Data Subject Requests

Export or erase everything Logspot holds about a person, from the dashboard or the API.

When someone exercises their right of access or erasure, Logspot can find every record tied to them and either package it up or delete it. Both request types work from the dashboard and from the API.

Logspot is the processor and you are the controller, so verifying that a requester is who they claim to be is your responsibility. Logspot acts on the identifiers you supply.

Create a Request from the Dashboard

Go to Settings → Privacy → Data Requests. The New Data Request form takes four inputs:

Type is either Export (DSAR) or Delete (DSR).

Regulation is GDPR or CCPA. This is recorded with the request so your audit trail shows the basis it was handled under.

Window appears for exports only, and is either All History or Trailing 12 Months. CCPA access requests are commonly scoped to the preceding twelve months, so the shorter window is there when you need it.

Subject Ids takes one or more user_id or anonymous_id values, separated by commas, spaces, or new lines. You can resolve several identifiers belonging to the same person in a single request.

Submitting an export creates the request and produces a downloadable artifact when it finishes. The artifact expires after a period, so download it rather than relying on the link later.

Deleting a Subject

Deletion asks for confirmation first. Logspot runs a preflight that counts how many records match the identifiers you gave, and the confirmation dialog, Permanently Delete This Subject?, shows that count before you commit.

Deletion is irreversible and reaches every store Logspot keeps the subject's data in. There is no undo and no recovery from backup, so check the matched count looks right before confirming.

Track a Request

The Request History table on the same page lists recent requests for your organization with their status. Every request records the identifiers it resolved and how many records it matched, so you can evidence what was done after the fact.

The API

The same operations are available over the API for teams routing requests from their own privacy tooling. All four endpoints use the secret key. See API Authentication.

Create a deletion request:

curl https://api.logspot.io/privacy/deletion \
  -H "Content-Type: application/json" \
  -H "x-logspot-sk: sk_a1b2c3d4e5f6" \
  -d '{"distinct_ids": ["user_42"], "regulation": "GDPR"}'

Create an export request:

curl https://api.logspot.io/privacy/export \
  -H "Content-Type: application/json" \
  -H "x-logspot-sk: sk_a1b2c3d4e5f6" \
  -d '{"distinct_ids": ["user_42"], "regulation": "CCPA", "window": "trailing_12_months"}'

Both return 202 with the request id wrapped in the standard success envelope:

{ "status": "OK", "data": { "request_id": "req_...", "status": "pending" } }

Poll GET /privacy/requests/{id} for status, and fetch a finished export from GET /privacy/requests/{id}/download.

Deletion requests are rate limited more tightly than exports, since they are destructive.

What a Request Covers

Requests resolve against a person: the user_id and anonymous_id values that identify a human being. Company records are not in scope, because a company is not a data subject.