Data Deletion Policy

Version: Launch Suite vL1 (rev. 8.1) · Effective date: 29 September 2026

Steez — operated by Steelo Labs Ltd (registered in England and Wales, company number 15553648) Registered office: Steelo Labs Ltd, 3 Harebell Close, Hamilton, Leicester, England, LE5 1UX Contact for data matters: privacy@steez.space

This policy explains how to delete your Steez account and personal data, what we delete, what we keep, and how we handle data held by connected third-party platforms. It also explains the instruction page we publish for Google Play's Data Safety form and for Meta's data-deletion requirements.

Steez's paid services are offered in the UK and US at launch (Terms of Service §2.1). This policy applies wherever you use Steez. Your local law may give you data-deletion or consumer rights that cannot be excluded by contract; where it does, those mandatory local rights prevail over anything in this policy that would give you less. Section 10 sets out additional rights for users in the United Kingdom, the European Union / European Economic Area, and the United States.

This policy forms part of the Steez legal document set and should be read alongside our Privacy Policy, Terms of Service, Creator Terms & Earnings Agreement, and Refund & Cancellation Policy. Capitalised terms not defined here have the meanings given in those documents.

Quick-Reference Summary

1. Definitions

1.1 "Account data" means the personal information associated with your Steez account, including your display name, email address, profile photo, and usage history.

1.2 "Financial records" means records of transactions, subscription payments, content purchases, first-hand Steez purchases and sales, earnings, and payouts processed through the platform.

1.3 "Platform Data" means data obtained from a connected third-party platform (Meta/Instagram, Google/YouTube, TikTok, Spotify) through our OAuth integration.

1.4 "UGC" (User-Generated Content) means posts, videos, images, comments, messages, and other content you have submitted to Steez.

1.5 "Steez" or a "Key" means a personal licence that lets you access only what a creator explicitly offers (such as Mosaic exclusives, Village community access, and creator-picked Perks). A Steez is not a financial asset, security, investment, e-money, stored value, deposit, trust asset, ownership interest, or share of creator/platform revenue, and it does not give you ownership of anything. Its value to you is the access it unlocks while you hold it and while your account remains open.

A Steez Key is personal, non-transferable, and non-resellable — it is tied to your account and to the creator who issued it. References in this policy to a "Steez you hold" mean a Key (an access licence) associated with your account; a Key is not a financial asset and has no cash or stored value that we pay out.

1.6 "Moderation records" means records of reports made about your content or account, enforcement actions taken, and ban history.

1.7 "GDPR" means, in the United Kingdom, the UK General Data Protection Regulation (retained in UK law by the European Union (Withdrawal) Act 2018) as amended by the Data Protection Act 2018 and the Data (Use and Access) Act 2025; and, for users in the European Union / European Economic Area, Regulation (EU) 2016/679 (the EU GDPR). Where this policy refers to a GDPR Article number, it refers to the equivalent Article in whichever of those regimes applies to you.

1.8 "Erasure request" means a request to delete your personal data made under Article 17 GDPR (or an equivalent right under your local law).

1.9 "Grace period" means the 30-day window after you submit a deletion request during which your account is suspended but not yet permanently deleted.

2. How to Delete Your Account

What this section says: You can ask us to delete your account through the app or by contacting us. After you request deletion, there is a 30-day window during which you can change your mind. After 30 days, deletion is permanent and most data cannot be recovered.

2.1 In-app deletion path

To delete your account within the Steez app:

1. Go to Settings (tap your profile icon, then the gear icon).
2. Select Account.
3. Select Delete Account.
4. Read the information about what will be deleted and what will be kept.
5. Confirm your intention by following the on-screen steps.

Your account will enter a 30-day grace period immediately after you confirm (or, if you choose the immediate option described in section 3.1, deletion proceeds without a grace period and is irreversible).

2.2 Web deletion-instructions page (Google Play and Meta)

If you cannot access the app, you may request account deletion by following the instructions at:

https://steez.space/delete-account

This page provides step-by-step instructions and a way to submit a request. Requests submitted through the web page are handled in the same way as in-app requests. You have the same two equally available choices as in the app: a 30-day grace period (during which you can change your mind) or immediate, irreversible erasure (section 3.1). Choosing one is never inferred from your silence, and not choosing the grace period does not waive your right to immediate erasure.

