Skip to main content

Data Subject Rights (GDPR)

Curupira gives every user self-service control over their own personal data — the two core GDPR data-subject rights are built in:

  • Right of access / data portability (Art. 15 & 20) — export your data.
  • Right to erasure (Art. 17, "right to be forgotten") — erase your account.

Both act only on the authenticated caller's own account — a user can never export or erase another user's data.

Export your data (Art. 20)​

curl https://auth.curupira.api.br/api/user/data-export -b cookies.txt

Returns a machine-readable JSON document with the account's personal data (profile, identity links, and related records), suitable for portability. It is available to the signed-in user for their own account only.

In the product this is offered on the user's profile / account page as a "Download my data" action.

Erase your account (Art. 17)​

curl -X DELETE https://auth.curupira.api.br/api/user/data -b cookies.txt

Response: {"erased": true}.

What erasure does​

  • Soft-delete + anonymize — never a hard delete. Curupira anonymizes the account and the user's rows in the security-log tables rather than dropping them. This removes the personal data while preserving referential integrity and the integrity of audit/security records (which regulators and security both require).
  • Sessions are terminated immediately — the erased user is signed out everywhere.
  • It is irreversible: there is no undo, and the anonymized identity can't be re-associated.

Safeguards​

  • A protected / break-glass administrator account cannot self-erase — the request is refused (403, "This account is protected and cannot be erased") so erasure can't brick platform administration. The check fails closed: if the protected-status lookup can't complete, the erase is refused rather than risked.

For tenant administrators​

  • These flows are user-driven self-service — a user exercises their own rights; admins don't erase users through this path.
  • Erasure is recorded in the audit trail (the erasure event survives the anonymization pass it triggers), so you retain proof the request was honored without retaining the personal data.
  • Because erasure anonymizes rather than deletes, historical logs and relationships stay consistent — entries remain, attributed to an anonymized subject.

:::note Support access is logged and must be disclosed Separately, when DW-Corp support staff access a tenant's data, that access is audit-logged and surfaced to the tenant's admins. If you enable cross-tenant support access, disclose it in your privacy policy (see your deployment's super-admin guidance). :::

Next steps​