Your data rights

Which organisation should handle your request?

• If you use a UserGist dashboard account or contacted UserGist directly, contact UserGist about those records.
• If you used another company’s app, answered its survey, or submitted content to its portal, contact that company first. It decides how the information is used; UserGist generally assists on its instructions.
• If you cannot identify the responsible organisation, send the app name or portal URL to UserGist and we can help route the enquiry. Do not post a privacy request containing personal information on a public feedback board.

What to include

Contact [email protected] with the subject “Privacy request” or “Legal request”, as appropriate. Do not send passwords, API keys, payment card numbers, or identity documents in an initial message.

• State the request: access, correction, export, deletion, restriction, objection, consent withdrawal, or an appeal where available.
• For a dashboard account, use your account email and, if known, the workspace name. For an app or portal, include its name/URL and the email or app-scoped identifier you already use there.
• If you participate anonymously, say so. Provide an existing app-scoped identifier only if you have it; do not send credentials or create a new account just to make the request.
• For an authorised-agent request, describe your authority. We may ask for proportionate verification and confirmation with the individual where applicable.

Verification, response, and exceptions

We must verify requests proportionately so that one person cannot access or erase another person’s information. We will ask only for information reasonably needed to locate the records and establish authority, and use it for handling the request. Avoid sending government identity documents unless a justified secure verification process specifically requires them.

Applicable response periods depend on the law and context. GDPR ordinarily requires a response within one month; an extension of up to two further months may be available for complex or numerous requests with timely explanation. Other laws can use different periods. We must log receipt, route the request, and track the applicable deadline rather than assuming a single global period.

Rights can have legal exceptions, such as information needed for a mandatory record or legal claim, or content concerning other individuals. If a request is limited or refused, the response should explain why and identify available complaint or appeal routes. Exercising privacy rights should not cause unlawful discrimination.

Controls available in the product

• Dashboard account name and appearance can be managed in Account settings. The revised dashboard also provides optional analytics preferences.
• Authorised customer administrators can request app-user exports and deletion through app-scoped API/dashboard features, using an anonymous or external identity as applicable.
• An app integrating a UserGist SDK can apply and withdraw separate analytics, feedback, survey, and push choices where supported. Disabling push also requires the documented token and device-permission handling.
• Account closure, independent portal identities, historical analytics/replays, downstream integrations, and backup handling may need support and vendor follow-up. A client reset or expired download link is not server-side deletion.

Complaints and appeals

You may contact UserGist to challenge a response or ask how a request was handled. Where law gives you an appeal, identify the original request and why you disagree. You may also complain to the relevant data protection or consumer authority; you do not need our permission to do so.

Your competent authority can depend on your residence, workplace, and the processing concerned. The operator’s establishment and any designated EU/UK representative or DPO must be confirmed before naming those contacts in an effective notice. The existing contact address remains available for routing enquiries during preparation.