HighFear is operated by Taciturn Studios LLC.
If you are located in the European Union, United Kingdom, or EEA, you have specific rights under the General Data Protection Regulation (GDPR) and UK GDPR regarding your personal data. This page explains who controls your data, what rights you have, and how to exercise them.
Data Controller
The data controller responsible for your personal data collected through HighFear is:
We do not have a designated Data Protection Officer (DPO) as we do not meet the thresholds requiring mandatory DPO appointment under GDPR Article 37. For all data protection enquiries, contact us at the email above.
Legal Basis for Processing
We process your personal data on the following legal bases:
- Contract performance (Article 6(1)(b)): Processing necessary to provide our services, including account management and digital product delivery.
- Legitimate interests (Article 6(1)(f)): Analytics, fraud prevention, and site security.
- Consent (Article 6(1)(a)): Newsletter subscriptions, advertising cookies, and non-essential analytics. You may withdraw consent at any time.
- Legal obligation (Article 6(1)(c)): Compliance with applicable laws, including financial record-keeping.
Your Rights
Right to Access (Article 15): You can request a copy of the personal data we hold about you, including the categories of data, the purposes of processing, and any third parties with whom we share it.
Right to Rectification (Article 16): You can request that we correct inaccurate or incomplete personal data.
Right to Erasure (Article 17): You can request that we delete your personal data ("right to be forgotten") where it is no longer necessary for the purposes it was collected, or where you withdraw consent.
Right to Restrict Processing (Article 18): You can request that we limit how we use your data in certain circumstances, such as while a rectification request is being assessed.
Right to Data Portability (Article 20): Where processing is based on consent or contract and carried out by automated means, you can request your data in a structured, machine-readable format (JSON or CSV).
Right to Object (Article 21): You can object to our processing of your data for direct marketing purposes at any time. You can also object to processing based on legitimate interests, though we may be able to demonstrate compelling grounds to continue.
Right to Withdraw Consent (Article 7(3)): Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.
Right Not to Be Subject to Automated Decision-Making (Article 22): HighFear uses AI tools (including FearBot and quiz scoring algorithms) that may produce automated outputs based on your inputs. These outputs are for informational and entertainment purposes only and do not produce legal or similarly significant effects on you. No automated profiling is used to make decisions about your access to services, creditworthiness, or any other consequential matter. You have the right to request human review of any automated output that you believe has affected you.
International Data Transfers
HighFear is operated from the United States. If you are located in the EU/EEA/UK, your personal data may be transferred to and processed in the United States. Where such transfers occur, we rely on Standard Contractual Clauses (SCCs) or other appropriate safeguards as required by GDPR Chapter V. Our key processors (Stripe, Google, MailerLite, Resend) maintain their own GDPR-compliant data transfer mechanisms.
How to Exercise Your Rights
To exercise any of these rights, email privacy@highfear.com with the subject line "GDPR Request" and include your name, email address, and a description of the right you wish to exercise. We will respond within 30 days (extendable by a further 60 days for complex requests, with notice).
We may need to verify your identity before processing your request to protect your data from unauthorized access.
Complaints
If you believe we have not handled your data correctly, you have the right to lodge a complaint with your local supervisory authority. In the UK, this is the Information Commissioner's Office (ICO). In the EU, contact your national data protection authority via the European Data Protection Board directory.
We would appreciate the opportunity to address your concerns before you contact a supervisory authority — please reach out to us first at privacy@highfear.com.
Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:
- Account data: Retained for the duration of your account plus 30 days after deletion request.
- Purchase records: Retained for 7 years as required by financial regulations.
- Analytics data: Aggregated and anonymized after 26 months.
- Newsletter subscriptions: Retained until you unsubscribe.
- AI chat transcripts: Retained for 90 days for service improvement, then deleted.
Cookies and Tracking
We use cookies and similar technologies as described in our Cookie Policy. Under GDPR, non-essential cookies require your consent, which you can manage through our cookie consent banner. Essential cookies (session authentication, security) are processed under our legitimate interest and do not require consent.
Children's Data
HighFear does not knowingly collect personal data from children under 16 years of age. If we become aware that we have collected data from a child under 16 without parental consent, we will take steps to delete that information promptly. If you believe a child has provided us with personal data, please contact us at privacy@highfear.com.
Changes to This Policy
We may update this GDPR Rights page from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last Updated" date. We encourage you to review this page periodically.