We make it straightforward to delete the data we hold about you, in line with your right to erasure under Article 17 of the GDPR. This page covers three things:
- Disconnecting a single social platform.
- Deleting your full Kidding account and all associated data.
- How to revoke our access from inside each social platform's own settings, in case you no longer have access to your Kidding account.
1. Disconnect a single social platform
Sign in to the Kidding platform and open the Connected Accounts page. Click Disconnect on the relevant platform card and confirm. We will:
- delete the encrypted OAuth access and refresh tokens immediately;
- stop pulling any new data from that platform;
- delete the analytics records we have already stored for that connection within 30 days, except where we are required to keep aggregated, non-identifying campaign metrics for contractual reporting.
Where the social platform supports server-side revocation (e.g. Google), we call the revocation endpoint as part of disconnect.
2. Delete your Kidding account
Account deletion currently runs through us. Send an email from the address registered to your account to:
contact@kidding.at
Subject: Account deletion request
Please include:
- the email address on your Kidding account;
- (optional) the reason for the deletion — this is useful feedback for us;
- whether you would like us to also delete data associated with you from any campaign reports you have been part of (subject to our legal retention obligations).
What happens next:
- We confirm receipt within 5 business days, typically much sooner.
- We may ask you to verify your identity before acting on the request.
- Your account is deactivated immediately on confirmation, and all personal data is deleted within 30 days from our production systems.
- Encrypted backups containing your data are overwritten within 30 days.
- We keep records that we are legally required to keep — most importantly invoices and signed contracts, which Austrian law (§ 132 BAO, § 212 UGB) requires us to retain for 7 years.
- We confirm completion in writing.
3. Revoke access directly from a social platform
If you cannot or do not want to sign in to Kidding, you can revoke our access from inside each platform. This stops us from pulling any new data. To also remove the data we have already stored, follow step 2 as well.
3.1 Instagram (Meta)
- Open Instagram and go to Settings → Apps and websites → Active, or visit instagram.com/accounts/manage_access.
- Find Kidding in the list and select Remove.
- To also delete the data we have already stored, email contact@kidding.at with the subject Instagram data deletion request and include the Instagram username connected to Kidding. We will confirm deletion within 30 days.
3.2 YouTube / Google
- Visit myaccount.google.com/permissions.
- Find Kidding in the list of third-party apps and select Remove Access.
- To also delete the data we have already stored, email contact@kidding.at.
3.3 TikTok
- In the TikTok app open Profile → ☰ → Settings and privacy → Security and permissions → Manage app permissions.
- Find Kidding and select Remove.
- To also delete the data we have already stored, email contact@kidding.at.
3.4 X (formerly Twitter)
- Visit x.com/settings/connected_apps.
- Find Kidding and select Revoke access.
- To also delete the data we have already stored, email contact@kidding.at.
4. Meta data-deletion callback
For Meta's App Review process we register this page as the “Data Deletion Instructions URL”. Users who request data deletion from inside their Facebook or Instagram account are directed here and can either remove their data themselves via the steps above or contact us at contact@kidding.at.
5. Your other rights
Deletion is one of several rights you have under the GDPR. You can also request a copy of your data, correction of inaccurate data, restriction of processing, and data portability. See the Privacy Policy for the full list and how to exercise them.
If you are not happy with how we handle your request you have the right to lodge a complaint with the Austrian Data Protection Authority — see the contact details in the Privacy Policy.