GDPR / data subject tools

[JuansesDev]

Problem

Real-world deployments need to honor data subject requests: 'export everything you have on me', 'delete me hard', 'show me what marketing you sent me'. Today we have unsubscribe (which only flips a status flag) and that is it.

Proposal

Subscriber-level operations exposed via UI and API:

1. Export all data — JSON dump of subscriber row, all email_logs targeting them, all open / click events, all unsubscribe history. Returned as a downloadable file.
2. Hard delete — remove the subscriber row, anonymize their email in email_logs (keep counts but lose PII), drop tracking events. Distinct from unsubscribe (which keeps the row).
3. Retention policies — project setting: 'auto-delete email_logs older than N days'. Cron job sweeps daily.
4. Per-recipient view — what we have on jane@example.com: every email sent, opened, clicked, current subscription status. UI page accessible via search.

Acceptance criteria

• Export and hard-delete work via API and UI
• Hard-deleted recipient cannot be re-targeted by name (anonymized in logs)
• Retention sweep is configurable per project
• Documented as the GDPR / CCPA feature in user-facing docs