DeviantArt, Inc. Privacy Policy

Policy last updated: November 12, 2025

DeviantArt respects your privacy and is fully committed to protect your personal information and use it properly and in compliance with data privacy laws.

This Privacy Policy applies to our websites, including www.deviantart.com, DreamUp, sta.sh, our products, and our DeviantArt mobile applications (collectively, the "DeviantArt Sites" or "Sites"). This Privacy Policy explains what information we (together with our affiliated companies worldwide) collect and use pertaining to each of our Account holders and non-Account holders (such as Site visitors) through the Sites, how we use that information, and what choices you have with respect to the information we collect about you. The Sites and our services available via the Sites are collectively called the "Services."

Please take a few moments to read this Privacy Policy before you access or use the Services. By using or accessing the DeviantArt Sites, you acknowledge that you have read and fully understood this Privacy Policy and our Terms of Service and that they both apply to your use of the Services. If you do not read and fully understand this Privacy Policy, please do not use the Sites or Services. This Privacy Policy is not intended to override the terms of any contract you have with us, nor any rights you might have under applicable data privacy laws. Where you have read this policy but would like further clarification, please contact us at help@deviantart.com.

To provide you the Services, we may collect personal information relating to an identified or identifiable natural person ("Information").

1. What Information do we collect?

We collect Information you provide us, from your use of the Services, and from other sources. Here are the types of Information we collect about you.

1.1. Information you directly provide us

When you use our Services – such as creating a DeviantArt account, registering for special services (e.g. Premium Content), making purchases, subscribing to newsletters, or communicating with us – we collect such information you provided directly. This may include:

• Basic Account Information: Name, email address, password, and date of birth (required at signup).
• Account Settings and Onboarding (as applicable): Pronouns, country, optional information you included under the “About” section in your profile, and preferences about the content and how you use the platform.
• Transaction Information for Buyers (including Core Members and Sellers): Full name, credit card number, country, and—if you are in the United States—your ZIP or postal code.
• Content and Activity: Information about the content you upload, submit, or interact with – including art, images, GIFs, videos, journal entries, literature, posts, comments, favorites, “Watch” activity, and other interactions with users.
• In-platform Messaging: Content of messages or other direct communications within our platform.

We collect only the information necessary to provide our Services securely and in compliance with applicable laws.

1.2. Information collected through your use of the Site or Services

When you visit or use our Site or Services – including browsing pages, viewing accounts, editing your settings, using features, or interacting with content – we automatically collect a range of data about your activity and your device. This includes:

• Usage Data: Actions you take on our platform, such as clicks, page views, searches, purchases, navigation paths, interactions with features, downloads, and other usages.
• Device and Technical Information: Information such as your IP address, browser type, operating system, device type, device identifiers, and basic geolocation (determined via your IP address).
• Session and Real-time Interactions: We use technologies to monitor user sessions and track interactions to help us understand browsing patterns, diagnose problems, and optimize our Services.
• Cookies and Tracking Technologies: For more about our use of cookies and similar technologies, see Section 5 ("Cookies and Tracking Technologies") of this policy.

We use these types of data to:

• Keep our Services secure and fully functional
• Analyze site and user behavior for improvement
• Customize your experience and show relevant recommendations
• Detect, prevent, and investigate fraud or misuse

1.3. Information we collect from other sources

We may receive certain information about you from third parties where required to operate, secure, and provide our Services. This includes:

• Third-party Login Providers: When you sign up or log in through services like Google, Apple, or Facebook, we collect your name, email address, and any other information you authorize via your privacy settings. We never receive or store your passwords for such third-party providers.
• Fraud Detection and Security Providers: We may receive fraud risk information, geolocation data, and abuse signals from our partners to help us keep our platform safe.
• Payment Processors: For transactions handled by PayPal, Stripe, or other payment providers, we get transaction IDs, payment status, payer names, and relevant details necessary for processing and verifying payments. We do not have access to your full payment credentials.
• Discord: If you choose to link a Discord account for tier access, we may receive your Discord username, user ID, related role, and tier-related information.
• Other Providers: Occasionally, we may obtain information from other security or service providers where needed to detect illegal activities or prevent abuse.

