Personal Information Rights and Requests

What it is

Depending on where you live, you can request to see, correct, or delete your personal data held by PlanetScale, and opt out of having your data shared for advertising.

Why it matters (compliance & governance perspective)

These rights are meaningful for EU, UK, and California users who have statutory entitlements to data access, portability, correction, and deletion, though the policy notes that some requests may be limited where fulfilling them would impair PlanetScale's legal obligations or service delivery.

Consumer impact (what this means for users)

Users in qualifying jurisdictions can email privacy@planetscale.com to exercise access, correction, deletion, or restriction rights, but the policy reserves the right to limit these requests where they conflict with legal obligations or service provision, and identity verification will be required.

What you can do

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: The rights described correspond to GDPR Articles 15-21 (access, rectification, erasure, restriction, portability, objection) and CCPA/CPRA rights to know, delete, correct, and opt out. The UK GDPR applies parallel rights for UK users. The policy's condition that rights depend on 'your location and the nature of your interactions' is appropriate given that these are jurisdiction-specific statutory entitlements, not universal contractual rights. The FTC and State AGs have enforcement authority over representations made about these rights. (2) GOVERNANCE EXPOSURE: Medium. The policy provides a single email contact point (privacy@planetscale.com) for all rights requests, which is operationally simple but may face scalability challenges. The statement that information access is already made available through the Privacy Policy itself does not satisfy GDPR Article 15's individual access right, which requires providing personal data specific to the individual requestor. The policy's limits on rights where 'fulfilling your request would impair the rights of others, our ability to provide a service you have requested, or our ability to comply with our legal obligations' are consistent with GDPR's permitted restrictions but should be applied narrowly. (3) JURISDICTION FLAGS: EU and UK users have the strongest statutory basis for these rights and can escalate to their national supervisory authority if unsatisfied. California residents have CPRA-based rights and can escalate to the California Privacy Protection Agency. The authorized agent provision is specifically required under CCPA/CPRA and is acknowledged in the policy. Users outside these jurisdictions may have more limited practical recourse if requests are denied. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers should note that this rights framework applies only to personal information PlanetScale processes as a controller, not to data processed on behalf of enterprise customers. B2B contracts should address how data subject rights requests from end users are routed and handled, as PlanetScale's obligations as a processor would be governed by the DPA rather than this policy. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that PlanetScale's identity verification process for rights requests does not itself collect excessive personal data or create barriers that effectively deny rights. Response time commitments are not specified in the policy; under GDPR, a one-month response period applies, and compliance teams should confirm operational capacity to meet this. The policy should be reviewed against CPRA's requirement to provide rights responses within 45 days.

Applicable agencies

Provision details

Other risks in this policy

• Enterprise Customer Data Processor Carve-Out high
• Interest-Based Advertising Data Sharing medium
• EU-US Data Privacy Framework Certification medium
• Do Not Track Non-Response low
• International Data Transfers and Cross-Border Safeguards medium
• Privacy Policy Modification Without Individual Notice medium