Under GDPR your customers enjoy a number of rights including the right to erasure or deletion. In this article we will explain how Xtremepush can assist you in being compliant in regard to this right.  

Background

Servicing a Request for Erasure

If you have to process a request from a customer to erase their data and that requires erasing their data on xtremepush then you can.

If you are not familiar with where user profile data can be found on the platform first read our user profile data guide to familiarise yourself with this part of the platform in the docs here:

• https://support.xtremepush.com/hc/en-us/articles/360000850789-User-Profiles-Quick-Start-Guide 

To erase customer data navigate to App Data > User Profiles and use the search fields to find the user who has made the request using a Customer ID or email.  

Once you have found the user record double check the data to ensure you have the correct user record.

Once you have confirmed you have the correct user then click the delete user icon (far right) to erase that users personal data from the system. Confirm that you want to continue to begin erasure.

The confirmation message explains what will be deleted:

WARNING: CLICKING OK WILL DELETE ALL PERSONAL DATA FROM THIS PROFILE AND 
IT WILL NO LONGER BE USABLE FOR CUSTOMER MARKETING. DATA REMOVED INCLUDES:
    -User ID, Email, Mobile Number
   - Device ID, ADID, IDFA, GA ID
   - All Custom Profile Attributes
   - All Custom Device Attributes
   - Historic Custom Attribute Values
   - Last Devices Coordinates
   - Attribution Events
   - All User data from message history (Email, Names, etc)
ONLY CLICK OK IF YOU ARE SURE YOU WANT TO CONTINUE

When the erasure task is complete you will receive confirmation. 

Automating Erasure

In some cases it may be necessary to automate the erasure of customer data fro example if you want to be able to say that all customer data has been deleted when the delete their account you may need to delete their data on xtremepush at the same time it is being deleted on you system to support automated erasure we have added APIs that will delete customer as per the manual approach above. Details on these APIs in the next section.

For a general introduction to the Xtremepush APIs please review:

• The API section of the docs
• The API overview

Erasure APIs

delete-personal-data

Used to delete all personal data for a user and devices of that user based on their user id.

URL

api/external/delete-personal-data

Parameters

Example

Delete a user using their user id

 
URL: https://external-api.xtremepush.com/api/external/delete-personal-data
POST_DATA: {
  "apptoken": "APPTOKEN",
  "user_id": "USER_ID"
}

If successful will give a 200 response

{
   “code”: 200,
   “success”: true
}

If the user does not exist or has already been deleted then it will return 404

{
   “code”: 404,
   “message”: “Not Found”,
   “success”: false
}

delete-device-personal-data

For projects where you have different User ID and Device External ID values. This can also be used to delete personal data from a device in the case where the device doesn't have a User ID.

URL

api/external/delete-device-personal-data

Parameters

Example

Delete a user using their external id

 
URL: https://external-api.xtremepush.com/api/external/delete-device-personal-data
POST_DATA: {
  "apptoken": "APPTOKEN",
  "external_id": "EXTERNAL_ID"
}

If successful will give a 200 response

{
   “code”: 200,
   “success”: true
}

If the user does not exist or has already been deleted then it will return 404

{
   “code”: 404,
   “message”: “Not Found”,
   “success”: false
}