This URL is the deletion-instructions URL we register with Google Play's Data Safety form.

Important — Meta: this instructions page is not, on its own, a substitute for the technical data-deletion callback that Meta's Platform Terms §3.d require for apps using Facebook Login or Instagram. We operate that data-deletion callback (an HMAC-verified callback endpoint with a status-check route — see §9.2), meeting Meta's data-deletion-callback requirement. This instructions page additionally lets you ask us to delete Meta-derived data manually; it is a supplementary route alongside the callback, not a substitute for it.

2.3 Email request

If you are unable to use the in-app method, you may submit an erasure request by email to privacy@steez.space. We will verify your identity before processing an emailed request. We will respond within one calendar month as required by Article 12 GDPR (and, for users outside the UK/EU/EEA, within the period required by your local law).

2.4 Confirming your deletion request

Once you submit a deletion request, we will send a confirmation to your registered email address. That confirmation will state:

• the date your grace period ends — or, if you chose the immediate, irreversible deletion route in section 3.1, confirmation that no grace period applies and that deletion will proceed without a recovery window;
• what will be deleted permanently;
• what will be retained and why;
• how to cancel the request if you change your mind (this applies only to the 30-day grace-period route; the immediate route in section 3.1 cannot be cancelled once actioned).

3. The 30-Day Grace Period

What this section says: You choose how deletion happens — either an immediate, irreversible deletion, or an optional 30-day recovery period in case you change your mind. Either way, your account stops being visible and processing stops straight away.

3.1 When you request deletion you may choose either: (a) optional account closure with a 30-day recovery period (your account is suspended and you can restore it within 30 days); or (b) immediate, irreversible deletion — an Article 17 erasure request that we action without undue delay. Under either route, public display, recommendation, analytics and marketing stop immediately.

3.2 During the grace period:

• Your profile and content are not visible to other users.
• You cannot use your Steez account to access content, make or receive payments, or receive earnings.

3.3 To cancel your deletion request during the grace period, log back into the Steez app; where the in-app restore screen is available you will be shown an option to Restore Account or continue with deletion. If you cannot access that screen, contact privacy@steez.space within the 30-day window and we will cancel the request.

3.4 After the grace period expires, deletion is permanent. We cannot recover your account or most of your personal data after this point.

3.5 Nothing in this grace period affects your statutory rights. If you are also exercising a consumer cancellation or refund right (for example a cooling-off right or a remedy for faulty digital content), that right is handled separately and immediately under our Refund & Cancellation Policy and your local consumer law — it does not wait for, and is not limited by, the deletion grace period.

3.6 Residual copies in backups. Once deletion is complete, we remove your personal data from our live systems. Limited residual copies may persist in our encrypted backups for a limited period after erasure; where they do, they are isolated and placed beyond use — not accessed or used for any other purpose — until they are overwritten in the normal course of our backup cycle.

4. Operational steps before deletion completes

What this section says: You may request account deletion at any time. If you have active subscriptions, unsettled payouts, or unresolved payment/legal issues, we may need to retain limited information or take steps to cancel, settle, or preserve records before deletion is completed. We will explain any delay, the lawful basis for retention, and what you need to do. Your consumer cancellation/refund rights are handled separately and are not delayed by an account-deletion request.

4.1 Active subscriptions: You may submit your deletion request even if you have active subscriptions. If you have any active subscriptions to a creator at the time you request deletion, we may require those subscriptions to be cancelled to stop future charges and access — but this is an operational step, not a precondition to us accepting your erasure request. Go to Settings > Subscriptions to cancel; cancellation takes effect at the end of the current billing period. We will explain any delay this causes to completion of the deletion. Cancelling a subscription never delays erasure of personal data unrelated to that billing relationship: only the billing, tax, dispute, and legal-hold records we are legally required to retain (sections 5.2 and 6) are kept, and your other personal data is erased on the normal timeline regardless of active subscriptions or unsettled earnings. Every Steez subscription is billed by us through Stripe, so we can always cancel it for you if you ask (Terms of Service clauses 10.1 and 10.5); you never need to cancel through an app store. Cancelling is an operational step for your benefit and is not a precondition to erasure of your personal data. This does not affect any statutory cancellation or refund right you may have, which is handled under the Refund & Cancellation Policy.

