GDPR tools
Subject-access export + right-to-erasure. Every export and delete is recorded in the audit log with the target user id, your operator id, and a timestamp.
Target user
Subject-access export
Gathers profile + bookings + reviews + notifications + conversations + saved payment methods + treatment photos + gift cards + owned businesses. Returns one JSON bundle.
Right-to-erasure
This is irreversible.
User profile, client account, notifications, saved payments, conversations, treatment photos, phone verifications, and sessions are hard-deleted. Bookings and call logs are retained with PII scrubbed. Reviews are deleted outright. Users who own businesses cannot be erased — transfer ownership first.