GDPR Article 17: how do I delete my account and all data?

GDPR Article 17 gives you the right to have your personal data erased. Zenovay implements this as a self-service flow you can run yourself — no support ticket needed, no waiting period.

Self-service deletion (recommended)

1. Sign in to app.zenovay.com.
2. Go to Settings → Account.
3. In the Delete account card, click Delete my account.
4. Read the confirmation panel, which lists what will be deleted.
5. Type DELETE to confirm, then click the delete button.

You'll be signed out immediately. A confirmation email is sent to your registered address shortly afterward.

What gets deleted

The deletion runs as a cascade across every system that holds your personal data:

System	What's deleted
Supabase auth	User row, sessions, OAuth identities
Supabase tables	Profile, websites you owned, team memberships, audit-log entries you authored, API keys, MFA/WebAuthn credentials
Stripe	Customer record, active subscription cancelled
Cloudflare KV	Sessions, security state, rate-limit counters, MCP and AI-query quota
Cloudflare R2	Heatmap screenshots for websites you owned
GA4 integrations	Disconnected and the Google refresh token revoked

A confirmation email is sent via Resend to your registered address after deletion completes. We do not retain you on any marketing list once the account is gone.

For owned websites that the deletion takes down, all visitor analytics for those sites are erased too — visitors, events, sessions, replays, heatmaps. If you're a team member of a website owned by someone else, deleting your account removes only your membership; the website's data stays under the owner.

Before you delete

Two things to consider:

• Export your data first. Article 20 (data portability) is separate from Article 17. If you want a copy of your personal data, use Export my data on the same Settings → Account page before deletion. See Article 20 export.
• Cancel paid subscriptions — the deletion auto-cancels any active Stripe subscription. You won't be billed past the deletion date. If you've prepaid annually, the unused portion is not automatically refunded; email [email protected] if you need a prorated refund.

What if I'm in a team I don't own?

Deleting your account removes:

• Your team membership (you no longer have access).
• Audit-log entries you authored (your reference is cleared from the workspace trail).
• Any MFA / WebAuthn devices you registered.

The team itself, the websites the team owns, and other members are unaffected. The team owner can re-invite you with a fresh account if you ever return.

Timeline

• Immediate: sign-out, profile + sessions purged.
• Within the deletion run: Stripe customer cancelled, GA4 tokens revoked, KV/R2 cleanup performed.
• Shortly after: confirmation email sent.
• Within 30 days: any database backup snapshots referencing your records are purged on their normal rotation.

What about already-shared analytics?

If you had public dashboards or shareable links pointing to your data, those URLs stop resolving after deletion. Anyone who already had screenshots or local copies still has those — there's nothing we can do about that.

I can't sign in to delete

Email [email protected] from the address you registered with. Include:

• "I am exercising my GDPR Article 17 right to erasure."
• A scan or photo of a government-issued ID with the document number redacted — we only need to verify name/email match. Discard the redaction copy after we confirm.

We respond within 30 days (the GDPR-mandated window). Most cases close within 5 working days.

Plan applicability

The right applies on every plan including Free. Deletion is free of charge — we cannot legally charge for an Article 17 request.

Related reading

• Right to erasure (overview)
• Article 20 data export
• Deleting your account (UI guide)