Data Subject Rights (GDPR)

Updated 10 September 2026. If the GDPR applies to you, these rights are yours over the data Girli holds about you. The Privacy Policy says what that data is; this page says how to make us do something about it. One address for all of it: support@girli.app.

The rights

• Access. A copy of what we hold, in a readable form: account fields, conversations, companion memory, characters, payment records.
• Rectification. Correction of anything wrong. Your email address you can change yourself in settings.
• Erasure. Deletion of the account and everything tied to it. Settings does this immediately; we will also do it on request.
• Restriction. We stop processing but keep the data, while a dispute about it is resolved.
• Portability. The data you gave us, in a machine-readable file, for you or for another service.
• Objection. To processing based on legitimate interest, including statistics.
• Withdraw consent. Wherever consent was the basis, taking it back is as easy as giving it, and it does not affect what was lawful before.
• Human review. No decision with a legal effect on you is made by automation alone. Automated moderation can suspend an account; a person reviews that on request.

How to file a request

Write to support@girli.app from the email address of the account, say which right you are using, and say what you want. Writing from the account address is how we verify you; if that is impossible, we will ask for something else that proves the account is yours, and we will ask for the least that will do.

We answer within 30 days. A complicated request can take up to 90, and if that happens we tell you inside the first 30 and say why. Requests are free. We only charge for a repeated copy of the same data, and only what it costs us.

What we cannot delete

Financial and tax records have a statutory retention period that outlives the account: we must keep the fact and the amount of a payment even after everything else is gone. Records kept to investigate a serious violation are also retained for as long as that takes. Everything else goes.

Transfers outside the EEA

Some processors - hosting, GPU compute, email delivery, payment - operate outside the EEA. Where they do, the transfer rests on the European Commission's standard contractual clauses or on an adequacy decision. The categories of processor are listed in the Privacy Policy.

Complaining

If our answer does not satisfy you, you can complain to the data protection authority of your country of residence or workplace. We would rather you told us first: most of these end up being something we can simply fix.