4.2 Steez (Keys) and content unlocks you hold: A Steez is a personal access Key — a licence to access what a creator offers (see section 1.5). It is not a financial asset and has no cash or stored value. A Steez Key (and a content unlock) is non-transferable and non-resellable, so there is nothing you need to sell, list, or dispose of before deleting your account: holding a Key never prevents you from requesting deletion at any time, and we will never require you to give up a Key as a condition of erasure. We do not simply destroy paid entitlements on deletion: before irreversible deletion completes, we build an inventory of the Steez (Keys) and content unlocks tied to your account and give you the choice of either (a) preserving that entitlement through a minimal pseudonymous record together with a secure, single-use re-link token — valid for 12 months from deletion (a shorter period than, and separate from, our financial-record retention in section 6.2) — that lets you redeem the preserved entitlement on a new account (see section 12.2), except that an account terminated for a serious safety breach may not redeem a preserved entitlement on a new account, or (b) an appropriate refund for access you have paid for but will lose. We will show you the available option and any refund amount on the confirmation screen before deletion completes, and you must confirm your choice there before deletion proceeds. Access on the deleted account ends when deletion is permanent, and no cash value is ever paid out on the Key itself; where you instead choose to preserve the entitlement, it is the re-link token — not the deleted account — that lets you regain it later. Deleting and re-creating an account without redeeming a preserved re-link token does not recover previously held Steez or content unlocks. Your statutory rights are unaffected: if you believe you are owed a refund in respect of access you have paid for but will lose by deleting, deleting your account does not waive that right — it is handled under your statutory rights and our Refund & Cancellation Policy. In particular, if you delete your account within the 14-day cancellation period for a first-hand Steez or a content unlock and you did not validly waive that cancellation right at checkout, your cooling-off refund still applies and is processed under the Refund & Cancellation Policy; deleting your account is not treated as giving up that refund. Active subscriptions: this preserve-or-refund choice covers one-off Steez and content-unlock entitlements only. For a grace-period deletion, any active creator or Steez Pro subscription (section 4.1) is automatically cancelled when deletion executes at the end of the 30-day grace period.

4.3 Creator accounts: If you are a registered creator with an active Stripe Connect account, you may request deletion at any time. Deletion of a creator account involves additional steps to close your Connect account and ensure all earned-but-unsettled funds (including any first-hand Steez royalties and subscription/content earnings) are distributed by Stripe; we will contact you to complete those steps — you do not need to contact support before requesting deletion. Your creator payout records are retained and reported as described in sections 5.2 and 6 (including under digital-platform tax-reporting rules).

4.4 Active enforcement or dispute: If your account is the subject of an active safety investigation, legal hold, or unresolved payment dispute, deletion may be temporarily paused. We will notify you of any hold and its expected duration. We will lift the hold as soon as it is legally or operationally appropriate to do so. A pause under this clause does not suspend any statutory deletion right beyond what the relevant law allows.

5. What We Delete

What this section says: When your account is permanently deleted, we remove your personal data from our live systems. We set out below exactly what happens to each category of data.

5.1 Account and profile data

The following are permanently and irreversibly deleted:

• Display name, username, and profile photo
• Email address and phone number
• Date of birth, where held
• Password / authentication credentials (via Firebase Authentication)
• Referral code
• Contact-discovery hash records (SHA-256 hashes of email and phone used for the Find Friends feature, which is opt-in)
• FCM (push notification) device tokens
• OAuth tokens and access tokens for connected third-party accounts (see section 9 for per-platform detail)
• Payment method records stored in Stripe (card tokens) — note: Stripe may retain some records independently as a regulated payments processor
• Mosaic performance session records (device model, OS version, play/swipe/error counts tied to your user ID)

5.2 Subscriptions, collections and purchase records

Your subscription records and purchase records — including content unlocks and first-hand Steez purchases — are pseudonymised and access-restricted, not deleted, to comply with our financial-record retention obligation (see section 6.2). Your name and direct contact details are removed and access is restricted, but the records remain personal data because they must retain the transaction data our tax and accounting obligations require.

This applies to every purchase. All purchases are made through Stripe's secure checkout, reached from our website; Stripe may also keep some payment records independently as a regulated payment processor (section 5). Records of platform fees — for example the platform's share of a creator subscription, content collection, or first-hand Steez sale (20%) — are retained in the same pseudonymised, access-restricted financial-record form.

