Privacy Requests

Export or erase everything Logspot holds about a person (data subject requests, DSAR/DSR), from the dashboard or the API.

When someone exercises their right of access or erasure, Logspot can find every record tied to them and either package it up or delete it. These are privacy requests, also called data subject requests (DSAR for access, DSR for erasure). Both request types work from the dashboard and from the API.

Logspot is the processor and you are the controller, so verifying that a requester is who they claim to be is your responsibility. Logspot acts on the identifiers you supply.

Create a Request from the Dashboard

Go to Settings → Privacy → Privacy Requests. The New Privacy Request form takes four inputs:

Type is either Export (DSAR) or Delete (DSR).

Regulation is GDPR or CCPA. This is recorded with the request so your audit trail shows the basis it was handled under.

Window appears for exports only, and is either All History or Trailing 12 Months. CCPA access requests are commonly scoped to the preceding twelve months, so the shorter window is there when you need it.

Subject Ids takes one or more user_id or anonymous_id values, separated by commas, spaces, or new lines. You can resolve several identifiers belonging to the same person in a single request.

Submitting an export creates the request and produces a downloadable artifact when it finishes. The artifact expires after a period, so download it rather than relying on the link later.

Deleting a Subject

Deletion asks for confirmation first. Logspot runs a preflight that counts how many records match the identifiers you gave, and the confirmation dialog, Permanently Delete This Subject?, shows that count before you commit.

Deletion is irreversible and reaches every store Logspot keeps the subject's data in. There is no undo and no recovery from backup, so check the matched count looks right before confirming.

Track a Request

The Request History table on the same page lists recent requests for your organization with their status. Every request records the identifiers it resolved and how many records it matched, so you can evidence what was done after the fact.

The API

The same operations are available over the API for teams routing requests from their own privacy tooling. A privacy request spans your whole organization, so these endpoints take an organization-scoped API token with the privacy_requests:write scope (and privacy_requests:read to list, poll, or download). A project key cannot file them. See API Authentication.

Create a deletion request:

curl https://api.logspot.io/v1/privacy-requests \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer sk_a1b2c3d4e5f6" \
  -d '{"request_type": "deletion", "distinct_ids": ["user_42"], "regulation": "GDPR"}'

Create an export request with a twelve-month window:

curl https://api.logspot.io/v1/privacy-requests \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer sk_a1b2c3d4e5f6" \
  -d '{"request_type": "export", "distinct_ids": ["user_42"], "regulation": "CCPA", "window": "trailing_12_months"}'

Both return 202 with the request wrapped in the standard success envelope:

{ "status": "OK", "data": { "id": "...", "status": "pending" } }

List your organization's requests with GET /v1/privacy-requests, poll one with GET /v1/privacy-requests/{id}, and fetch a finished export from GET /v1/privacy-requests/{id}/download.

Deletion requests are rate limited more tightly than exports (5 per minute against 30), since they are destructive.

What a Request Covers

Requests resolve against a person: the user_id and anonymous_id values that identify a human being. Company records are not in scope, because a company is not a person.