CRMcy Docs

GDPR

Data subject access, export, and deletion tooling.

Last updated 2026-05-05

CRMcy ships first-party tooling for the GDPR (and CCPA / KSA PDPL / equivalent) data-subject rights workflow. The Settings → Privacy → Data Subject Requests screen lets you receive, triage, and fulfill access (Article 15), rectification (Article 16), erasure (Article 17), and portability (Article 20) requests. An access request produces a downloadable ZIP archive containing every row across the tenant database that references the subject's email, phone, or external id, plus all attached files. Erasure runs a destructive sweep that nullifies PII fields in-place while preserving aggregated row counts for legitimate-interest reporting.

A configurable retention policy auto-archives or deletes records past their retention window (e.g. tickets older than 5 years) — see Settings → Privacy → Retention.

Related endpoints

  • POST /api/tenant/gdpr/requests — open a new request.
  • GET /api/tenant/gdpr/requests/:id — current state + audit trail.
  • POST /api/tenant/gdpr/requests/:id/fulfill — produce the export zip or run erasure.
  • GET /api/tenant/gdpr/retention — current policy.

See the source at apps/web/src/app/(tenant)/settings/privacy and apps/api/src/gdpr.