---
title: "Submit a privacy deletion request (GDPR Art.17 / CCPA §1798.105 / PIPEDA right-to-be-forgotten)."
method: POST
path: "/v1/privacy/deletion-request"
tags: ["privacy"]
---

# Submit a privacy deletion request (GDPR Art.17 / CCPA §1798.105 / PIPEDA right-to-be-forgotten).

`POST /v1/privacy/deletion-request`

## Request

- Base URL: `https://api.etymolt.com`
- URL: `https://api.etymolt.com/v1/privacy/deletion-request`
- Auth: none declared

Queues a deletion of the personal data Etymolt holds for the requester's email address. Returns a receipt with a quotable request_id and a 30-day SLA. An acknowledgement email is dispatched best-effort; ack_email_sent=False in the response just means the operator needs to reach out manually (does NOT mean the request failed — the request is queued regardless).

Retention policy (Sarah §2.3 canonical): raw personal data (email, source IP, verdict body content) is deleted within 30 days. An aggregate-anonymized name+outcome hash may be retained beyond 90 days for coexistence lookups per the ToS. The deletion-receipt row itself (this request_id) is retained forever as the audit trail proving the request was honored.

## Request body

- DeletionRequestBody: POST body for /v1/privacy/deletion-request. ``email`` is required — it's the identifier we authenticate against when the requester later follows up, and it's the address the ack email is sent to. ``verdict_ids`` (optional) narrows the deletion to specific verdicts the requester wants scrubbed. If omitted, the background drainer deletes ALL verdicts, brief history, dossier PDFs, watches, and audit-log entries associated with this email across the primary tables. ``identifier`` (optional) — a supplementary identifier like an ``X-Etymolt-Key`` API-key hash or a Stripe customer ID. Lets the drainer find records that aren't email-keyed.
  - `email` string, email, required: Email address to authenticate the request against. The ack + completion emails are sent here.
  - `verdict_ids` string[], nullable: Optional narrow-scope: delete only the listed verdict_id records. Omit to delete ALL data for this email.
  - `identifier` string, nullable: Optional supplementary identifier (API-key hash, customer ID, phone number for voice-line users, etc.) so the drainer can locate records that aren't email-keyed.

## Response `200`

Successful Response

- DeletionReceipt: Response body for POST /v1/privacy/deletion-request.
  - `request_id` string, required: Opaque short ID the requester can quote in follow-up correspondence. Format ``dsr_<12-url-safe-chars>``.
  - `received_at` string, required: ISO-8601 UTC timestamp of the request intake.
  - `ack_email_sent` boolean, required: Whether an ack email was successfully dispatched. False does NOT mean the request failed — the request is queued either way; it just means the operator should follow up manually. Common cause: no RESEND_API_KEY in the environment (dev / test).
  - `sla_days` integer: SLA under which the deletion will be completed, measured from ``received_at``. 30 days per Sarah's BOARD_REPORT_LEGAL §2.3 for EU/CA jurisdictions; matches the GDPR Art.12 §3 one-month floor.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/etymolt/apis/etymolt-verify-ai-generated-brand-names.md) · [All operations](https://skmtc.dev/etymolt/apis/etymolt-verify-ai-generated-brand-names/llms.txt) · [OpenAPI document](https://skmtc.dev/etymolt/apis/etymolt-verify-ai-generated-brand-names/revisions/7228ffa1efa7?raw)