# Data subject requests

> How to export or delete a shopper's ShopAssist data from the dashboard, the API or your platform's privacy tools.

Source: https://shopassist.coec.dk/docs/compliance/data-subject-requests · Updated 2026-10-01

Shoppers exercise their GDPR rights against you, the controller. ShopAssist gives you tools to export and delete their data; verifying the shopper's identity is your responsibility.

[Open privacy & data](/app/go/privacy)

## Create a request [#create]

Under **Privacy & data → Requests**, choose **Export** or **Delete** and identify the shopper by any of: email, customer id on your platform, conversation id or visitor id. Requests complete within 7 days, usually within minutes. When an export is ready, owners and admins get an email with a download link.

The same is available through the [privacy requests API](/docs/api/reference/privacy/create-privacy-request) (`privacy:write`, every plan).

## Platform tools [#platforms]

| Platform    | What triggers a request                                                                                                                              |
| ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
| Shopify     | the `customers/data_request`, `customers/redact` and `shop/redact` compliance webhooks; exports go to the store owners, never to the shopper         |
| WooCommerce | WordPress **Tools → Export / Erase Personal Data** includes "ShopAssist chat assistant"; deleting a customer user also deletes their ShopAssist data |
| PrestaShop  | the official GDPR module (psgdpr) export and delete actions                                                                                          |
| Magento 2   | deleting a customer; exports go through the ShopAssist dashboard                                                                                     |

## What is exported [#export]

Conversations with every message (AI messages marked as AI-generated), leads, back-in-stock alerts, consent records and attributed orders, as JSON and CSV.

## What is deleted [#delete]

Conversations, messages and attachments, leads, consents, back-in-stock alerts, analytics events and order links of the shopper, plus matching webhook events. Aggregated metrics are kept. A note on leads already synced to Shopify customers tells you to erase them in Shopify too.

## Other rights [#other-rights]

* **Rectification:** delete the record; it is captured again when the shopper next provides the data. Transcripts are records of what was said and are not edited.
* **Objection to analytics:** the shopper withdraws consent in your consent banner.

If a shopper writes to COEC directly, we forward the request to your owners within 3 business days and take no other action without your instruction.