Customers & GDPR
Export and erasure (GDPR)
Export a customer's data as JSON and erase personal data: what is erased, what is kept and what you handle by hand.
With the Privacy (GDPR) card you answer a customer's request for access or erasure.
Where: Customers › a customer › the Privacy (GDPR) card.
Both actions need the admin role. Both match on the customer's email and on the link to the record. They therefore include orders with the customer's email that are not linked to the record.
Export
- Open the customer.
- Press Export JSON in the Privacy (GDPR) card.
The file downloads. The card shows the same list under What the export contains.
| In the file | Not in the file |
|---|---|
| The customer record | The activity log |
| Orders and order lines | Submissions from the storefront's forms |
| Reviews and notes | Shipments, carrier records and saved shipping quotes |
| Access-group memberships | Forum posts, which are saved under a display name |
| Contact messages | The sign-in account, if the person has one |
| Saved checkout sessions, without the payment provider's HTML | – |
The file also includes membership, loyalty account, event RSVPs, returns, withdrawals and complaints with their lines and a complaint's photos (file, type, size and date), and withdrawals for orders from a previous shop, when they exist.
Erase
- Open the customer.
- Press Erase personal data.
- Read what is erased, anonymised and kept.
- Fill in Reference for this request, for example the ticket number.
- Type the customer's email address.
- Press Erase permanently.
BunStack saves the reference in the activity log. It later shows which request the erasure answered. Do not write the person's email there.
Warning: You cannot undo the erasure. Export first if the customer also asked for a copy.
| What | How |
|---|---|
| Notes, access-group memberships, contact messages from the address and their notifications | Erased outright |
| The customer record | The email is replaced. Name, phone and sign-in link are removed. Consent is turned off |
| Orders | The buyer's email is replaced. Name, message, internal notes, addresses and links are removed. The answers the customer typed for a service, such as a print text, are removed from the order lines, see Services |
| Returns, withdrawals and complaints | The name, the comment and the receipt address are removed. The return label PDF and the complaint's photos are deleted. Return number, lines, amounts, status, tracking number and the reason for a rejection are kept |
| Withdrawals for orders from a previous shop | The email and the name are replaced. The comment and the note are removed. A rejection keeps its note |
| Checkout sessions, membership, event RSVPs, the loyalty account's email, log rows with the address, the log rows of the orders and returns, notifications with the address or the name from a withdrawal | Anonymised |
| Order numbers, amounts, VAT, status and dates | Kept for 7 years under the Swedish Bookkeeping Act |
| The delivery country on each order | Kept. The VAT return is built from it |
| The VAT number on reverse-charge orders | Kept. The invoice is not valid without it |
| Loyalty points, redemptions and reviews | Kept without a link to the person |
After the erasure the card shows a receipt with counts per table, once. The proof that remains is the customer.erased row in the activity log. The record gets the ERASED stamp.
The receipt also counts the deleted return labels. If they could not be deleted, the card says so. Then run the erasure again.
Handle by hand
The erasure does not reach:
- shipments and carrier records. A tracking number still leads to the delivery address at the carrier
- the destination in saved shipping quotes, until the quote expires
- submissions from the storefront's forms and forum posts
- the sign-in account itself
Handle them before you answer that the request is complete.
Erase again
Erasures before September 2026 did not reach the buyer's name and email on the orders. The card on an erased record therefore shows Erased before Sep 2026? Run it again to clear names on orders.
- Press Run the erasure again.
- Fill in the reference and the address the dialog shows.
- Press Erase permanently.
The erasure reaches the orders linked to the record. It no longer finds orders that only had the email, because the address is gone. On a complete record it changes nothing.