5.3 User-generated content (UGC)

Fan-submitted content (comments, community chat messages, reactions, direct messages):

• Direct (private) messages are erased when your account is permanently deleted, unless a legal hold requires us to retain specific messages. We do not keep your private messages after deletion in the ordinary course.
• Public comments, community chat messages and reactions may remain visible in context (for example, in a comment thread) but are pseudonymised — your name and user ID are removed and the content is attributed to "Deleted User". Because the underlying content is not itself deleted and could in principle be linked back to you, this is pseudonymisation, not anonymisation. If the content is directly harmful or the subject of a moderation action, it may be removed rather than pseudonymised.

Creator-submitted content (posts, videos, images):

Creator posts and Mux-hosted video assets are subject to the following process:

• Posts that have no paid purchasers: the post and associated Mux video asset are deleted from our systems and from Mux's infrastructure. See section 7 for Mux asset deletion details.
• Exclusive content that fans have paid for: creators cannot hard-delete exclusive content that fans have already paid to access. A creator may "hide" or "disable" such content (which stops further purchases), but existing purchasers retain their access. Accordingly, where you delete your creator account, exclusive content that has existing paid purchasers is not destroyed: access for those existing purchasers is preserved, and the content is hidden from new sales. The only exception is a legal takedown (for example a valid copyright or unlawful-content removal), in which case access ends and any consumer remedy is handled under the Refund & Cancellation Policy.

The intellectual-property licence you granted to Steelo Labs in the Creator Terms & Earnings Agreement survives account deletion to the extent necessary to continue delivering already-purchased exclusive content to existing purchasers. This does not mean we continue displaying your content publicly — public visibility ends when your account is deleted.

IP and licence interplay: The intellectual-property rights in your content remain yours. Steelo Labs does not acquire ownership of your content and takes no ownership of music or other material you post. The survival of the hosting licence is limited, personal, and non-transferable, and exists only to honour access already paid for. See the Creator Terms & Earnings Agreement section on content licences for full details.

6. What We Keep — Retention After Deletion

What this section says: Some data must be kept by law or for legitimate safety reasons even after your account is deleted. This section sets out exactly what is kept, for how long, and why.

6.1 Overview

You may request deletion at any time. Some records may be retained where required for tax, accounting, fraud prevention, legal claims, safety, payment disputes, or statutory obligations. Active subscriptions or unsettled payouts may require cancellation, settlement, or limited retention, but they do not remove your right to submit an erasure request.

6.2 Financial records — retention period

UK tax and accounting law requires financial records to be kept for 6 years — principally the corporation-tax record requirement (Finance Act 1998 Sch 18 para 21) and the VAT record requirement (VAT Act 1994 s.58). (The Companies Act 2006 s.388 minimum for company accounting records is 3 years; we retain for the longer 6-year tax period.) Our standard retention period for financial records is therefore 6 years from the end of the relevant financial year. Where VAT One-Stop-Shop (OSS) records apply, the required period may be up to 10 years.

Because you may transact from more than one territory, other tax and accounting regimes may impose their own retention periods on transactions in their jurisdictions. Where a jurisdiction in which you transacted requires a longer period, we keep the relevant records for that longer period; we do not keep them for longer than the longest applicable legal obligation requires.

Where value-added tax, goods-and-services tax, or equivalent sales tax applies to a transaction, records sufficient to evidence that tax are retained on the same basis.

These records are pseudonymised and access-restricted within our live systems when your account is deleted: your name and direct contact details are removed and access is restricted, but the records remain personal data while re-identification is reasonably possible — they must retain the transaction data our tax, accounting and audit obligations require. The legal basis is Article 6(1)(c) GDPR (compliance with a legal obligation).

6.3 Creator payout and tax-reporting records

If you earned money as a creator, records of your payouts are kept and, where the digital-platform reporting rules require it, reported to tax authorities. In the UK these rules are the OECD Model Reporting Rules for Digital Platforms as implemented by SI 2023/817 (and equivalent rules in other jurisdictions). Reporting is not automatic for every payout: it applies to reportable sellers, after we have completed the seller due-diligence and classification the rules require. The low-volume exclusion (fewer than 30 transactions and no more than €2,000) applies to sales of goods and is not assumed for creator services. Reportable earnings include your royalties from subscriptions, content collections, and first-hand Steez sales (80%). We keep the records these reporting rules require for the period they specify — currently 5 years from the end of the reportable period — which is separate from, and where applicable runs alongside, the 6-year accounting-record period in section 6.2; where both periods apply to the same record, the longer one governs.