We use this information only as required to operate our platform, provide our Services, ensure transaction security, or protect against fraud or abuse.

2. Why do we use your Information?

2.1. We use your Information for the following purposes

• To provide and operate our Services: We use your account details, preferences, content activity, and payment information to create your account, enable platform features, process transactions, and deliver content.
• To ensure safety, security, and fraud prevention: We use information such as device and technical details, account identifiers, purchase records, and data from trusted security providers to detect and prevent fraud, verify your identity, secure your account, and protect our platform from abuse and illegal activities.
• To personalize and improve our Services: We analyze your activity on our platform, including the way you interact with our features and content, to tailor recommendations and results, remember your preferences, and continuously enhance your experience.
• To communicate with you: We use your contact details to send service updates, provide information about your account, deliver security notifications, and respond to your support requests and inquiries.
• To deliver marketing and promotional content (where allowed by law or with your consent): We may use your Information to send you special offers, product updates, or relevant marketing content. You can opt out of receiving promotional communications at any time, as further detailed in Section 6.1 below.
• To enable social, community, and interactive features: We may use information you choose to provide when interacting with content in the Site, such as posts, messages, comments, and social connections, as part of platform interactions and community engagement.
• To run contests, events, or promotions: If you participate in a contest or promotional event, we use your entry details and contact information to manage participation, communicate with winners, and provide prizes or rewards.
• To create aggregated and statistical insights: We analyze user trends and behaviors by using aggregated or de-identified information so we can improve our Services, understand user needs, and advance our platform’s features. This aggregated data does not identify you individually.
• To comply with legal and regulatory requirements: We use your Information to meet our obligations under laws, regulations, and legal processes, and to respond to official requests from authorities.

2.2. Lawful Bases for Using Your Information

We only use your Information when permitted by law, including where:

• It is necessary to perform our contract with you (such as providing the Services or supporting your account).
• It is required to comply with laws and regulations that apply to us.
• It is necessary for our legitimate business interests – like improving and protecting our services, provided that these interests do not override your fundamental rights or freedoms.
• We have obtained your consent, where required (for example, for sending marketing communications). When we rely on your consent, you can withdraw it at any time.

3. How and why do we share your information with third parties?

We share your information only as needed to provide our Services, protect our communities, comply with the law, and when you ask us to. Here’s how and why your data might be shared:

3.1. With Third-Party Service Providers

We share your information with trusted Third-Party Service Providers who help us deliver and improve our services. This includes companies and individuals who provide:

• Website and data hosting
• Content delivery networks (CDNs)
• Cybersecurity and fraud detection
• Payment processing and billing
• Analytics and performance measurement
• Email and notification delivery
• Customer support
• Legal, compliance, or professional advice

These providers only get the information they strictly need to perform their services for us, and they are required to protect your data.

3.2. With Third Parties For Legal and Safety Reasons

We may disclose your information if required by law, or when we believe in good faith it’s necessary to:

• Comply with a legal process (such as a subpoena, court order, or government request)
• Enforce our policies or legal agreements
• Protect the rights, property, or safety of DeviantArt, our users, employees, agents, or the public.

In certain circumstances, we may be legally restricted from notifying you about such disclosures.

3.3. With Our Corporate Group

We may share your information with our parent companies, affiliated companies, and subsidiaries so we can provide and improve our Services, comply with the law, and support business operations.

If we (or our parent or affiliated companies) go through a business change – like a merger, acquisition, or sale of assets – your information may be shared with those involved, as needed to manage the transition.

3.4. Through APIs (Application Programming Interfaces)

We offer APIs so that certain features, content, or services can interact with third-party tools or services.

• If you use a third-party app or service that connects to your DeviantArt account via our APIs, those third parties will only get access to your Information if you have given your permission.
• Some API-based sharing with our service providers (such as payment processors) occurs as part of their provision of services for us, as described above.

3.5. With Your Consent or by Your Request

If you ask us to connect your account or share information with a third party (for example, sharing artwork to a social network), we will only do so with your express permission.

For the avoidance of doubt, we may share your Information in manners other than as described above, pursuant to your explicit approval, or if we are legally obligated to do so.

