Erasing personal data

When a customer asks you to erase their personal data, what Pixonaut holds for them depends on how far their purchase got. Each call below states, in its own description, exactly what it removes and what it keeps.

Before the design is ordered

A delivery given for a design’s first order (PUT /v1/designs/{id}/delivery, or the customer’s answer on the address capture page) is held with the design. Erase it with DELETE /v1/designs/{id}/delivery, using the secret key or a connected store’s integration key. It answers 204 whether there was a delivery or not, so it is safe to call for every design the customer made.

After the design is ordered

Once the design has an order, the order holds the recipient and the shipping address, and the design’s delivery no longer applies. Erase them with POST /v1/orders/{id}/erase-personal-data, once the order has shipped, failed or been cancelled. Until then it is refused 409 order_in_flight, since the printshop may still need the address. The order stays, its recipient and shippingAddress now null, and personalDataErasedAt says when its data was erased.

Find a customer’s orders by your own reference with GET /v1/orders?externalRef=. The reference is yours, and is not erased.

What the customer put into a design

A design holds what its customer made: the text they typed, such as a name on a shirt, and the pictures they uploaded, in each of its revisions, proofs and prints. Erase them with POST /v1/designs/{id}/erase-personal-data, using the secret key or the store’s integration key, whatever the design’s status: approved and printed designs included. Call it for every design the customer made.

• Every field the customer could fill is emptied, and every picture they uploaded is removed, in every revision. Text and pictures the template itself holds stay, so the design still says what was made from which template.
• Their request for changes and the delivery they gave are erased with them.
• The design stays: its template, status, dates and prints. It answers with personalDataErasedAt set, and design.personal_data_erased is sent to your webhook.
• The pictures and proofs are deleted within six hours.
• A print’s files are kept while an order of it is still being made, since the printshop needs them, and deleted within six hours once every order of it has shipped, failed or been cancelled. An order whose outcome is unknown is not done, and keeps them until it is settled.
• Nothing more is printed, ordered, corrected, duplicated or asked to change from the design, and it takes no delivery: those calls answer 409 design_erased.

Calling it again answers the design unchanged. A design you already deleted is erased too, and answered 204.

{
  "id": "1792022400000-8c2f4e1a-6b3d-4f7e-9a5c-1d0e8f7a6b52",
  "type": "design.personal_data_erased",
  "createdAt": 1792022400000,
  "payload": { "designId": "6f1c8a2b-3d4e-4f5a-8b6c-7d8e9f0a1b2c" }
}

What is not erased

• The fulfilment payload is yours, written by your store, and stays with the design and its prints. Keep personal data out of it.
• A design duplicated from another is a design of its own: erase it too.
• No erasure reaches what a printshop was already sent.