6.4 Moderation and ban records

Records of enforcement actions taken on your account (content removals, warnings, mutes, bans) are retained for 6 years from the date of the action. This period corresponds to the general limitation period under the Limitation Act 1980 and allows us to defend legal claims, investigate patterns of abuse, and maintain platform safety.

The legal basis is Article 6(1)(f) GDPR (legitimate interests). We have weighed this against your rights and freedoms and determined that the safety interest is proportionate. These records are not used for any purpose other than safety, legal defence, or regulatory compliance.

After 6 years, moderation records are permanently deleted unless a legal hold applies.

7. Mux Video Asset Deletion

7.1 Steez uses Mux, Inc. ("Mux") to host and deliver video content. When a creator's video post is deleted (either by the creator or as part of account deletion), we send a deletion request to Mux's API to remove the corresponding video asset from Mux's infrastructure. This does not apply to exclusive content that existing fans have paid to access, which is preserved for those purchasers as described in section 5.3.

7.2 Mux processes deletion requests promptly, but there may be a short technical propagation delay before the asset is fully removed from all CDN edge nodes. We cannot guarantee instantaneous removal from all Mux infrastructure.

7.3 Viewer telemetry data sent to Mux Data (including your Firebase UID as a viewer identifier, device model, OS version, and connection type) is governed by Mux's own data retention and deletion policies. We will request deletion of your Mux Data viewer records as part of our erasure process where Mux provides the technical mechanism to do so. See the Privacy Policy for further details on Mux as a data processor.

7.4 Mux operates under an Article 28 GDPR data processing agreement with Steelo Labs Ltd.

8. Deletion of Data Held by App Stores

8.1 Apple App Store: If you downloaded Steez through the Apple App Store, or used Sign in with Apple, Apple independently holds certain records (for example your app-download record). We do not sell through Apple's in-app purchase system, so Apple holds no Steez purchase records. For data held by Apple, use Apple's data and privacy tools at https://privacy.apple.com.

8.2 Google Play: Google Play processes certain data independently when you download and use apps from its store. Steez's Data Safety form on Google Play registers this policy page (https://steez.space/delete-account) as the deletion-instructions URL. For data held by Google independently (for example, your app installation record), you should use Google's own account-deletion tools at https://myaccount.google.com.

9. Connected Third-Party Accounts — Platform Data Deletion

What this section says: If you connected your Steez account to another platform (such as YouTube, Instagram, Spotify, or TikTok), disconnecting and deleting your Steez account removes our access to your data on those platforms. You should also revoke access directly on those platforms.

9.1 How to disconnect before or during deletion

You can disconnect any connected account at any time, independently of a deletion request:

1. Go to Settings > Connected Accounts.
2. Select the platform you want to disconnect.
3. Tap Disconnect.

Disconnecting removes our OAuth access token and stops any data sync between that platform and Steez. Where the relevant developer policy requires it, we delete any Platform Data we hold for that platform on disconnection.

9.2 Meta (Instagram / Facebook)

Data we hold: OAuth access tokens; published post metadata (if you used Steez to publish to Instagram); public profile identifier.

On disconnection or account deletion: We revoke our OAuth access token and delete Platform Data obtained through the Meta integration from our systems.

Manual deletion route for Meta data: If you used Facebook Login or Instagram with Steez and want to confirm deletion of all associated data, visit https://steez.space/delete-account and follow the instructions, or contact privacy@steez.space. You can also verify what apps have access to your Meta data at https://www.facebook.com/settings?tab=applications and revoke Steez's access there.

Independent revocation on Meta: https://www.facebook.com/settings?tab=applications (Facebook) / Instagram Settings > Security > Apps and Websites.

9.3 Google / YouTube

Data we hold: OAuth access tokens; YouTube channel identifier and any authorised channel data (e.g. video metadata accessed for distribution features); viewer data sent to Mux (governed separately — see section 7).

