> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lekalao.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy and the GDPR

> Consent records, the right of access, the right to be forgotten and retention limits.

Lekalao keeps a trace of every consent, and gives you what you need to answer people who ask "what do you know about me?" and "forget me".

## Consent records

**Settings → Privacy** shows three figures (**People on file**, **Forgotten**, **Consent records**) and then the register itself.

Each row says who, what, through which channel, for which list, from which IP address and when:

| Event                | Written when                                     |
| -------------------- | ------------------------------------------------ |
| **Subscribed**       | Someone subscribes or is added.                  |
| **Confirmed**        | They click the double opt-in link.               |
| **Unsubscribed**     | They unsubscribe, or the team unsubscribes them. |
| **Subscribed again** | They come back after leaving.                    |
| **Blocked**          | Their address goes to the suppression list.      |
| **Data exported**    | Their data was downloaded.                       |
| **Data erased**      | They were forgotten.                             |

The source is one of: **Subscription form**, **Import**, **API**, **Added by the team**, **Automation**, **Sending provider** (a bounce, a complaint) or **The subscriber** themselves (their preferences page).

Search an address and filter by event to find the proof someone asks you for.

## The right of access

On a subscriber's record, **Download their data** produces a readable JSON file with:

* the person: address, first name, last name, time zone, attributes;
* the subscription: list, status, dates, the reason they left, tags;
* their consent records;
* the e-mails they received: subject, date sent, opened, clicked, bounced.

The download itself is written to the register.

## The right to be forgotten

On a subscriber's record, **Forget this person**. Their address, their name, their attributes, their time zone and their tags are erased for good. What they opened and clicked stays in the statistics, attached to nobody: your rates do not move.

The **Remember the address as blocked** option (ticked by default) adds the address to the [suppression list](/contacts/suppression-list), so that an import does not bring it back.

In the register, the records stay but lose the address, the IP, the browser and the URL.

<Warning>
  Forgetting cannot be undone. When a person simply wants nothing more from
  you, unsubscribe them instead.
</Warning>

## Retention limits

The **How long data is kept** section, applied every night:

<ParamField path="Forget people who left after" type="days">
  Subscribers who unsubscribed longer ago than that are forgotten
  automatically (without being blocked: they left, they were not thrown out).
  Between 30 and 3,650 days; empty to never do it.
</ParamField>

<ParamField path="Keep consent records for" type="days">
  Records older than that are deleted. Between 365 and 3,650 days; 1,825 days
  (five years) by default. They are what proves a subscription was asked for:
  do not go below the time during which someone could take you to task over
  it.
</ParamField>

Two other clean-ups live elsewhere:

* subscribers who **never confirmed** are deleted after the delay in **Settings → General** (see [General settings and maintenance](/account/maintenance));
* the **detail** of opens, clicks, transactional e-mails and webhook calls is purged after a year (see the same page).

## What is still up to you

Lekalao gives you the tools; compliance stays yours:

* say on your forms what people will receive, and how often;
* prefer [double opt-in](/contacts/lists);
* put a postal address and an unsubscribe link in every campaign (Lekalao refuses to send without them);
* answer requests within the legal time (a month in Europe).