably necessary to verify that the requester is the person entitled to exercise the right. Verification should be proportionate and should not become an excuse to collect unnecessary identity documents.

3. Right to be informed

You have the right to receive appropriate information about how your personal data is collected and used. Herpegram provides this primarily through the Privacy Policy, this page and contextual notices where necessary.

4. Right of access

You may request access to personal data Herpegram holds about you and the supplementary information required by applicable law. This is commonly called a subject access request or SAR.

Access rights concern your personal data, not an unrestricted right to obtain another person's data, confidential security material, source code, moderation methods or information protected by an applicable exemption. Where records contain information about several people, Herpegram must consider the rights of everyone involved.

5. Right to rectification

You may ask Herpegram to correct inaccurate personal data or complete information that is materially incomplete. Some public profile information may be editable directly through account settings, but availability of self-service editing does not remove applicable statutory rights.

Where accuracy is disputed, processing may need to be restricted while the issue is considered in circumstances required by law.

6. Right to erasure

You may ask for personal data to be erased in circumstances where the right applies. The right to erasure is not absolute.

Herpegram may need or be entitled to retain particular information despite an erasure request, for example where retention is necessary for a legal obligation, the establishment, exercise or defence of legal claims, security and fraud records, or another applicable statutory ground. Preserved moderation evidence is not automatically erased merely because the original post or account is deleted; its continued retention must have a lawful basis and remain proportionate.

7. Right to restrict processing

In qualifying circumstances, you may ask Herpegram to restrict the processing of personal data. Restriction can mean retaining information while limiting further use, for example while accuracy or an objection is being assessed.

8. Right to data portability

Where the statutory conditions are met, you may be entitled to receive personal data you provided to Herpegram in a structured, commonly used and machine-readable format, or request eligible data be transmitted to another controller where technically feasible.

Data portability does not apply indiscriminately to every inferred score, moderation assessment, third-party record or category of data Herpegram holds.

9. Right to object

You may have the right to object to processing based on particular lawful bases, including certain processing based on legitimate interests. Herpegram will assess the objection against the applicable statutory test.

Where personal data is processed for direct marketing, applicable objection rights will be respected. Product notifications necessary to provide or secure an account are distinct from optional marketing communications.

10. Automated decision-making and CERBERUS

CERBERUS may automate ranking, recommendations, filtering, abuse signals or other service operations. Routine ranking does not necessarily amount to a solely automated decision producing legal or similarly significant effects.

If Herpegram uses solely automated processing to make a decision about a person that falls within statutory protections for significant automated decisions, Herpegram will provide the safeguards and information required by the law then in force, including any applicable route for human intervention, representations or challenge.

11. Deleting your account

Account deletion and the legal right to erasure overlap but are not identical. A deletion feature may remove the live account and public content while limited records remain for lawful retention purposes.

Herpegram should explain the practical consequences before deletion, including what happens to public Contaminations, Mutations, reports, subscriptions, security records and encrypted Transmission data where relevant to the production architecture.

12. Public content and other people's records

Deleting your content does not necessarily delete another user's independent personal data. For example, another person may hold their own lawful copy of a communication, and a moderation report may contain the reporting person's own account of an incident.

Herpegram will assess rights requests record by record where competing rights or legal obligations are involved.

13. End-to-end encrypted Transmissions

Herpegram's planned end-to-end encryption means the service is not intended to possess routine plaintext access to private Transmissions. A data-access request cannot force Herpegram to produce plaintext that Herpegram does not possess or cannot technically decrypt.

Herpegram may nevertheless hold associated personal data such as account identifiers, encrypted payloads, device or key-management information, timestamps or report material, depending on the final architecture and applicable retention rules.

14. Identity verification

Before disclosing, changing or deleting account data in response to a request, Herpegram may need to verify identity to avoid handing one Variant's information to another. Verification measures should be proportionate to the risk and information involved.

15. Response times

Herpegram will respond to rights requests within the period required by applicable data-protection law. Under the current UK framework many individual-rights requests are ordinarily subject to a one-month response period, subject to lawful extensions or modified timing rules where applicable.

If a request is refused or limited, Herpegram will provide the information and reasons required by law, including available complaint rights.

16. Fees and excessive requests

Herpegram will not impose a routine charge for exercising UK GDPR rights. A fee or refusal will only be considered where and to the extent permitted by applicable law, such as where a request is manifestly unfounded or excessive under the relevant statutory test.

17. Complaints to the ICO

You may have the right to complain to the Information Commissioner's Office about Herpegram's handling of personal data. Using Herpegram's internal privacy route first can allow us to investigate and correct an issue, but it does not remove a statutory right to approach the regulator.

18. Records of requests

Herpegram may retain appropriate records showing that a rights request was received, verified, assessed and answered. Such records support compliance, dispute handling and accountability and will themselves be subject to retention and security controls.

19. Contact route

Before public launch, Herpegram will publish a dedicated privacy contact and request mechanism here. The interface should make access, correction, export, restriction, objection and deletion requests understandable without requiring users to decipher legislation written by committees.