GDPR & Your Rights
Last updated: June 26, 2026
Under the General Data Protection Regulation (GDPR) you have the following rights regarding your personal data held by 3Desk.
Your rights at a glance
- Access (Art. 15) — Request a copy of the data we hold about you.
- Portability (Art. 20) — Export your data in a machine-readable format. Signed-in users: Settings → Account → Export my data (ZIP).
- Erasure (Art. 17) — Request deletion of your account and personal data. Signed-in users: Settings → Account → Delete account. Billing records are anonymized and retained for up to 10 years as required by law.
- Rectification (Art. 16) — Correct inaccurate data. Update your display name in Settings, or contact us for other corrections.
- Restriction (Art. 18) — Request we limit processing of your data while a dispute is resolved.
- Object (Art. 21) — Object to processing based on legitimate interests.
How to submit a request (DSAR)
Email us at privacy@3desk.net with the subject GDPR data request. Please include:
- Your registered email address
- The type of request (access / export / erasure / other)
- Any relevant details
We respond within 30 days. In complex cases we may extend by a further 60 days and will inform you.
Data we hold
- Account: email, display name, plan, storage quota
- Billing: wallet balance, transactions, AI generation usage and costs
- Projects: scenario, generated images, audio, video you create
- Technical: session tokens, server logs, rate-limit counters
Retention after deletion
- Personal and project files: removed immediately on account deletion
- Billing records: anonymized and archived for up to 10 years (tax / accounting legal basis)
- Debug logs: purged after 90 days
Supervisory authority
If you believe we have not handled your data correctly, you have the right to lodge a complaint with your local data protection authority. In Bulgaria: Commission for Personal Data Protection (CPDP).