Visitor data requests: access, export, and deletion

When a visitor asks what you hold about them or asks you to erase it, you can answer from Databuddy directly. One request covers everything stored about that visitor on one website: pageviews and custom events, errors, web vitals, engagement, outgoing link clicks, revenue attribution, identity links, profile traits and their history, and session recordings with their summaries.

Find the visitor

Requests take a visitor ID:

• For identified users, use the profile ID you pass to identify(). To start from an email address, look the profile up with POST /profiles/findByEmail.
• For anonymous visitors, use the visitor ID shown on the user's page in the dashboard.

Databuddy links the ID to every browser and session recorded for that visitor. On a browser that another identified profile also used, only the visitor's own sessions are included, so one person's request does not remove someone else's data. Naming a shared browser directly covers its sessions that belong to no identified profile.

With the default anonymizeVisitorIds setting, each browser gets a new stored ID every day. Without an identified profile, a request reaches only the days whose stored ID you have; Databuddy cannot connect earlier days to the same browser.

The same applies to a profile you identify only from your server. identify() in the browser tags the visitor's later events with the profile ID, so a request reaches them. A browser ID you pass to server-side identify() is kept as sent, while its events are stored under the daily ID, so the request covers that profile's stored profile, traits, and events tagged with it, but not the browser's untagged visits.

From the dashboard

Open Users, select the visitor, and use the menu next to the session count:

• Export visitor data downloads a JSON file with every stored row, the profile with decrypted name and email, trait changes, and recording metadata.
• Delete visitor data erases it. Reports can take a few minutes to update.

Both actions need the same permission as deleting the website: organization owners and admins.

From the API

Use an API key with permission to manage the website.

curl -X POST https://api.databuddy.cc/visitor-data/export \
  -H "x-api-key: $DATABUDDY_API_KEY" \
  -H "content-type: application/json" \
  -d '{"websiteId": "your-website-id", "visitorId": "user_123"}'

curl -X POST https://api.databuddy.cc/visitor-data/delete \
  -H "x-api-key: $DATABUDDY_API_KEY" \
  -H "content-type: application/json" \
  -d '{"websiteId": "your-website-id", "visitorId": "user_123"}'

Export returns a filename and the JSON document in data. Each analytics table holds up to 50,000 rows and is marked truncated past that. Delete returns a requestId, the rows erased per table, and the profiles and recordings removed. A pending status means the request is stored and the background purge finishes it.

Keep the requestId and check it later. Calling delete again creates a new request instead of reporting on the first one.

curl -X POST https://api.databuddy.cc/visitor-data/deletion-status \
  -H "x-api-key: $DATABUDDY_API_KEY" \
  -H "content-type: application/json" \
  -d '{"websiteId": "your-website-id", "requestId": "the-request-id"}'

The status is pending while the latest deletion pass failed and is waiting for retry, submitted while queued events recorded before the request are still being erased, and completed with a completedAt time once the seven-day window has closed and nothing the request covers remains.

What deletion does

• Events recorded before the request that were still queued are erased by a background pass every six hours, for seven days. Identify calls recorded before the request are dropped instead of recreating the profile. After that, the request keeps only its ID, website, requester, and timestamps.
• Visits after the request are new data. If the visitor returns, or your site identifies them again, Databuddy collects as usual. Stop calling identify() for them, or honor their opt-out, if they objected to processing.
• The audit log records who exported or deleted visitor data, without the visitor ID.

Some records are not part of a visitor request:

• Replay billing receipts keep a session ID.
• Short-lived rate-limit and replay counters keyed by IP address or session expire on their own within a day.
• Feature flag rules and saved analysis can contain an ID you typed into them yourself.

For anything else, contact privacy@databuddy.cc.