Data Privacy & Compliance

Joryio includes built-in GDPR and CCPA compliance tools to help you manage data subject requests, configure privacy settings, and maintain audit trails for regulatory compliance.

Data Subject Requests (DSR)

Data subject requests allow you to process erasure (right to be forgotten) and data export (data portability) requests for individual users.

Creating a DSR

1. Open the Data Subject Requests page (at /compliance/dsr in your dashboard)
2. Click New Request
3. Enter the User ID of the data subject
4. Select the request type:
   • Export: Collects all personal data across all systems into a downloadable JSON archive
   • Erasure: Permanently deletes or anonymizes all personal data across all systems
5. Click Create Request

You can also create DSRs directly from a user's profile page using the Export Data or Erase Data buttons.

The User ID must belong to someone this workspace holds data for: a profile's internal ID or external ID, a profile that was already deleted, or a person whose events are still stored. Any other ID is refused (404). An organization can have up to 50 requests pending or processing at once; beyond that a new request is refused (429) until some complete.

DSR Processing

Each DSR is processed asynchronously across all data stores:

Store	Data Affected
Profile store	User profile, devices, aliases, list subscriptions, canvas executions
Engagement store	WhatsApp messages/conversations, SMS messages, in-app impressions, variant assignments
Analytics event store	Analytics events (including message opens/clicks) and rendered messages
S3	Export files and wallet pass files

Processing steps are tracked individually, so you can monitor progress in real-time on the DSR detail page.

Deadline Tracking

Deadlines are automatically calculated based on the applicable regulation:

• GDPR: 30 days from request creation
• CCPA: 45 days from request creation

Overdue requests are flagged daily and logged in the compliance audit trail.

Downloading Exports

For export DSRs, once processing is complete:

1. Go to the DSR detail page
2. Click Download Export
3. The export file stays available for 24 hours after processing; each generated download link is valid for 1 hour

The export file is a gzipped JSON archive containing all personal data organized by data store.

Privacy Settings

Open the Data Privacy & Compliance settings page (at /settings/privacy in your dashboard) to configure organization-level privacy settings.

These settings apply to every workspace in your organization - shortening a retention period deletes data in all of them - so changing them requires the company-level Organization Settings: Write permission (org_settings:write). Anyone with Compliance: Read can view them.

Default Regulation

Set the default regulation framework (GDPR or CCPA) that applies to new DSR requests. This determines the default deadline period.

Data Retention

Configure how long different types of data are retained:

Setting	Description	Default
Tracking Retention	Message opens and clicks	Same as events. Set 7-365 days to delete opens and clicks sooner - it can only shorten, never extend
Audit Log Retention	Compliance audit entries	365 days. Set 30-3650 days; the nightly cleanup applies it. Admin actions and sign-in events are never kept less than 365 days
Export File Retention	DSR export files on S3	24 hours
Anonymous Profile Retention	Anonymous profiles that went cold	365 days. Depends on your plan - contact Customer Success to change it. See below

Analytics events retention (730 days by default) is set for your plan by Joryio and is not edited on this page.

Requests you send to Joryio support are Joryio's own records, not workspace data, so they are not set here - see how long we keep support requests.

Anonymous profile retention

Visitors you have never identified still get a profile, so in-app messages, events and push can reach them. Most of them visit once. A nightly job deletes an anonymous profile only when all of these are true:

• it was never identified - no email, phone or user ID;
• it had no activity (no event and no profile change) for 365 days;
• it has no active device, so anyone push or in-app can still reach is kept;
• it is not in an active or waiting journey, and not in any list.

Its events stay in analytics under the anonymous ID and age out with events retention. Each nightly run is recorded in the compliance audit log with how many profiles were deleted and how many were kept, and why. The period is 365 days by default and depends on your plan. It is not edited on this page - to change it, or to keep anonymous profiles forever, contact Customer Success.

Inactive contact cleanup

Off unless you ask for it. When Customer Success turns it on for your plan, a nightly job deletes an identified contact only when all of these are true: no channel can reach them under any campaign setting (their email is unsubscribed, hard-bounced or missing; their phone is unsubscribed on SMS, WhatsApp and Viber, or missing; they have no active device), they had no activity for the agreed number of days (180 at least), and they are not in an active journey or subscribed to a list. A contact whose status was simply never set counts as reachable and is kept. Before a contact is deleted, their unsubscribe or bounce is added to your suppression list, so importing the same address again later cannot subscribe them again.

When your account ends

When your subscription ends, nothing happens to your data. Joryio staff then confirm with you that the account has ended; until they do, your data stays as it is.

Once the end of the account is confirmed:

1. The same day, the account's owners and admins, and the billing email in your billing details, receive an email: the account has ended, and the date its data will be deleted.
2. 7 days before the account closes, a reminder.
3. 14 days after the confirmation, the account is closed: it becomes read-only, its API keys are revoked and data collection stops.
4. 30 days after that, all of its data - contacts, events, messages, files and settings - is permanently deleted.

