The idea
A small web app that gives a company one public URL where customers submit "send me my data" or "delete my data" requests. Behind that URL sits a case tracker: each request gets a verified requester, a countdown to the statutory deadline, a checklist of every system that holds personal data, and an append-only log of who did what. When the case closes, it emits a signed export bundle for the customer and an evidence trail for whoever asks later.
Why build this
Any company with EU or California customers has to answer these requests, and the ones under about fifty people answer them in Slack threads. Someone emails support, support forwards it to an engineer, the engineer runs a query against production, pastes a CSV into a Google Drive link, and nothing is recorded. That works until the volume rises past a couple a month, or until an auditor, an enterprise customer's security questionnaire, or a regulator asks how the last twenty were handled.
The existing tools are priced for companies with a privacy team — OneTrust and Osano start where a seed-stage startup stops reading. The gap is a tool that assumes one part-time owner, no legal department, and five to fifteen systems holding customer data. It is also a rare compliance product where the deliverable is concrete: a bundle of files and a timestamped trail, not a policy document.
Stack sketch
- Portal and console: Next.js (App Router) with Tailwind, deployed on Vercel or self-hosted behind Docker.
- Data: Postgres via Prisma. Cases, systems, connector runs, and an
audit_eventstable that is insert-only and hash-chained so tampering is detectable. - Requester verification: magic-link email through Postmark, tied to an address that already exists in the customer's own user table — verify against the account, not against a claim.
- Connectors: small modules with a common
find(subject)/export(subject)interface. Ship with a direct Postgres connector (you supply the queries), Stripe, Intercom, and S3 prefix listing. - Job runner: BullMQ on Redis, so a fan-out across ten systems retries per-connector instead of failing the whole case.
- Export: a zip of JSON plus flattened CSVs, delivered as a presigned S3 URL that expires in seven days.
- Nudges: a daily cron that posts to Slack at day 7, 14, and 25 of a 30-day clock.
Scope for v1
In: the public intake form, email verification, case timeline with a deadline clock, a per-company list of systems with manual "checked / exported / deleted" states and an evidence note on each, two working connectors (Postgres and Stripe), the export bundle, the audit log, and Slack reminders.
Out: identity-document verification, consent and cookie management, a connector marketplace, multi-tenant white-labelling, and — deliberately — automated deletion. v1 records that a human deleted the rows and stores their note. Executing destructive writes against a customer's production database on day one is how you become the incident.
Where it could go
The obvious next step is turning the manual checklist into real automation, one connector at a time, with a dry-run mode that shows exactly which rows would be touched before anything is written. That dry run is the feature people will pay for, because it converts the scariest part of the job into something reviewable.
After that, two paths open. The audit trail is already most of an evidence pack, so exporting a per-quarter summary that drops straight into a SOC 2 or ISO review makes the tool useful to a second buyer inside the same company. And agencies and fractional privacy consultants handle this for a dozen clients at once — a client-switcher and per-client branding turns a single-company tool into their daily workspace.
Watch out for
Verification is the sharp edge in both directions: verify too little and you hand one person's data to an impostor, verify too much and you have collected a passport scan in the name of privacy. Anchor identity to the existing account wherever possible. Separately, keep the product on the mechanics of handling requests and out of telling anyone what the law requires of them — the moment the UI starts asserting deadlines as legal advice, you own that claim.