A user wants their data deleted — how do I handle GDPR?

You need to delete their submissions. There is no magic button for this yet, but the API gets you there.

Search for the user's submissions: GET /api/forms/{id}/[email protected]. This finds submissions across all fields containing that value.

Then delete each submission individually. Or if you want to delete everything for a specific email across all your forms, loop through your forms and search each one.

Is this ideal? No. A bulk delete endpoint for GDPR would be better. We are working on it. For now, the search + delete loop works.

The important thing: Sutrena does not share submission data with third parties. It is stored in our PostgreSQL database, not sent to analytics services or ad networks. When you delete it, it is gone.

For prevention: collect only what you need. If you do not need a name, do not add a name field. Fewer fields means less data to worry about.