PROJECT WEBSITE Manual privacy and deletion requests
CURRENT
FRICTION●

PRIVACY / UPDATED 17 SEPTEMBER 2026

Data deletion.

A human handles your request.This is a manual contact procedure, not an automatic deletion endpoint. Isolated deletion tests have been completed for a temporary database table, an n8n test execution and a test media asset. End-to-end newsroom deletion and backup erasure remain unverified. These tests do not establish that all copies of real personal data can already be removed automatically.

1. Send a request

Write to Timo Krämer, Current Friction, Geilsweg 1, 31855 Aerzen, Germany. You may also use kraemer.timo@mein.gmx; the operator has confirmed that this mailbox is monitored for these requests. A suggested subject is “Data deletion request — Current Friction”. No special form or exact wording is required.

Please describe the interaction concerned and provide only what is necessary to locate the data: for example, the relevant platform, approximate date, username or post link. For WhatsApp, the number used in the relevant conversation may help. You do not need to provide every item.

Do not send passwords, access tokens or identity documents unsolicited. If there are reasonable doubts about identity, the operator may ask for proportionate additional information. Requests should preferably come through the channel associated with the original interaction.

2. What happens next?

  1. The operator records receipt and checks the scope and, where needed, the requester's identity.
  2. The operator identifies relevant records held by Current Friction. Depending on the interaction, these may include correspondence, WhatsApp test records, n8n execution history, Neon database records, local working files or media and records held by processors.
  3. The operator assesses the request and removes or restricts relevant data where required. Applicable processors and recipients are involved where necessary. No deletion is claimed until its outcome has been checked.
  4. The operator responds with the result, scope, any outstanding provider action and any reason for retaining particular data. If the request is refused, the response explains the grounds and complaint/remedy options.

3. Response time and charges

Under the GDPR, requests must be addressed without undue delay and normally within one month of receipt. A permitted extension for complexity or number of requests can be up to two additional months; notice and reasons must be given within the first month. Requests are normally free. Charges or refusal for manifestly unfounded or excessive requests are subject to the GDPR's conditions, not an automatic fee.

4. Scope, exceptions and backups

Erasure is not unconditional. Relevant exceptions can include legal obligations, legal claims and freedom of expression and information. Any exception must be assessed for the particular data and explained; it is not a blanket exemption for the newsroom.

Current Friction cannot directly erase data a platform holds independently, third-party posts or every copy on the internet. Where required, the operator must take the applicable steps concerning recipients or published personal data and explain the limits. You may separately exercise your rights with the relevant platform.

Deleting an active record may not immediately remove it from provider backups. Backup retention and restoration handling must be verified for the actual services; no instant or universal deletion is promised. A completed request must not be represented as fully removed from backups unless that has been established.

5. Disconnecting Google and YouTube

You can revoke Current Friction's Google access at any time in Google's third-party access settings. You can also ask the operator to disconnect the n8n YouTube credential. The operator will revoke the token without delay, stop future authorised access and delete Google-authorised API data held solely under that consent as soon as possible and no later than seven calendar days.

If a token can no longer be refreshed, the operator treats that as revoked access and starts the same deletion process. Other stored YouTube API metadata is refreshed or deleted within 30 calendar days. A narrowly required legal or security record may be retained only where a specific obligation or defensible need applies, and the requester is told about that limit.

6. Questions or complaints

Contact the operator above. You can also complain to a supervisory authority, including the Lower Saxony data-protection authority. Further information about your rights and processing is in our privacy notice.