Privacy requests (GDPR and CCPA)
Find every record of an IP address, Google click ID, click ID or e-mail address, export it as JSON, erase it, or anonymise an account.
Last updated 3 min read
On this page
People whose clicks were tracked can ask for a copy of their data or for its deletion (GDPR Articles 15 and 17, CCPA "right to know" and "right to delete"). In TrackCrown these data-subject requests are handled by the platform operator in the admin area — workspace staff cannot run them, but they can forward requests to the operator. Answer within one month under GDPR or 45 days under CCPA.
Who can do what#
Find the records#
-
Open Admin → Privacy requests.
-
Choose the Identifier:
-
Enter the Value, choose All workspaces or one Workspace, and optionally a Request reference ("Ticket or e-mail reference of the request, kept in the log.").
-
Click Find records.
The result lists Clicks (first 1,000, from the last 13 months — older clicks no longer exist), Conversions and Accounts with this e-mail. If the click store cannot be searched you see "Click data could not be searched" — do not erase in that case; retry later.
Export (right of access)#
Click Export JSON to download everything found. The file is generated for you and not stored; the request log records the export as done with the counts.
Erase (right to deletion)#
Click Erase and confirm "Erase these records?". What happens:
The deletion of clicks runs as a background job (every 30 seconds). When it is done, the stored subject value of the request is cleared — only a keyed hash remains so the request can be recognised later. The request log shows the status and the result.
E-mail requests delete nothing in the click store, because it holds no e-mail addresses.
Anonymise an account#
When the e-mail belongs to a user account, the account appears under Accounts with this e-mail with Anonymise account:
- The e-mail and name are replaced (
anonymized-<id>@anonymized.invalid). - The password, 2FA and recovery codes are removed, every session is signed out and the account is disabled.
- The account's sign-in events are deleted.
- Workspace memberships stay for the audit trail.
The request log#
Request log lists every request with Requested, Action (search/export/erase), Subject (redacted, e.g.
203.0.113.*** or p***@example.com), Scope (workspace or all), Status, Result and Reference. Every
export, erasure and anonymisation is also written to the platform audit trail.
Reduce what you store in the first place#
- Switch on EU IP masking so European visitors' IPs are stored truncated.
- Do not send personal data (e-mail, phone, names) in sub IDs or postback parameters unless you need it.
- Clicks are deleted after 13 months anyway — see Data retention.