For sure @nader should at least feed this document to ChatGPT and ask for help.. Let me quote - "As a general rule, storing personal data on a blockchain should be avoided, if this conflicts with data protection principles."

DeSo is blockchain, so once transaction is made it's there... But you can still limit access to data via API and via GraphQL. Right now if you fetch list of user posts via API you can't get posts marked as hidden, but GraphQL does not have such limitation. Those people who provide access to data via API or GraphQL are responsible.

If you build and run an app, this is your responsibility to comply with European Data Protection regulations. API and GraphQL is another level and who is responsible here? @nader is responsible. He can easily update API and GraphQL in a way that if you "delete" (hide) your profile, apps can't get your data.