Privacy center
GDPR and California rights matrix
A practical map of what Apphelm processes and how people can exercise GDPR, UK GDPR, CCPA and CPRA rights.
Effective 22 September 2026 · Version 1.31. Rights matrix
| Right | GDPR / UK GDPR | California CCPA / CPRA | How Apphelm responds |
|---|---|---|---|
| Know / access | Access and processing information | Categories, sources, purposes, recipients and specific pieces | Verified export in a portable format |
| Correct | Rectification | Correction of inaccurate PI | Account edits or verified correction workflow |
| Delete | Erasure where grounds apply | Deletion subject to exceptions | Delete, de-identify or document a lawful exception |
| Portable copy | Portability for certain automated data | Portable access where required | JSON/CSV export for supported data |
| Restrict / object | Restriction and objection, including legitimate interests | Opt out of sale/sharing and targeted advertising | Suppress processing; Apphelm does not sell/share for cross-context ads |
| Limit sensitive PI | Special-category safeguards | Limit certain uses/disclosures | Prohibited sensitive capture; no sensitive inference |
| Automated decisions | Safeguards for solely automated significant decisions | Rights as regulations require | Apphelm insights are advisory; human review is required |
| Appeal / complain | Supervisory-authority complaint | Appeal a denied request where applicable | Written appeal review and regulator information |
| Non-discrimination | Fair treatment principles | No discriminatory treatment for exercising rights | Core service is not degraded for a privacy request |
2. California category matrix
| Category | Examples processed | Sources / purposes | Sold or shared? | Retention |
|---|---|---|---|---|
| Identifiers | Email, account ID, pseudonymous user/account IDs, limited IP security metadata | Direct, customer SDK, integrations; account, security, telemetry | No | Account term; security logs up to 24 months |
| Customer records / commercial information | Organization, plan, subscription status, product adoption | Direct and commerce integration; service and billing | No | Account term and legal billing period |
| Internet or electronic activity | Routes, events, interactions, sessions, performance, errors | Customer-configured SDK; analytics and reliability | No | Customer-selected plan retention |
| Approximate geolocation | Country/region derived at edge when enabled | Network request; security and aggregate analysis | No | Per customer retention; full IP not stored as analytics property |
| Professional information | Role, team membership | Direct; permissions and collaboration | No | Account term |
| Inferences | Product-health and likely-cause findings about product systems | Customer telemetry; operational recommendations | No | Insight/audit retention |
| Sensitive PI | Account credentials are hashed/tokenized; prohibited replay fields are blocked | Direct; authentication only | No; not used to infer characteristics | Security/session schedule |
Categories not listed are not intentionally collected. Apphelm has no actual knowledge that it sells or shares personal information of consumers under 16.
3. Submit a request
We verify requests proportionately and normally respond within one month under GDPR/UK GDPR or 45 days under California law, subject to permitted extensions. Authorized agents may submit a request and will be asked for proof of authority.