# Privacy and data requests

> Answer an end user's request to see or delete their data, and choose how long Whisperr keeps raw events.

Use this page when one of your users asks to see or delete their data, or when you set how long Whisperr keeps raw events. Whisperr processes your users’ data for you, so you answer the user. The tools below give you what you need.

## Export or erase one user

Find the user by the id your app sends as `external_user_id`.

**In the dashboard:** only a workspace owner can export or erase. Use either path:

- **On the person’s page:** open **Users**, pick the person, open the actions menu and choose **Export data** or **Erase user**. Erase asks you to confirm in a dialog titled **Erase this user?**. The menu shows these actions only for a user with your app’s user ID, not for an anonymous visitor.
- **In Settings:** open **Settings → Data and privacy → Privacy requests**, enter the user ID from your app, and choose **Export** or **Erase**. Erase asks you to hold the button to confirm. This works even when the person is not in the Users list. If Whisperr holds nothing for the ID, Export says so, and Erase still records the request.

Export downloads the data as a JSON file.

**With the API:** call these endpoints from your backend with the server key (`wrk_…`). The publishable key in your app gets `403 server_key_required`.

```text
GET    /v1/users/{external_id}/export
DELETE /v1/users/{external_id}
```

The dashboard and the API return the same bodies. For the requests, the responses and the error codes, see [Export and erase a user](/api/data-subjects/).

## What does erase delete?

Erase deletes the user and their data in one step. You cannot undo it. Whisperr deletes:

- the user, their traits, and their contact channels and addresses;
- consent records;
- events, including events still waiting to be processed and events imported from Mixpanel, Amplitude or PostHog;
- churn scores and decisions;
- the messages Whisperr wrote and sent, the AI requests that wrote them, and their deliveries, opens and clicks;
- billing data from RevenueCat, Superwall and Adapty that is linked to the user. Billing records that are not linked to any user yet are deleted when Whisperr can match them to the user’s ID;
- identities and profiles from connected sources;
- daily activity rollups and background jobs for the user.

## What does Whisperr record about an erasure?

Whisperr keeps one record for each erase request. The record holds:

- a keyed hash of the user’s id (HMAC-SHA-256, scoped to your app), never the id itself;
- whether the request came from the dashboard or the API, and which dashboard user or server key sent it;
- whether Whisperr found the user;
- the time of the erasure.

An erase request is safe to repeat. A second request finds nothing, returns `found: false`, and adds another record.

## What if my app sends data for the user again?

Live data creates a new user. If your app or backend tracks or identifies the same `external_user_id` after the erase, Whisperr stores it as a new user, with none of the erased data. Stop tracking and identifying the user before you erase them. In a mobile app, `optOut()` stops the SDK on the user’s device. `optOut()` stops new data, but it does not delete data that Whisperr already has.

History imports skip erased users. A Mixpanel, Amplitude or PostHog import that runs later does not bring back the user’s past events.

## Set event retention

By default, Whisperr keeps raw events forever. To keep them for a shorter time, open **Settings → Data and privacy → Event retention** and set **Keep events** to **90 days**, **13 months** or **25 months**. Only an owner or admin can change it. A shorter period asks you to confirm first.

The setting covers events sent through the SDKs or the API, and history imported from Mixpanel, Amplitude and PostHog. These are deleted automatically once older than the period you chose. Deleted events cannot be restored.

The setting does not cover:

- event copies received from connected sources, such as Shopify, Segment and RevenueCat. They are not covered yet;
- scores, decisions and message history. These stay until you [erase](#export-or-erase-one-user) the user.

## What does Whisperr store about a user?

The export holds everything Whisperr stores about one user:

- **User and traits:** the user, with all traits you sent, and the time zone and language from `identify()`.
- **Contact channels:** email addresses and push tokens, with opt-in state. The export shows addresses in clear text.
- **Consent:** the consent records your app or backend sent.
- **Events:** live events, events imported from Mixpanel, Amplitude or PostHog, lifecycle changes, daily activity rollups and the app versions the user ran.
- **Scores and decisions:** churn risk evaluations and the decisions to send or not to send.
- **Messages:** the messages Whisperr wrote, messages it rejected, the messages it sent, and their deliveries, opens and clicks. Also the channel that works best for the user.
- **Billing:** subscription state and history from RevenueCat, Superwall and Adapty.
- **Connected sources:** the user’s identities and profiles from connected sources.

For each field that the mobile SDKs send, see [What the mobile SDKs send](/privacy/sdk-data/). For how long Whisperr keeps data in general, and your rights, see the [privacy policy](https://whisperr.net/privacy/).

## Common questions

### How do I export or erase one user's data in Whisperr?

A workspace owner can open a person's page in Users and choose Export data or Erase user from its actions menu, or use Settings → Data and privacy → Privacy requests. From your backend, call GET /v1/users/{external_id}/export or DELETE /v1/users/{external_id} with the server key.

### What does Whisperr keep after I erase a user?

Only a record that the erasure happened. The record holds a keyed hash of the user's id, never the id itself.

### What happens if my app identifies an erased user again?

Whisperr creates a new user with the same id. Stop tracking and identifying the user before you erase them.

### How long does Whisperr keep raw events?

Forever by default. An owner or admin can choose 90 days, 13 months or 25 months in Settings → Data and privacy → Event retention. Events sent through the SDKs or the API, and imported Mixpanel, Amplitude and PostHog history, are deleted automatically once older than the period. Events from connected sources such as Shopify, Segment and RevenueCat are not covered yet.

Source: https://docs.whisperr.net/privacy/data-requests/