Your Data Rights

Effective date: October 1, 2026

This page describes the rights you have over the personal information Stone Kite Inc., a Delaware corporation ("Stone Kite," "we," "us") holds about you: how to make a request, how we check it is really you, how long we take, and what erasure does and does not reach. Read it alongside our Privacy Policy and Notice at Collection, which describes what we collect and why.

1. The rights you have

Depending on where you live, you have the right to:

- Access. Ask for a copy of the personal information we hold about you, as a machine-readable export.

- Correct. Ask us to fix information about you that is inaccurate.

- Delete. Ask us to erase your information. Section 6 describes what erasure reaches.

- Object. Object to certain processing, including profiling.

- Portability. Receive your information in a format you can take elsewhere.

- Opt out of sale or sharing. We do not sell personal information, and we do not share it for cross-context behavioral advertising. You can still register an opt-out, and we will honor it. We do not yet detect Global Privacy Control signals automatically, so this right is exercised through the request channel in Section 2 rather than by a browser signal.

- Not be discriminated against for exercising any of these rights.

If you are in the European Union or the United Kingdom, you may also withdraw consent at any time, and lodge a complaint with your supervisory authority.

2. How to make a request

Email privacy@stonekite.com and tell us which right you are exercising: access, correction, erasure, objection, portability, or opt out of sale or sharing. Include the email address on your account, or the address you gave us if you do not have an account. The date your email arrives starts our clock, not the date we read it.

3. How we verify it is you

We check who is asking before we act, so that no one else can reach your information or delete it.

- If you have an account, reply from the email address on the account, or sign in and confirm something only visible there.

- If you do not have an account, for example you only gave us an address on a notify-me or waitlist form, your request must come as a reply from that same address. Control of that mailbox is the only identity we hold for you.

- If you are an agent or a parent, or the request concerns a minor, we do not act on your say-so. We will tell you what we need and escalate the request internally before anything is done.

If we cannot verify a request after two attempts, we close it and tell you why.

4. How long we take

We respond within 30 days of receiving your request, which meets both the one-month deadline under the EU and UK GDPR and the 45-day deadline under California law. A genuinely complex request may need an extension, a further two months under GDPR or 45 days under California law; if we need one, we will tell you why before the original deadline passes.

5. What an access request covers

An export covers what Stone Kite holds in its own systems: your account and identity records, your orders and entitlements, the slice of our event ledger that relates to you, and the contact details held in our encrypted vault. We deliver it as JSON or CSV. Where a service provider holds data on our behalf, our published retention and erasure commitments still apply to it, and we will tell you which providers are involved in your request.

6. What erasure reaches, stated plainly

Erasure works by destroying your personal encryption key, which makes your personal data permanently unreadable in our production systems. We then run the same erasure through the services that hold data for us, including our store, our email provider, our analytics provider, and our community tooling.

Some things survive erasure, by design or by law:

- Consent records, which are the proof of what you agreed to and when.

- Email suppression records, which are the proof that an opt-out was honored. A suppression record is never deleted, because deleting it is what would let marketing reach you again.

- Transaction records held under financial record-keeping requirements. Your personal details in them are redacted; the transaction itself is retained.

- Aggregate statistics, which do not identify you.

- Anything held by Discord itself. The text of messages you posted on Discord belongs to Discord, not to us. Unlinking removes our connection and the participation metadata we gathered, but it does not delete anything Discord holds. Requests about that go to Discord.

7. Complaints

If you are unhappy with how we handled a request, tell us at privacy@stonekite.com and we will look at it again. If you are in the European Union or the United Kingdom you may complain to your data protection supervisory authority; if you are in California you may complain to the California Attorney General.

8. Contact

privacy@stonekite.com. Stone Kite Inc., PO Box 858, Santa Monica, CA 90406, United States.