why were you collecting private data without notifying the user? some severe violations like this prompt immediate removal imo
All data collected (email address which can be masked and name and surname which can be made up) was properly stated in the privacy policy