4. Where do we store your information?

4.1. Data Centers

Your Information is stored in secure data centers operated by leading cloud providers:

• Amazon Web Services (AWS)
• Google Cloud Platform (GCP)

4.2. Transfers Across Borders

DeviantArt processes data about individuals worldwide, which means your Information could be transferred and stored in a country different from your own. Wherever your data goes, we maintain strict security, privacy, and confidentiality standards, and your data is always protected in accordance with this policy.

Special Notes for Users in Europe, the UK, and Switzerland:

• If we transfer your Information outside the European Economic Area, the UK, or Switzerland, we do so only when one of the following safeguards is in place:
  • There is an adequacy decision by the relevant regulator.
  • We use the Standard Contractual Clauses (approved legal contracts for data transfers).
  • We comply with the Data Privacy Framework (or "DPF") for transfers to the United States, as described below.
  • We use any other legally approved data transfer mechanism in your jurisdiction.
• Our affiliates and service providers who store or process your data on our behalf are contractually required to follow strict security and privacy standards, wherever they are located.

4.3 The Data Privacy Framework

DeviantArt, Inc.,complies with Data Privacy Framework that embeds the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce, European Commission, UK Government, and Swiss Federal Administration regarding the collection, use, and retention of personal information transferred from the European Union, the United Kingdom (and Gibraltar), and Switzerland to the United States. DeviantArt has been certified to the U.S. International Trade Administration (ITA), within the U.S. Department of Commerce that adheres to the DPF's Principles. If there is any conflict between the terms in this policy and the Data Privacy Framework Principles, the Data Privacy Framework Principles shall govern. DeviantArt's commitment to subject the personal information described in this policy to the Data Privacy Framework is subject to the enforcement and investigative powers of the United States Federal Trade Commission.

To learn more about the Data Privacy Framework Program visit it here, and to view our certification, please click here.

DeviantArt may share personal information with third parties under certain circumstances described in this policy, subject to obligations under the Data Privacy Framework Principles which extend to third parties acting as agents who help us run our business and provide services, and DeviantArt remains liable should a third party acting as our agent processes personal information subject to this policy in a manner inconsistent with this policy, except where DeviantArt is not responsible for the event giving rise to the damage.

In compliance with the Data Privacy Framework Principles, DeviantArt commits to resolve complaints about our collection or use of your personal information. E.U., UK and Swiss individuals with inquiries or complaints regarding our Data Privacy Framework policy should first contact us at: help@deviantart.com.

DeviantArt commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF.

DeviantArt has further committed to refer unresolved Data Privacy Framework complaints to an alternative dispute resolution provider located in the United States. If you have an unresolved privacy, or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third-party dispute resolution provider TRUSTe for more information or to file a complaint. The services are provided at no cost to you.

If you have such an unresolved complaint, under the recourse mechanism you may contact the applicable EU Data Protection Authorities (free of charge). DeviantArt commits to cooperate with the DPAs and comply with the advice given by such authorities.

If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, you may – under certain conditions described on the Data Privacy Framework website – invoke binding arbitration when other dispute resolution procedures have been exhausted. For more information on this option, please see Annex I of the Data Privacy Framework Principles.

5. Use of Cookies and Similar Technologies

5.1. A cookie is a small file of letters and numbers downloaded onto your computer when you access certain websites. In general, cookies allow a website to recognize a user's computer. The most important thing to know about cookies placed by DeviantArt is that they make our website a bit more user-friendly, for example, by remembering site preferences and language settings. Please check out the table below to receive information about the type, categories, purpose and duration of cookies placed by DeviantArt and Third-Party Service Providers