30-day refresh/delete obligation: Under YouTube API Services Developer Policies §III.E.4.c, we are required to refresh or delete stored Authorised Data (YouTube user data held server-side) after 30 calendar days. We honour this obligation by refreshing tokens on active connections and deleting YouTube-origin data within 30 days of disconnection or token expiry, whichever is earlier.

On disconnection or account deletion: We revoke our OAuth access token (calling the revocation endpoint) and delete stored YouTube Platform Data from our systems within 30 days.

Independent revocation on Google: https://security.google.com/settings/security/permissions — revoke "Steez" from this page.

Google Privacy Policy: https://policies.google.com/privacy

Limited Use statement: Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

YouTube Terms of Service: Use of the YouTube integration is subject to the YouTube Terms of Service (https://www.youtube.com/t/terms). By connecting your YouTube account, you agree to be bound by those terms.

9.4 TikTok

Data we hold: OAuth access tokens; TikTok user identifier; any content metadata obtained for display or distribution features.

On disconnection or account deletion: We revoke our OAuth access token and delete TikTok Platform Data from our systems.

Independent revocation on TikTok: TikTok App > Profile > Settings > Security > Manage App Authorisations > Steez.

9.5 Spotify

Data we hold: OAuth access tokens; Spotify user ID; listening or library metadata obtained for music-linking features.

On disconnection — Spotify-specific rule: Under Spotify Developer Policy §I.1.b, when you disconnect your Spotify account from Steez, we delete all Spotify personal data we hold about you and stop all processing. This is automatic and occurs immediately upon disconnection.

On account deletion: Spotify Platform Data is treated the same as disconnection — deleted from our systems immediately.

No AI/ML use of Spotify data: We do not train or ingest Spotify content or your Spotify data into any machine-learning or artificial-intelligence model.

Independent revocation on Spotify: Spotify > Settings > Security and Privacy > Manage Apps > Steez > Remove Access.

10. Your Data Subject Rights (Erasure and Beyond)

10.1 Your right to erasure (Article 17 GDPR, or its local equivalent) is what this policy primarily addresses. For the full statement of all your data rights — including the right of access, rectification, restriction, data portability, and objection — please read our Privacy Policy.

10.2 To make a data subject access request (DSAR) or any rights request other than account deletion, contact us at privacy@steez.space. We will respond within one calendar month (or within the period your local law requires). We may ask you to verify your identity before responding. Where a self-serve route for a given right is not yet built, you can exercise that right by contacting us at this address and we will action it manually within the applicable time limit.

10.3 Users in the United Kingdom

10.3.1 If you are in the UK, your data is controlled by Steelo Labs Ltd and processed under UK GDPR and the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025). Steelo Labs Ltd is registered with the Information Commissioner's Office (ICO), registration reference ZB826048.

10.3.2 You have the right to complain to the ICO if you are not satisfied with how we have handled your data or responded to a rights request:

• Website: https://ico.org.uk/make-a-complaint/
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
• Phone: 0303 123 1113

10.3.3 Separately, under section 164A of the Data Protection Act 2018 (as amended and in force 19 June 2026), you have the right to make a complaint directly to us as the controller about our processing of your personal data. If you make such a complaint, we will acknowledge it and take the steps required to respond, without undue delay. This section 164A right to complain to us is distinct from — and does not replace — your right to complain to the ICO under Article 77 UK GDPR and section 165 of the Data Protection Act 2018 (section 10.3.2 above). You may exercise either or both, and you do not have to complain to us first before going to the ICO.

10.3.4 We have a named privacy contact (privacy@steez.space) rather than a formal Data Protection Officer.

10.4 Users in the European Union / European Economic Area

10.4.1 If and when Steez is made available in the EU/EEA (not at launch — see Terms of Service §2.1), the data of users there will be processed under the EU GDPR, with the same core rights as UK users, including erasure under Article 17 EU GDPR.

10.4.2 If and when Steelo Labs Ltd offers Steez to users in the EU/EEA, it will be required to designate a Representative in the Union under Article 27 EU GDPR. The Representative has not yet been appointed; once appointed, their name and contact details will be published here and in the Privacy Policy. In the meantime, any EU/EEA resident whose personal data we process can raise any data-protection matter (including erasure) with us directly at privacy@steez.space and we will deal with it directly.

