Toast · Legal

Your Data Rights

Last updated
2026-05-26
Effective
2026-05-26

You have rights over the personal data Toast holds about you. This page explains how to exercise them.

For full details on what data we collect and how we use it, see our Privacy Policy.

What you can ask for

Depending on where you live (Thailand under PDPA, the European Union or United Kingdom under GDPR, California under CCPA/CPRA, and other jurisdictions), you have one or more of the following rights:

  1. Access — Get a copy of the personal data we hold about you.
  2. Correction — Ask us to fix data that is wrong or out of date.
  3. Deletion — Ask us to delete your personal data.
  4. Portability — Receive your data in a structured, machine-readable format and transmit it to another service.
  5. Restriction — Ask us to stop using your data in specific ways.
  6. Objection — Object to particular processing (for example, processing based on our legitimate interest).
  7. Withdraw consent — Withdraw any consent you gave us, without affecting prior processing.
  8. Complain — Lodge a complaint with your local data-protection authority.

In Thailand, the relevant authority is the Personal Data Protection Committee (PDPC). In the EU/UK, it is your national data-protection authority.

How to make a request

Email hello@ericerialabs.com with:

  • The right you wish to exercise (e.g., "access" or "deletion")
  • The email or anonymous user ID associated with your account
  • Enough information to confirm your identity (we may request additional verification to prevent fraud)

We respond within 30 days of receiving a complete, verifiable request. For complex requests, we may extend by up to 60 additional days and will tell you why.

In-app shortcuts

You can also exercise some rights directly in the app:

  • Delete account — Settings → (coming soon)
  • Export data — Email hello@ericerialabs.com; we will send a JSON archive
  • Reset onboarding — Settings (in DEBUG builds; production users delete and reinstall)

Charges

We do not charge for normal data-rights requests. We may refuse or charge a reasonable fee for requests that are manifestly unfounded or excessive (for example, requests we have already fulfilled and that you repeat).

What happens to deleted data

When you delete your account, your personal data is purged from our active systems within 30 days. Encrypted backups are deleted within 90 days. Anonymized aggregate statistics (with no link to you) may be retained indefinitely.

Contact