Data privacy and account deletion

Every Digital Empire product ships a self-serve deletion route so you can hard-delete your pre-signup data (email captures, free-scan records, waitlist entries) without emailing support. Paid subscriber records go through a slightly different flow, described below, since they cross-reference Stripe billing objects that need coordinated teardown. This guide covers both paths and the retention and breach-notification promises that back them.

• PixelProof (meta-monitor): visit /meta-monitor/account/delete. Enter your account email, receive a one-time confirmation link (24-hour TTL) via email, click it to complete deletion.
• EntryProof (cpsc-efile): visit /api/cpsc/account/delete or use the "Delete my data" link on the EntryProof privacy page.
• TariffWatch: visit /api/tariffwatch/account/delete, same double-opt pattern as the other two.

The double-opt pattern (submit email, click emailed link) exists to prevent someone else's email from being used to delete your data without your inbox verifying the request. This mirrors the mailbox-verified pattern the FTC's business guidance on ftc.gov has flagged as best practice for deletion request handling under the Click-to-Cancel rule.

For pre-signup PII (email captures from free scans, waitlist signups), deletion is immediate and irreversible. The rows are hard-deleted from Supabase within seconds of the confirmation click, and no soft-delete grace period applies to these records.

For paid subscriber records (stores, subscription events, meter confirmations, referral redemptions), the flow is different because the row cascade touches Stripe. The self-serve deletion route enqueues an owner-alert email, then support processes the deletion within 5 business days per California Consumer Privacy Act response-time requirements enforced by the California Attorney General, documented at the CCPA enforcement page on oag.ca.gov. The 5-business-day promise is our operative service level; the underlying steps are Stripe subscription cancellation, Supabase auth.users row deletion (which cascades via owner_user_id foreign key to every product row), and Stripe customer object deletion. If you want to cancel the subscription first without triggering the full deletion flow, see our separate How to cancel your subscription guide.

Even if you never request deletion, free-scan and readiness-checker inputs (store URL, HTS code, hashed IP) are automatically anonymized 30 days after collection by a daily cron job that runs at 3 AM UTC. The cron overwrites identifying fields with SHA-256-derived placeholders while preserving non-identifying aggregate fields (score, band, findings counts, exposure dollar figures) so portfolio analytics keep working. Paying customers are excluded from this anonymization pass, since we need identifiable billing records for tax and legal reasons that outlast the 30-day marketing-lead retention window.

If we discover a security incident that affects your personal data, we notify you without unreasonable delay. For users in the EU or UK, we notify affected users within 72 hours of becoming aware of the breach in accordance with GDPR Article 33 as codified in EU Regulation 2016/679 on eur-lex.europa.eu. For California residents, we notify in the most expedient time possible per California Civil Code section 1798.82. The notification lands as email to the address on file, plus a public update on the affected product's landing page, and includes: a description of the incident, categories and approximate count of records affected, likely consequences, and mitigation steps we are taking.

We do not sell your personal information to any data broker, so there is nothing to opt out of under the CCPA "Do Not Sell" provision, a stance the Information Commissioner's Office guidance on ico.org.uk also frames as lower-risk under UK-GDPR. We do not use dark patterns to make deletion harder than signup: no "are you sure" gauntlet beyond the mailbox-verified confirmation click, no phone call requirement, no retention-specialist chat, and no requirement to explain why you are leaving.

• How to cancel your subscription
• Amazon FBA CPSC eFiling walkthrough
• How to add your first Shopify store to PixelProof

Is deletion reversible? No. Once you click the confirmation link, the hard-delete is irreversible. If you might want to come back within 30 days without losing your configuration, cancel your subscription first (that preserves everything in a soft-deleted state) and only request full deletion if you decide not to return.

Can I request a data export before deletion? Yes. Email hello@citationsafe.com from the account address with the subject line "Data export request." We return a JSON dump of your data within 5 business days, ahead of any deletion request you also want processed.

Do you honor GDPR right-to-erasure requests from non-EU residents? Yes. Our deletion flow does not check jurisdiction: any user of any of our three products can use the self-serve deletion route regardless of residency.

What happens to my data on backups after deletion? Production database rows are hard-deleted immediately. Backups follow a rolling 90-day retention beyond that per standard AWS backup lifecycle, then are also removed. This is consistent with the CCPA "reasonable security" standard.

Still stuck? Email hello@citationsafe.com or hello@argushq.ai.