Type	Name	Purpose	Duration
Cookie	auth	Identify logged users	1 month	Essential
Cookie	auth_secure	Security	never	Essential
Cookie	userinfo	Identify logged users	1 month	Essential
Cookie	td	image grid sizing for SSR (eclipse)	session	Essential
Cookie	tw	image grid sizing for SSR (green site)	7 day	Essential
Cookie	hubtoken	websocket push messages	session	Essential
Cookie	tpc	Oauth login for stash	session	Essential
Local Storage	chatDB	Allow chat feature	persistent	Essential
Local Storage	console_dapi_recent, console_recent	Recently used endpoints list in API developer console	persistent	Essential
Local Storage	custombox.recent.colors	Remembers colors used in custom boxes	persistent	Functional
Local Storage	FilmQuality	Allow the use of player settings	persistent	Essential
Local Storage	statusUpdateSubmitCounter	Number of status updates submitted via eclipse	persistent	Functional
Local Storage	intents, intents_other	List of signup intents selected by user	persistent	Essential
Local Storage	pwa_notifications	Allowing push notifications	persistent	Essential
Cookie	pwa_banner	Dismissing the prompt to install the web app	session	Essential
Local Storage	boost_promo_last_seen	Dismissing the prompt to boost deviations	persistent	Functional

Third Party Cookies:

Type	Name	Third party	Purpose	Duration
Beacon and Cookie	_pxhd	PerimeterX (https://www.perimeterx.com/legal/privacy/)	Security	1 y	Essential
Script and Cookie	TS#, XSRF-TOKEN	Wix.com https://www.wix.com/about/privacy	Security	session	Essential
Script and Cookie	frog.wix.com	Wix.com https://www.wix.com/about/privacy	Identify logged users	persistent	Essential
Script and Cookie	fed ,fedops.logger.sessionId	Wix.com https://www.wix.com/about/privacy	System monitoring	persistent	Essential
Local Storage	debug, debugpanel-height, debugpanel-tab, debugpanel-visible	Wix.com https://www.wix.com/about/privacy	System Monitoring	persistent	Essential
Local Storage	firebase:host:wix-engage-visitors-prod-27.firebaseio.com	Wix.com	Allow the Chat feature	persistent	Essential

6. Communications:

6.1. Promotional Messages

We may use your Information to send you promotional content and messages by email, text messages, notifications within our platform, and similar forms of communication from DeviantArt or our partners (acting on our behalf) through such means. If you do not wish to receive such promotional messages, you may notify DeviantArt at any time or follow the "unsubscribe" instructions contained in the promotional communications you receive.

6.2. Service and Billing Messages

We may also contact you with important information regarding our Services, or your use thereof. For example, we may send you a notice (through any of the means available to us) if a certain Service is temporarily suspended for maintenance; reply to your support ticket or email; send you reminders or warnings regarding upcoming or late payments for your current or upcoming subscriptions; forward abuse complaints regarding your Account; or notify you of material changes in our Services.

It is important that you are always able to receive such messages. For this reason, you are not able to opt-out of receiving such Service and Billing Messages unless you are no longer a DeviantArt User (which can be done by deactivating your Account).

7. Your rights in relation to your information

7.1. It is imperative that you will have control over your Information. That is the reason why we are taking reasonable steps in order to enable you to access, receive a copy of, update, amend, delete, or limit the use of your Information.

7.2. We may ask you for additional information to confirm your identity and for security purposes, before disclosing the requested data to you. We reserve the right to charge a fee where permitted by law, for instance if your request is manifestly unfounded or excessive.

7.3. You have the right to lodge a complaint with your local supervisory authority for data protection (but we still recommend you to contact us first).

7.4. For all DeviantArt Users, if you may review and amend your Information by logging in and navigating to your Settings page on the website. Once there, you may modify information that is incorrect and delete certain information from your profile. You can also change your permission settings for us to send you email newsletters.

7.5. For all DeviantArt Users, if you wish to retrieve your DeviantArt Account data or permanently delete your DeviantArt data, please follow the instructions provided here.

7.6. In addition, feel free to contact us online, or mail your request (see Section 15). We will make all reasonable efforts to honor your request promptly (unless we require further information from you in order to fulfill your request), subject to legal and other permissible considerations.

7.7. Please note that permanently deleting your Account erases all of your information from our databases. After completing this process, you can no longer use any of your Services, your Account and all its data will be removed permanently, and we will not be able to restore your Account or retrieve your data in the future. If you contact DeviantArt Support in the future, the system will not recognize your Account and support agents will not be able to locate the deleted Account.

8. Data Retention

We may retain your Information for as long as your Account is active, as indicated in this Privacy Policy or as otherwise needed to provide you with our Services.

