Context
The Auto Drive Terms of Use (Section 9) commit to deleting or anonymising personal data upon account termination, subject to legal retention obligations. The system also acknowledges that data written to the DSN will persist. The implementation should balance data protection compliance with the ability to maintain audit records and allow account resurrection.
Requirements
Deletion flow
When a user requests account deletion (via UI or support request), the system should: (a) confirm the request with the user (e.g., "This will remove your personal data. Data stored on the DSN cannot be removed. Are you sure?"); (b) initiate a grace period (suggest 30 days) before deletion is executed, during which the user can cancel and resurrect their account by logging in; (c) after the grace period, execute the anonymisation.
Anonymisation approach
Rather than hard-deleting the user record, anonymise it. Replace personally identifiable fields (name, email, OAuth identifiers, wallet address display name) with anonymised placeholders (e.g., "deleted-user-[hash]"). Retain the internal user ID and association with upload/download records so that audit trails remain intact. Remove or anonymise any IP addresses, session logs, and authentication tokens.
Account resurrection
If a user signs up again with the same OAuth provider within the grace period, re-link them to their existing account and cancel the deletion. After anonymisation has been executed, a returning OAuth sign-up creates a fresh account with no link to the prior one.
Credit handling
If the user has unused Credits at the time of deletion request, refund them in accordance with ToU Section 5.6 (original AI3 amount) before anonymisation. If the wallet address has also been anonymised, the refund must be processed during the grace period while the address is still available.
Admin visibility
Admins can view pending deletion requests and their grace period status. Admins cannot reverse a completed anonymisation.
Compliance
The implementation should satisfy GDPR Article 17 (right to erasure) and CCPA/CPRA deletion rights. Maintain a log of deletion requests and execution timestamps for regulatory audit purposes. The log itself should not contain personal data.
Context
The Auto Drive Terms of Use (Section 9) commit to deleting or anonymising personal data upon account termination, subject to legal retention obligations. The system also acknowledges that data written to the DSN will persist. The implementation should balance data protection compliance with the ability to maintain audit records and allow account resurrection.
Requirements
Deletion flow
When a user requests account deletion (via UI or support request), the system should: (a) confirm the request with the user (e.g., "This will remove your personal data. Data stored on the DSN cannot be removed. Are you sure?"); (b) initiate a grace period (suggest 30 days) before deletion is executed, during which the user can cancel and resurrect their account by logging in; (c) after the grace period, execute the anonymisation.
Anonymisation approach
Rather than hard-deleting the user record, anonymise it. Replace personally identifiable fields (name, email, OAuth identifiers, wallet address display name) with anonymised placeholders (e.g., "deleted-user-[hash]"). Retain the internal user ID and association with upload/download records so that audit trails remain intact. Remove or anonymise any IP addresses, session logs, and authentication tokens.
Account resurrection
If a user signs up again with the same OAuth provider within the grace period, re-link them to their existing account and cancel the deletion. After anonymisation has been executed, a returning OAuth sign-up creates a fresh account with no link to the prior one.
Credit handling
If the user has unused Credits at the time of deletion request, refund them in accordance with ToU Section 5.6 (original AI3 amount) before anonymisation. If the wallet address has also been anonymised, the refund must be processed during the grace period while the address is still available.
Admin visibility
Admins can view pending deletion requests and their grace period status. Admins cannot reverse a completed anonymisation.
Compliance
The implementation should satisfy GDPR Article 17 (right to erasure) and CCPA/CPRA deletion rights. Maintain a log of deletion requests and execution timestamps for regulatory audit purposes. The log itself should not contain personal data.