Export or erase a customer's personal data

When a customer asks for a copy of their data, or asks you to delete it, use the Privacy card on their record. This page explains what each button does, who can use it, and, plainly, what it does not do yet.

Who can export or erase customer data

Only the store owner. The Privacy card does not appear for managers, staff or viewers. If you want a team member to have it, give them the Export and erase customer data permission under Settings, Team.

Where else it is, and is not, available:

• Export is only here. There is no export in the AI assistant, in the admin MCP server or through an API key, so no connected AI agent can pull a customer's data out of your store.
• Erasing is also done by the delete actions. The Delete Customer action on the customer list, and the delete customer actions of the AI assistant and the admin MCP server, run the same erasure. They are available to anyone who can edit customers (a Manager by default), not only the owner, and they ask for no reason or typed email. See Delete a customer. Only the Privacy card adds the preview, the required reason and the export.
• If you do not want an AI agent or a manager to be able to erase a customer, do not give them the permission to edit customers, or do not connect the agent.

Export customer data (a copy of what you hold about them)

1. Open Customers and click the customer.
2. In the Privacy card press Export customer data.
3. Wait a few seconds while the file is prepared, then press Download.

You get one .zip file with two files in it:

• index.html, a page you can open and read, or print. It lists the customer's profile, addresses, orders, messages, reviews, loyalty points, marketing consent, emails sent to them and more.
• data.json, the same information in a form a program can read.

The download link works for 15 minutes, and the file itself is deleted after 24 hours. After that, start a new export. Every export and every download link is written to your audit log, with who asked and when, and never with the customer's details.

It does not contain passwords or login tokens, the card token or any payment provider reference (only the brand, last four digits and expiry of a saved card), your private notes, or the internal replies on an inquiry. A list is cut at 500 rows and says so.

A customer who bought as a guest has no customer record, but you can still find their orders and emails by their email address when you export from a customer record that uses the same address. There is no button for exporting by email alone yet.

Erase a customer's personal data (the right to be forgotten)

1. Open the customer and press Erase personal data in the Privacy card.
2. Read the preview. It counts what will be Erased, what is Kept without the name or contact details, what is Kept on purpose, and what is Not changed yet.
3. Write the reason (required, saved in the audit log, do not put personal details in it), type the customer's email to confirm, and tick the box.
4. Press Erase personal data. It cannot be undone.

The record disappears from Customers right away. A few clean-up steps, such as removing the address from old email logs, finish in the background within minutes.

What erasing removes

The customer's profile (name, email, phone, birthday), saved addresses, tags, saved cards, sign-in links, wishlist, loyalty membership with points and badges, referral links, their closed contact inquiries and the messages in them, their chats with the storefront bot and what the bot remembered, and back in stock subscriptions.

What stays, with the person taken out

• Product reviews stay and show Anonymous. Only the link to the person, their email and their name are removed.
• Email logs and campaign send lists keep the type, status and date, and lose the address and the subject.
• Newsletter signups keep the coupon terms, and lose the address and browser details.
• Proof of consent is cut down to a marker made from a hash of the address, with no IP address and no browser details. It is deleted after 24 months.
• The unsubscribe and bounce list keeps the address in plain form, so you never email someone who opted out. This is a deliberate choice and may change.

Why a customer can't be erased yet

Erasing is refused, and the dialog says why, when the customer:

• has an order. Orders keep the buyer's name and address. Order anonymisation is a later release, so any customer with an order can't be erased yet. This is the most common reason today.
• has an active recurring payment schedule or a paid loyalty membership that is still billing. Cancel it first.
• has ever been charged for a paid loyalty membership. That is your financial record.
• has an open contact inquiry. Resolve or close it first.
• has a gift card scheduled for later delivery, or is registered for an upcoming event.

For a customer with orders, you can edit their details, unsubscribe them from all marketing, and write to [email protected].

What is not done yet

Please read this before you tell a customer their data was erased.

• Orders are not anonymised. Orders, checkouts, shipments, donations, event registrations, gift cards and recurring payment records keep the name and address they were made with. Nothing in them changes when you erase a customer.
• Your payment provider is not told. Our copy of a saved card is removed, but the card token at the provider is not deleted.
• Your email provider and your ad audiences are not notified. The email provider keeps its own sending logs, and an audience you built in an ad platform keeps who it already has.
• Backups still hold the customer until they expire. A backup you made keeps the customer until it is deleted, and if you restore a backup the erased customer comes back, so erase them again.
• There is no list of past erasures in the dashboard yet. Each one is in your audit log.
• There is no bulk erase. You do one customer at a time from the Privacy card.
• The order retention setting is stored, not enforced. Brainerce records a number of months for how long an order should keep its buyer's details (84 by default), but nothing deletes anything because of it yet.

Need help with a data request? Email [email protected].