10.4.3 You have the right to lodge a complaint with your local EU/EEA supervisory authority. A list of national supervisory authorities is published by the European Data Protection Board (https://edpb.europa.eu/about-edpb/about-edpb/members_en).

10.4.4 Separately from your data rights, if and when Steez is made available in the EU/EEA, EU users will also have rights under the EU Digital Services Act, including in relation to content moderation. Our content-reporting, statement-of-reasons, notice-and-action mechanism, and EU legal representative are described in our Terms of Service and Acceptable Use & Community Guidelines.

10.5 Users in the United States

10.5.1 If you are a US resident, you may have rights under your state's privacy law (for example, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and comparable laws in other states). These can include the right to know what personal information we hold about you, the right to request deletion, the right to correct inaccurate information, and the right not to be discriminated against for exercising these rights. We do not "sell" or "share" your personal information for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA.

10.5.2 To exercise these rights, use the deletion routes in section 2 or contact privacy@steez.space. We will verify your identity before acting and will respond within the timeframe your state law requires.

10.6 Users elsewhere — mandatory local rights

If you are in any other jurisdiction, your local data-protection or consumer law may give you deletion or related rights that cannot be excluded by contract. Where it does, those mandatory local rights apply and prevail over anything in this policy that would give you less. Contact privacy@steez.space to exercise them.

11. Data Portability — Downloading Your Data Before Deletion

11.1 Before deleting your account, you can request a copy of your personal data. This right is provided under Article 20 GDPR (right to data portability) for data you have provided to us where processing is based on consent or contract, and under equivalent rights in other jurisdictions where they apply.

11.2 Data portability is not yet available via self-service. To request a copy of your personal data before deletion, contact privacy@steez.space and we will provide it within one calendar month.

11.3 The data copy includes your profile information, content metadata, subscription history, Steez purchase history, and other data you have provided to us. It does not include financial records held by Stripe (you should request those directly from Stripe), or data held independently by Apple or Google.

12. Account Restoration and Re-registration After Deletion

12.1 Once the 30-day grace period expires and deletion is complete, your account cannot be restored. Where you chose the immediate, irreversible deletion route in section 3.1, no grace period or restoration window applies, and your account cannot be restored once deletion has been actioned.

12.2 You may create a new Steez account using the same email address after deletion is complete. A new account will not automatically have access to your previous content, subscriptions, earnings, or purchase history, and will not restore any Steez (Keys) or content unlocks you previously held — except where you chose to preserve an entitlement under section 4.2: in that case, redeeming your single-use re-link token on the new account restores the preserved Steez (Key) or content unlock. A Key that was not preserved in this way ends with the deleted account and is not paid out; if you believe a refund was due for access you had paid for, that is handled under your statutory rights and our Refund & Cancellation Policy (see section 4.2).

12.3 If you were a creator with outstanding earnings at the time of deletion, any earned-but-unsettled funds that are cleared by Stripe after account deletion will be processed in accordance with your Stripe Connect account terms. Contact support@steez.space if you have questions about outstanding creator earnings.

13. Changes to This Policy

13.1 We may update this Data Deletion Policy from time to time, for example if our data processing activities change, new third-party integrations are added, or legal requirements change.

13.2 We will notify you of material changes by:

• posting a notice in the Steez app;
• updating the version number and effective date at the top of this document; and
• if the change materially affects your rights, sending you an email to your registered address.

13.3 Continued use of Steez after the effective date of a material change constitutes your acknowledgement of the updated policy. If you do not accept the changes, you should delete your account before the effective date.

13.4 A summary of the material changes made between published versions of this policy is available on request by contacting privacy@steez.space.

14. Contact Us

If you have any questions about this Data Deletion Policy or wish to exercise your right to erasure:

Email: privacy@steez.space Post: Steelo Labs Ltd (company number 15553648), 3 Harebell Close, Hamilton, Leicester, England, LE5 1UX

For general support: support@steez.space For legal notices: legal@steez.space

Cross-references in this document: Terms of Service; Creator Terms & Earnings Agreement; Privacy Policy; Cookie & Tracking Policy; Acceptable Use & Community Guidelines; Refund & Cancellation Policy; Copyright & Takedown Policy; Moderation, Complaints & Appeals Procedure.