We may continue to retain such Information even after you deactivate your Account and/or cease to use any particular Services, as reasonably necessary to comply with our legal obligations, to resolve disputes regarding our Users, prevent fraud and abuse, enforce our agreements, and/or protect our legitimate interests. Where your Information is no longer required, we will ensure it is securely deleted.

9. Security

9.1. We have implemented security measures designed to protect the Information you share with us, including physical, electronic and procedural measures. Among other things, we offer HTTPS secure access to most areas on our Services; the transmission of sensitive payment information (such as a credit card number) through our designated purchase forms is protected by an industry standard SSL/TLS encrypted connection; and we regularly maintain a PCI DSS (Payment Card Industry Data Security Standards) certification. We also regularly monitor our systems for possible vulnerabilities and attacks, and regularly seek new ways and Third-Party Services for further enhancing the security of our Services and protection of our visitors' and Users' privacy.

9.2. Regardless of the measures and efforts taken by us, we cannot and do not guarantee the absolute protection and security of your Information, or any other content you upload, publish or otherwise share with us or anyone else. We therefore encourage you to set strong passwords for your User Account, and avoid providing us or anyone with any sensitive information which you believe its disclosure could cause you substantial or irreparable harm.

9.3. If you have any questions regarding the security of our Services, you are more than welcome to contact us at security-report@deviantart.com.

10. Third-Party Websites

Our Services may contain links to other websites or services. We are not responsible for such websites' or services' privacy practices. We encourage you to be aware when you leave our Services and to read the privacy statements of each and every website and service you visit before providing your information. This Privacy Policy does not apply to such linked third-party websites and services which are subject only to the third-party policies.

11. Your Profile Page

11.1. Please note that when you create an Account, your profile page will display your Account user name and certain statistics regarding your own use of the Services, including but not limited to, the date you became an Account holder, the categories of materials you posted and how long ago you last visited the Sites. It will also display information about the Account holders who visit your profile page including the names of those Account holders who follow you (if the Account holder has permitted such display), and the number of visitors to, and views of your profile page or pages containing content you have submitted.

11.2. Any information or content that you post to your profile page, or to any Groups which you are a part of, chat rooms or forums will be publicly accessible by Users so please exercise your good judgment before you post. The name you choose when creating your Account is visible to all Users of the Services. If you visit another Account holder's profile page, your user name will appear on that page. DeviantArt does not control, and is not responsible for, the use of any information or content that you have exposed to the public through your use of the Services. You may use the tools we make available via the Services to make decisions about what information about you, including Information, will be visible on your profile page and on the profile pages of other Account holders that you visit. Please note accounts can be created either by individuals or companies. Note that in some cases, we may not be able to remove your Information from such areas.

12. Questions and Complaints

12.1. If you have any questions or concerns about our collection, use or disclosure of information, or if you believe that we have not complied with this Privacy Policy or applicable data protection laws, please contact us at our details set out at the end of this Privacy Policy.

12.2. Our Data Protection Officer team will investigate the complaint and determine whether a breach has occurred and what action, if any, to take. We take every privacy complaint seriously and will make all reasonable efforts to resolve your complaint promptly and in accordance with applicable law.

13. Updates and Interpretation

13.1. We may update this Privacy Policy as required by applicable law, and to reflect changes to our information collection, usage and storage practices. In relation to any updated Privacy Policy, we will, if so required by applicable law, notify you, seek your consent, and/or take any other measures. We encourage you to periodically review this page for the latest information on our privacy practices.

13.2. Any heading, caption or section title contained herein, and any explanation is provided only for convenience, and in no way defines or explains any section or provision hereof, or legally binds any of us in any way.

14. Contacting Us

If you have questions about this Privacy Policy or our policies or wish to exercise any of your rights as described, please contact our DPO team at:

DeviantArt, Inc.
7111 Santa Monica Blvd, Ste B, PO Box 230
West Hollywood, CA 90046
Email: help@deviantart.com

For the purposes of GDPR (Article 27), you may contact our EU representative at:

Wix Online Platforms Limited
1 Grant's Row
Dublin 2 D02HX96, Ireland

Additional Information for U.S. State Residents

This section of our Privacy Policy details what personal information we collect about you under U.S. applicable privacy laws and regulations, the sources of the personal information, the purposes of use and disclosure, and the categories of third parties that may receive that personal information. The information in this section applies to you if you are a U.S. resident in a state with an applicable privacy law or regulation. Please read this section in combination with the other sections of this Privacy Policy for a complete understanding of how we collect, use, and disclose your personal information.

