Your GDPR rights and how to use them

Governing law and place of jurisdiction for MrFollows is the United Arab Emirates. That changes nothing when someone in the EU or the UK writes in about their own data: the rights below are the ones we act on.

The privacy notice lists what we collect and which processor sees which part. This page is the European view: grounds, rights, transfers and time limits.

Most of the record exists because you placed an order, so the ground for it is the contract between us. The email address carries your confirmation, the public link you pasted is the target we deliver to, and the order and payment entry is what a refund or a refill gets checked against.

Where a service lets you spread the count over time, the window is part of the order and stored with it for the same reason. That applies to Instagram views and to nothing else except TikTok views.

A smaller part is kept because we are obliged to: payment and order entries sit behind the accounts, so they outlive the order even once the refill window has closed.

Fraud prevention runs on a hashed IP address and a shortened browser identifier. Neither names you, and both are held as a legitimate interest in keeping orders and other people's links from being misused.

Consent covers what you switch on yourself: the name published beside a review you submit, and browser storage past the essentials. Today the essentials are all there is, cart, currency and your banner answer, listed on the cookie page.

Access. Ask, and we send back what sits against your email address: the orders, the links you gave us, the payment state of each and the fraud prevention entry if there is one.

Rectification. A wrong address, a misspelled review name or a mistyped order detail is corrected as soon as we have your message. A delivery already made cannot be, because nothing we operate takes a count back off a public profile.

Erasure. We delete the order record and the address that carries it. Two limits: the accounting copy stays as long as the books need it, and anything already delivered sits on the platform rather than with us.

Restriction. Dispute something we hold and the record is frozen instead of used: stored still, but out of use until the point is settled.

Portability. What you gave us, the address, the links and the order lines, goes out as a plain machine readable file.

Objection. You can object to the fraud prevention processing. Objection. You can object to the fraud prevention processing. It is the record we look at when an order or a link is reported as misused, so we weigh your case against that and answer with the decision and the reason.

Withdrawing consent. Say the word and the name comes off your review. Clearing browser storage removes cart, currency and the banner answer from your device.

Decisions taken without a person. If an order was held back and you believe nobody looked at it, write in and somebody will. You get the reason, and the order then moves or is refunded under the money-back policy.

One address does all of it: support@mrfollows.com. Write from the address you ordered with, name the right you are using, and add the order ID when it concerns one order. That ID is the heading of your order page. We answer within 24 hours.

Proving a request is yours should cost you little: we match the address and the order ID rather than ask for documents we would then have to store. The order page opens from a link and not a login, so keep it private.

Hosting, order storage, email, the crypto payment step and the delivery itself are separate services, each getting only the slice of the record it needs. The one that carries out delivery is sent the public link and the quantity, never your email address and nothing about your payment.

Not all of them sit inside the EU or the UK, so a request you send can be handled outside Europe. What crosses is short: an email address, a public link, a quantity, the state of a payment. No card number and no password.

An order record has to outlive its order. Where a service offers a refill, a count that falls inside 30 days of delivery is topped back up against the order ID, so deleting the record at once would take your own claim with it.

What remains is the accounting side, kept as long as the books are kept, then deleted or stripped of anything pointing at a person. No fixed clock is published here, because a number we cannot stand behind is worse than none.

Whatever sits in your browser sits on your device, and clearing site data removes it.

Say so in the same thread first. Most of what goes wrong here is a request we read too narrowly, faster to correct than to escalate.

You can also take it to the data protection supervisory authority where you live or work, with no agreement from us and no waiting. Telling us afterwards helps, because it shows which part of our answer did not hold.