Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PSA: HelloFresh doesn't delete data when asked, only changes the email address

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 54 posts

Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address

#21

Post by mrsuprawsm »

nerdjon wrote: post #13

Somehow this doesn't surprise me, they still want to be able to spam you with offers (I legit got a text today from Martha and Marley, I have not used them for 3+ years) and possibly sell your data to make more money. It does bring up an interesting idea, how many people use unique emails for each company to track spam. If something like that was possible for shipped goods (wouldn't work well for food but that is the…

>It does bring up an interesting idea, how many people use unique emails for each company to track spam

Probably not a lot, but Apple's "Hide my Email" feature is now native to iOS and should in theory make this fairly easy to do. I do this _occasionally_ when signing up for new sites.

Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address

#22

Post by nerdjon »

mrsuprawsm wrote: post #21
nerdjon wrote: post #13

Somehow this doesn't surprise me, they still want to be able to spam you with offers (I legit got a text today from Martha and Marley, I have not used them for 3+ years) and possibly sell your data to make more money. It does bring up an interesting idea, how many people use unique emails for each company to track spam. If something like that was possible for shipped goods (wouldn't work well for food but that is the…

>It does bring up an interesting idea, how many people use unique emails for each company to track spam Probably not a lot, but Apple's "Hide my Email" feature is now native to iOS and should in theory make this fairly easy to do. I do this _occasionally_ when signing up for new sites.

I was very happy when that was added, I have started using it for anything I sign up for.

Doesn't fix everything that already has my email, but I am hoping it helps to expose companies that sell data more. It is hard to hide behind "well maybe you accidentally did it" when I don't think there is a way on iOS to use the same email in multiple places?

Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address

#23

Post by closeparen »

I think it's pretty rare that a business is going to erase all record that a transaction ever occurred, particularly a transaction involving other people (merchants, gig workers). Rather they are going to erase your association with the transaction, by rewriting your account as a "tombstone" account with fake details. That's a pretty normal approach.

Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address

#25

Post by gruez »

jgalt212 wrote: post #17
0x0000000 wrote: post #14

Earlier quoted context omitted.

If you don't need to use the second line for "Street Address", you might be able to repurpose it and put in a unique identifier for each entity you conduct business with. Might depend on your mail carrier being OK with putting a letter to "Apt 41723" in the only mailbox at the primary address.

Does the USPS Address Verification API reject such "modifications"? https://www.usps.com/business/web-tools-apis/

Maybe. On one hand USPS might have a database of which buildings are multi-family homes and reject stuff like "unit 123" if it's not a multi-family/tenant building. However, I've also seen letters addressed to "basement" (for someone who's renting out the basement of a single family home) which seem to arrive fine so maybe they're not doing too aggressive filtering.

Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address

#26

Post by Someone »

cronix wrote: post #12
valbaca wrote: post #4

Earlier quoted context omitted.

Article 17 of the GDPR would disagree. """ “The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay” if one of a number of conditions applies. “Undue delay” is considered to be about a month. """

Does that include data contained in their x years of backups?

What companies keep x years of backups (for any x > 1, possibly even ½)? I don’t think that’s worth much to any company. Better make sure your recent backups are good than spend effort on keeping such old backups around.

For accounting/tax purposes, you need data up to typically 7-ish years ago, but isn’t that data typically online nowadays so that it will end up in today’s backup?

Even if they still have the bits from an old backup, they should have thrown away its encryption key.

Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address

#27

Post by lancesells »

nerdjon wrote: post #22
mrsuprawsm wrote: post #21

Earlier quoted context omitted.

>It does bring up an interesting idea, how many people use unique emails for each company to track spam Probably not a lot, but Apple's "Hide my Email" feature is now native to iOS and should in theory make this fairly easy to do. I do this _occasionally_ when signing up for new sites.

I was very happy when that was added, I have started using it for anything I sign up for. Doesn't fix everything that already has my email, but I am hoping it helps to expose companies that sell data more. It is hard to hide behind "well maybe you accidentally did it" when I don't think there is a way on iOS to use the same email in multiple places?

I've gotten to the point where signing up for anything is rare. I used to try out all types of tools to see if they help me work, or sign up for the "10% discount" at some new store.

But then you start to realize what happens to your info. If I buy running shorts from Nike I'll start getting junk mail from running and fitness brands to my home address. If I back something on Kickstarter I get spam coming from other Kickstarter campaigns.

Lately I've started reading privacy policies more than signing up. Here's something from Pelotons policy on what they collect:

> Voice and Likeness: Your visual image, likeness and voice recording (e.g., via photographs, video and/or CCTV) if you visit our studios and/or showrooms or participate in live studio classes. Additionally, Peloton fitness equipment and the Peloton App may contain a camera, microphone and voice control features. These features are in use only when activated by you, for example, to use the Peloton Guide, to take a Peloton user profile photo or to initiate or accept a video chat from another user and, for usage of the Peloton App, any device settings that you have activated.

Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address

#28

Post by shmoogy »

shockeychap wrote: post #8
marrone12 wrote: post #3

This is generally standard practice for e-commerce companies, is it not?

It is common for companies to randomize all data containing PII. It's not common for them to obfuscate one data point and leave all the others alone.

An internal ID for a customer record is probably tied to the orders and other internal data. Deleting a record just breaks shit you might need for historical purposes.

It's better to disassociate the customer info and maintain the other links - unless there is an obligation to do so otherwise (unfamiliar with gdrp nuances)

Randomizing multiple foreign keys at the same time is interesting though. Is it really necessary if the company isn't intentionally being malicious trying to maintain and advertise to the requesting individual ?

Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address

#29

Post by Traster »

closeparen wrote: post #23

I think it's pretty rare that a business is going to erase all record that a transaction ever occurred, particularly a transaction involving other people (merchants, gig workers). Rather they are going to erase your association with the transaction, by rewriting your account as a "tombstone" account with fake details. That's a pretty normal approach.

If it really keeps credit card details, that’s way more than just a tombstone.

Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address

#30

Post by zxienin »

closeparen wrote: post #23

I think it's pretty rare that a business is going to erase all record that a transaction ever occurred, particularly a transaction involving other people (merchants, gig workers). Rather they are going to erase your association with the transaction, by rewriting your account as a "tombstone" account with fake details. That's a pretty normal approach.

Correct for transaction data. Such data is owned by hello fresh and they need to keep it (for financial reporting, for instance).

However OP talked of master data. That should be removed when user asks to delete their account.

Post reply on HN