Privacy Request

CCPA / CPRA / GDPR / COPPA — submit a data subject request

Use this form to exercise your privacy rights under California law (CCPA/CPRA), the EU/UK GDPR, COPPA (parents of children under 13), or similar state laws. We respond within the legally required timeframe (45 days for California, 30 days for GDPR, 5 business days for COPPA parental requests).

Submit a Request

What would you like to do? * Your email * Where do you live? (helps us meet the right SLA) If this is a parent request, your child's BrainCandy username: Anything else we should know?

I confirm that I am the person whose data this request concerns (or the parent/guardian of a minor whose data is involved). Submitting a fraudulent request may be a crime.

If you prefer email, you can also write directly to privacy@braincandy.im (privacy/CCPA/GDPR) or safety@braincandy.im (parent / COPPA requests).

What happens next

Confirmation: You'll receive a reference number on screen and a confirmation email.
Identity verification: For sensitive requests (deletion, opt-out, parent action), we may ask you to verify identity by replying from the email associated with the account.
Resolution: California requests within 45 days, EU/UK GDPR within 30 days, COPPA parent requests within 5 business days, all others within 30 days. Most are completed faster.
Response: We email the result and, where applicable, a download link or confirmation of action taken.

What we cannot delete

Some records must be retained for legal or tax reasons even after you delete your account:

Creator payout records (7 years for IRS reporting)
Fraud/security audit logs (1 year)
Anonymized usage analytics (no longer identifies you)

Everything else is purged within 30 days of completing your deletion.