Account Deletion

The end-to-end self-serve erasure workflow is being delivered in Phase 3 of our compliance programme. In the interim, deletion is handled within 30 days of an emailed request to dpo@mechasite.com.

Email dpo@mechasite.com from the email address on your account, with subject “Account deletion request”. We will:

• Verify your identity via a confirmation email + (where MFA is enabled) an MFA challenge.
• Confirm in writing what we’re about to delete and what we need to retain (with the legal basis for each category).
• If you are the sole owner of an organisation with active sites, present the transfer-or-terminate options described in Section 5 below.
• Schedule deletion. We honour a 14-day grace period (see Section 7) before the irreversible operations begin.
• Issue an erasure certificate after deletion completes (see Section 8).

• Your name, email address, and profile picture.
• Your password hash and MFA secrets.
• OAuth identity bindings (Google, GitHub, etc.).
• Your active sessions and API keys.
• Free-text content you submitted (support tickets, feedback, complaint descriptions where you are the complainant).
• Any sites you own that are not transferred to another organisation owner — content, drafts, generated artefacts, deployment records.
• Cached representations across our infrastructure (Cloudflare R2 artefacts, Sentry user identifiers, Statsig user mapping).

We pseudonymise rather than delete the following because we have a legal obligation or overriding legitimate interest to retain them:

Mecha Site organisations require at least one owner. If you delete your account while you are the sole owner of an organisation that still has active sites or other members, we will offer you three options:

• Transfer ownership to another existing member of the organisation. Their consent is required; we’ll email them to confirm.
• Terminate the organisation alongside your account — all sites are decommissioned, billing is cancelled, and any invoiced amounts already paid are not refunded except as required by law.
• Pause your deletion request while you arrange transfer (we’ll hold the request open for up to 30 days).

We propagate erasure to every sub-processor that holds personal data about you. The current set:

• Stripe — customer object pseudonymised; invoices retained per HMRC obligation under Stripe Connect terms.
• Sentry — user identifier removed from all stored events; replay recordings purged.
• Statsig — userID mapping removed; aggregate statistics retained as anonymous.
• Cloudflare R2 — owned artefacts purged; cached edge content invalidated.
• Resend — email delivery records pseudonymised.
• GitHub — repositories created during deployment archived or deleted per your DPA election.

The full sub-processor list lives at /legal/sub-processors.

We hold your deletion request for 14 days before the irreversible operations begin. During that window you can cancel by replying to our confirmation email. After 14 days the deletion proceeds as a saga — once a sub-processor step has executed, that part cannot be reversed.

When deletion completes, we issue an erasure certificate by email listing:

• The categories of data deleted, with timestamps.
• The categories of data pseudonymised, with the lawful basis for retention and the period.
• Each sub-processor confirmation (where the sub-processor returns one).
• A reference number you can quote in any later complaint or regulator query.