> ## Documentation Index > Fetch the complete documentation index at: https://docs.zespan.com/llms.txt > Use this file to discover all available pages before exploring further. # Privacy: your choices, data export, and account deletion > Manage analytics, marketing and advertising choices, download a copy of your Zespan account data, or delete your account from Settings → Privacy. This page covers **your own Zespan account**: the optional choices you make about analytics, marketing and advertising, and how to export or delete your account data. To export or erase the data of **your application's end users** — the people whose activity your traces record — see [End-user data requests](https://docs.zespan.com/platform/end-user-data.md). Everything here lives under **Settings → Privacy**. ## Privacy choices Zespan has three optional choices. None is required to use Zespan, and none is ticked for you. Sign-up asks only about the first two, **Product analytics** and **Product emails**. Advertising measurement is never asked at sign-up or during setup; it stays off until you turn it on under **Settings → Privacy**: | Choice | What it allows | | - | - | | **Product analytics and session replay** | Usage analytics and recorded sessions that help us improve Zespan. | | **Marketing emails** | Product updates and announcements from Zespan. | | **Advertising measurement** | Sharing sign-up and first-trace events with our ad partners, so we can measure our own advertising. It is not used to show you ads inside Zespan. | The **Privacy choices** card under **Settings → Privacy** has a switch for each. Changes apply immediately, and withdrawing is as easy as granting. If saving a change fails with `CONSENT_REQUIRED`, accept the Terms of Service first. ### Product analytics and session replay Analytics loads only after you turn this choice on, and turning it off stops tracking and session replay at once and clears the analytics identifiers stored in your browser. While it is on: * **Session replay masks all text.** Every element's text is replaced, and images, video, canvas, embedded frames, and the areas that show trace, prompt, completion and conversation content are blocked entirely. Only a sample of sessions is recorded. * **Clicks only.** Automatic capture records clicks — never what you type or the text on the page. * **No IP addresses** are stored by analytics. * **No name or email.** Analytics identifies you only by an opaque user id; your email, name and avatar are never sent. The dashboard honours your browser's **Do Not Track** and **Global Privacy Control** signals: when either is set, analytics never loads, even if you turned the choice on. ### Cookies from our advertising If you reach Zespan from one of our ads, a click identifier and campaign details may be stored in a cookie — but only if you consented on our website and your browser sends neither Global Privacy Control nor Do Not Track. | Cookie | Purpose | Lifetime | | - | - | - | | `zs_rdt_cid`, `zs_rdt_uuid` | Reddit ads click identifier, used for advertising measurement. | Deleted at sign-up, because sign-up doesn't ask for **Advertising measurement**. | | `zs_utm` | Campaign source, medium and name, set only together with the click identifier. | 28 days, or deleted at sign-up, because sign-up doesn't ask for **Advertising measurement**. | If you turn on **Advertising measurement**, the campaign details are kept with your account and are deleted when you withdraw the choice. Turning the choice off stops anything further from being shared. ## Export your data You can request a copy of the data Zespan holds about your account (GDPR Articles 15 and 20). Requests are answered within 30 days. **1. Request an export** Under **Settings → Privacy**, click **Export my data**. When the export is ready you get an email. The email contains no link or attachment. **2. Download it** Sign in, open **Settings → Privacy**, and click **Download** next to the finished export under **Your exports**. The list shows when each export expires (7 days after it's ready, by default). Each click creates a new short-lived download link. The export includes your account details and the data from your organizations' projects and your ZespanPilot conversations. | Message | Meaning | | - | - | | This export is not ready yet | It's still being prepared. Try again later. | | This export has expired. Please request a new one. | The download window has passed. | | Download storage is temporarily unavailable | Try again in a few minutes. | ### From the API Both routes authenticate with your dashboard session (browser cookie), not `x-api-key`. | Route | What it returns | | - | - | | `GET /v1/gdpr/dsar-requests` | Your requests, each with its status, deadline, `expiresAt`, and `hasDownload` (true only for a completed export that hasn't expired). The download link is never in this list. | | `GET /v1/gdpr/dsar-requests/{id}/download` | `{ "url", "expiresInSeconds" }` — a fresh link that works for 5 minutes. `404` if the request isn't yours, `409 NOT_READY`, `410 EXPIRED`, `503 STORAGE_UNAVAILABLE`. | ## Request statuses | Status | Meaning | | - | - | | **Pending** | Received, waiting to be processed. | | **Processing** | Being prepared. | | **Ready** / **Completed** | Done. Exports show **Download** until they expire. | | **Failed** | Could not be completed. **Stalled** means it was stuck for more than 24 hours; you can submit a new request. | | **Closed** | Handled by the Zespan team. | You can have one request of each kind in progress at a time, and make up to three privacy requests per hour. ## Delete your account Under **Settings → Privacy → Danger zone**, click **Delete account** (GDPR Article 17). * **You can't delete your account while you're the only owner of an organization.** The dashboard names those organizations. Delete them first — see [Organizations → Deleting an organization](https://docs.zespan.com/account/organizations.md#deleting-an-organization). * **You're signed out right away**, and your data is erased in the background. * **Your name and email are removed from changes you posted.** Change timeline entries created from the dashboard before 2026-10 could carry your name or email as their source; account deletion rewrites those to `dashboard` in every organization you belonged to. The change itself stays on the timeline. > [!WARNING] > > Deleting your account can't be undone. Export anything you need first. > [!NOTE] > > Privacy requests can't be made or downloaded while a Zespan staff member is [impersonating your account](https://docs.zespan.com/platform/security.md#staff-access-to-your-account) for support. ## Emails you'll receive | Email | When | | - | - | | **Your data export is ready** | When an export finishes. It states the expiry date; download from **Settings → Privacy**. | | **Your account data has been erased** | When account erasure completes. It is the last email sent to the account. | ## What deletion does not remove * **Audit log entries** about your actions stay with your organization's audit trail; see [Audit log](https://docs.zespan.com/platform/audit.md) for how long. * **Backups** are not edited. They expire on their own schedule (database backups after 30 days, trace-store backups after 42 days), and completed erasures are re-applied if a backup is ever restored. * **Copies you or your teammates curated** (datasets, annotation queues, evaluation runs, issues) are not part of account erasure. For your application's end users, see [what an erase does not remove](https://docs.zespan.com/platform/end-user-data.md#what-is-not-erased), including why session ids must be unique per conversation. ## IP addresses are stored truncated IP addresses stored with your sign-in sessions, privacy choices, and new audit log entries are truncated before they are saved: the last part of an IPv4 address is zeroed (`203.0.113.0`, a /24), and IPv6 addresses keep only the first 48 bits. The active-sessions list, the [audit log](https://docs.zespan.com/platform/audit.md), and your data export show the stored, truncated value. ## Next steps * [End-user data requests](https://docs.zespan.com/platform/end-user-data.md) — erase or export one of your application's end users * [Data retention and deletion](https://docs.zespan.com/platform/data-retention.md) — how long trace data is kept, and deleting projects and organizations * [Account security](https://docs.zespan.com/account/security.md) — password, two-factor authentication, sessions, and CLI terminals * [Security](https://docs.zespan.com/platform/security.md) — encryption, authentication, and data controls This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.