Your Rights and how to exercise them

Here is a brief overview of your rights:

• Right to Delete Your Information: Upon your request, we will delete the personal information we have collected from you, subject to certain legally permissible exceptions. Please follow the instructions provided here, which explains how to delete your personal information. You can also choose to request the deletion through the email address: help@deviantart.com or by contacting us as described in this Privacy Policy.

  Right to Know and Access Your personal information: You have the right to ask us to confirm whether we process your personal information and for a copy of the personal information we maintain about you. Please follow the instructions provided here, which explains how you can retrieve your personal information.

  Right to Correct Inaccurate personal information: You may review and amend your Information by logging in and navigating to your Settings page on the website. Once there, you may modify information that is incorrect and delete certain information from your profile. You can also change your permission settings for us to send you email newsletters. For any questions, you can reach out to us using the method described in this Privacy Policy. You may exercise any of the rights described above, you can also submit a request by email to help@deviantart.com, or by mail to DeviantArt, Inc., 7111 Santa Monica Blvd, Ste B, PO Box 230, West Hollywood, CA 90046.

  When you submit a request, we will usually ask you to provide an email address to verify your identity and prevent fraud. You may also designate an authorized agent to submit a request on your behalf. Depending on the nature of the request, we may authenticate the request by requesting additional information or documentation, such as account-related information, billing information used to purchase paid Services and the submission of specific documents.

  No Discrimination: DeviantArt does not discriminate against any individual for exercising their rights under this section. If we deny your request or cannot fulfill it, you may appeal our decision by contacting us as described in this Privacy Policy to ask us to review your request again. Your communication should include “Appeal” in the subject line.

  In the last 12 months, we collected the following categories of personal information

  • Personal and online identifiers
  • Commercial and transactions information
  • Internet or other electronic network activity information
  • Non-precise Geolocation data (IP address, only)
  • Audio, electronic, visual, or similar information
  • Inferences drawn from the above information

  We collect personal information:

  • That you provide us when you register for our Services, sign up for any DeviantArt events, subscribe to our blog(s) or newsletter(s), use any of our Services, and/or when you contact us directly by any communication channels.
  • When you use the Services by visiting, downloading, and/or using any of our Services.
  • From third-party sources, such as security providers, fraud detection services, social media platforms.

  Disclosure of Information for Business Purposes:

  In the past 12 months, we may have disclosed each of the categories of personal information listed above with our Corporate Group, and Third-Party Service Providers, as permitted in accordance with this Privacy Policy’s provisions.

  Sales or Sharing of Your Information:

  DeviantArt does not sell user Information to third parties for the intents and purposes of the U.S. applicable privacy laws and regulations.

  Minors:

  DeviantArt does not knowingly collect, use, sell or share the personal information of minors under the age of 13.

  Users of the Services who are defined as minors under the US applicable data privacy regulations may request and obtain removal of content they posted by emailing us at help@deviantart.com. All requests must be labeled "U.S. Citizen Removal Request" on the email subject line. All requests must provide a description of the content you want removed and information reasonably sufficient to permit us to locate that content. We do not accept California Removal Requests via email to help@deviantart.com. We are not responsible for notices that are not labeled or sent properly, and we may not be able to respond if you do not provide adequate information. Please note that your request does not ensure complete or comprehensive removal of the material. For example, materials that you have posted may be republished or reposted by another user or third party.

  Sensitive personal information:

  We may process Sensitive personal information in accordance with the US applicable privacy laws and regulations, and do not use or disclose Sensitive personal information in any way that would require us to provide an opt-out opportunity under the applicable laws.

  Retention of Information:

  We retain your personal information for the time period reasonably necessary to achieve the purposes described in this Privacy Policy, or any other notice provided at the time of collection. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of such data, the potential risk of harm from unauthorized use or disclosure of such data, the purposes for which we process it, and the applicable legal requirements.