Your data is therefore deleted within 60 days after the end of your account is confirmed. Backups age out after that: database backups within 7 days.

While an invoice is unpaid or a payment is still pending, none of these steps happen; they continue once it is settled, always with at least 7 days notice of the new date.

To keep your account and its data, contact us before it closes: we cancel the deletion or move it to a later date. After the account is closed, it can still be restored until its data is deleted.

Erasure Behavior

• Anonymize instead of delete: When enabled, an erasure keeps the user's event/message rows but irreversibly de-identifies them - the user identifier is replaced with a random, non-reversible token and every identifying field is scrubbed (event properties, anonymous/session/device ids). Only non-personal analytics dimensions (event name, timestamp, campaign/channel) remain, so aggregate analytics stay intact while the person can no longer be identified. When disabled, the records are hard-deleted.
• Retain aggregate statistics (Enterprise add-on): For customers who require a true hard delete (not anonymization) but still don't want dashboards to drop, this keeps scrubbed, de-identified event rows so campaign totals and funnels survive - while every PII store (profiles, messages, devices) is fully deleted.

Enterprise add-on

Retain aggregate statistics is an enterprise add-on. It can only be turned on for your organization by the Joryio team through our admin console - it is not self-serve. Until it's enabled the toggle stays disabled on this page. Once we enable it, you control whether to apply it per erasure from here. Contact us to add it to your plan.

tip

Anonymization alone already preserves aggregate analytics and satisfies erasure, so most organizations don't need the hard-delete add-on. Choose the add-on only when a policy or regulator specifically requires actual deletion rather than anonymization.

Privacy Contact (DPO)

Configure your Data Protection Officer's contact information:

• DPO Name and Email: Displayed in compliance records
• Privacy Policy URL: Link to your organization's privacy policy

Marking data as personal (PII)

Personal data is stored normally and hidden at read from users who lack the pii:view permission. Marking a field as PII does not delete it or change what you can do with it - you can still segment and target on it exactly as before. It controls who sees the values.

What is personal by default

Fields the platform defines are covered without any setup - email, phone, firstName, lastName, address fields, date_of_birth, postal_code, ip_address, national_id and similar. These match in any casing, so first_name and firstName are the same field.

We do not guess beyond that list. A field called plan_name, store_name or emailSubject is ordinary data, because guessing from names gets it wrong in both directions - and a field wrongly marked as personal has its values hidden from your own team for no privacy gain.

Marking your own fields

Anything you send is yours to classify:

• Attributes - Settings → Data Dictionary, the PII toggle on the row.
• Event properties - Settings → Data Dictionary, open an event and use the PII toggle on the property.

email and phone cannot be un-marked. They are the addresses the platform delivers to, so their contents are not a matter of configuration.

What changes when a field is marked

Where	Effect
Data Dictionary & Event Explorer	example values hidden without pii:view
Segments & targeting	unchanged - you can still filter on it
Campaign personalization	unchanged
AI assistant context	values withheld from the model
Predictive models	the field is excluded from training

The last row is the one that behaves differently on purpose. Display can be undone by unticking the box; a value learned into a model cannot. So fields that are personal by nature stay out of training even if you untick them, and identifiers such as externalId are never trained on although they are shown normally.

The "ID?" hint

Some properties are flagged with a small ID? marker. That means their values behave like identifiers - a new value on almost every event, or roughly one per person - which a name alone cannot reveal. It is a prompt to review, not an automatic decision: nothing is hidden or excluded because of it.

Compliance Audit Log

All compliance-related actions are logged in an immutable audit trail, accessible from the Data Subject Requests page (audit entries are visible on each DSR's detail page).

The log shows the current workspace's entries. Organization-level entries, such as privacy settings changes, are shown only to members with Organization Settings: Write.

Logged actions include:

• DSR creation, processing, completion, failure, and cancellation
• Export file downloads
• Privacy settings changes
• Overdue deadline warnings
• Anonymous profile retention runs (deleted and kept counts)
• Inactive contact cleanup runs (deleted and kept counts)

Important

The subscription audit log is never deleted during erasure requests (GDPR Article 17(3)(b)). Instead, user identifiers are anonymized to maintain proof of consent while removing PII.

Store orders

An erasure never deletes store orders (Shopify, WooCommerce, Magento or the Orders API), so revenue totals stay correct. It removes what identifies the person on each of their orders - name, addresses and phone, the store's customer ID, the order note, the order status link and the tracking number - and unlinks the orders from the contact. Amounts, products and coupon codes stay, and so do custom fields you send in an order's metadata through the API - keep personal data out of them.

Quick Actions from User Profile

On any user's profile page, you'll find two compliance action buttons:

• Export Data: Creates an export DSR for the user
• Erase Data: Creates an erasure DSR for the user (requires confirmation)

These are shortcuts that create DSR requests with the same processing pipeline.