Your Data Rights

Exercise your GDPR rights with Engramma: data export, erasure, consent management, and the processing registry — step by step.

Overview

Under the General Data Protection Regulation (GDPR), you have specific rights over your personal data. Engramma provides full API access to exercise each right programmatically or via the dashboard.

Right	GDPR Article	How to exercise
Access	Art. 15	Data export
Rectification	Art. 16	Update memories via store/forget
Erasure	Art. 17	Request erasure
Restrict processing	Art. 18	Revoke consent
Data portability	Art. 20	Data export (JSON/CSV)
Object	Art. 21	Revoke consent

Engramma processes your data based on explicit consent. You can view, grant, and revoke consent at any time.

View your consents

import os
from engramma_cloud import EngrammaClient

client = EngrammaClient(api_key=os.environ['ENGRAMMA_API_KEY'])

consents = client.gdpr.consents()
for c in consents:
    status = 'granted' if c.granted else 'not granted'
    print(f'{c.purpose}: {status}')
    if c.expires_at:
        print(f'  Expires: {c.expires_at}')

Purpose	Description	Required
`memory_storage`	Store and process memories for retrieval	Yes (core service)
`analytics`	Anonymous usage analytics for service improvement	No
`marketing`	Product updates and feature announcements	No
`third_party_sharing`	Share anonymized data with research partners	No

# Grant consent with optional expiration
client.gdpr.grant_consent(
    purpose='analytics',
    expires_in_days=365  # auto-expires after 1 year
)

# Revoke a specific consent
client.gdpr.revoke_consent(consent_id='consent_abc123')

# Impact: data processing for that purpose stops within 24 hours

Warning

Revoking memory_storage consent triggers an automatic data erasure request. Your memories will be queued for permanent deletion.

Export your data

Request a complete export of all your data in JSON or CSV format (GDPR Article 20 — Right to data portability).

Request an export

# Request a full data export
export_req = client.gdpr.export(
    format='json',
    include=['memories', 'metadata', 'causal_links', 'usage']
)
print(f'Export ID: {export_req.export_id}')
print(f'Estimated time: {export_req.estimated_time_minutes} minutes')
print(f'Will notify: {export_req.notify_email}')

Data categories

Category	Contents
`memories`	All stored memory patterns with text and embeddings
`metadata`	Tags, importance scores, creation dates
`causal_links`	Causal relationships between memories
`usage`	API call history, timestamps, operations performed

Check export status

# Check if the export is ready
status = client.gdpr.export_status(export_id='exp_abc123')
print(f'Status: {status.status}')  # processing, completed, or failed

if status.status == 'completed':
    print(f'Download: {status.download_url}')
    print(f'Size: {status.size_mb} MB')
    print(f'Expires: {status.download_expires_at}')

Info

Download links expire after 24 hours. You'll receive an email notification when the export is ready.

Request erasure

Request permanent deletion of all your data (GDPR Article 17 — Right to erasure). This is irreversible after the 7-day safety window.

Submit an erasure request

# Request data erasure
erasure = client.gdpr.erasure(
    confirm=True,
    reason='No longer using the service'
)
print(f'Erasure ID: {erasure.erasure_id}')
print(f'Scheduled for: {erasure.execution_at}')
print(f'Cancel before: {erasure.cancellation_deadline}')
print(f'Data affected:')
print(f'  Memories: {erasure.data_affected.memories}')
print(f'  Causal links: {erasure.data_affected.causal_links}')

What gets deleted

Data	Deleted	Timeline
All memory patterns	Yes	At execution date
Causal links	Yes	At execution date
Metadata records	Yes	At execution date
Export files	Yes	At execution date
Account	Yes	At execution date
Billing records	Retained 7 years	Legal obligation
Audit logs	Retained 90 days	Security requirement

Cancel an erasure request

You have 7 days to change your mind:

# Cancel before the deadline
client.gdpr.cancel_erasure(erasure_id='era_abc123')
print('Erasure cancelled — your data is safe')

Danger

After the 7-day window, erasure is permanent and cannot be reversed. All data is cryptographically shredded and unrecoverable.

Processing registry

View exactly how your data is processed (GDPR Article 30):

registry = client.gdpr.processing_registry()
print(f'Controller: {registry.controller}')
print(f'DPO contact: {registry.dpo_contact}')

for activity in registry.processing_activities:
    print(f'\nPurpose: {activity.purpose}')
    print(f'  Legal basis: {activity.legal_basis}')
    print(f'  Data categories: {activity.data_categories}')
    print(f'  Retention: {activity.retention}')
    print(f'  EU transfers: {activity.transfers_outside_eu}')

Contact the DPO

For any data protection question not covered by the API:

Channel	Contact
Email	[email protected]
Response time	Within 72 hours
Supervisory authority	CNIL (France)

Next steps

GDPR API Reference — Full endpoint documentation
Authentication — Secure your account with MFA
API Key Best Practices — Protect your credentials