Two things live here, and they are not the same. Export is you taking your data out. Erasure requests are members asking to be removed, and those come with a legal clock attached.
Exporting members
From the member list, open More actions and choose Export CSV. Despite the name, the window that opens lets you decide what goes into the file and in which format.
- System fields, the built-in ones such as name, email, status and dates.
- Custom fields, the ones you defined yourself.
- More data, the extras beyond the profile itself.
Under Output file you pick CSV, Excel or JSON. CSV for another system, Excel for a person, JSON when something will read it programmatically.
Your column selection is remembered, so the export you build once is a click next time.
Filter before you export. The file covers everything your current search and filters return, so narrowing the list first is what gets you the fifty people you were asking about instead of all four thousand. Ticking rows does not change it.
To export only the rows you tick, tick them in the list and choose Export CSV in the bar that appears at the bottom. That file is always CSV with the standard columns, so the column and format choices above do not apply.
One member's own data
When a single person asks for a copy of their data, the list export is the wrong tool. Open their profile, go to Security, and use Export data (GDPR).
You get a ZIP file with everything stored about that member: profile and membership, tags and custom fields, access and course progress, orders and subscriptions, community activity, chats, sign-ins, devices and files. That is the answer to an access request under Art. 15 GDPR.
Members can also get a copy themselves. In their own profile, under Privacy, Export my data downloads their personal data as a JSON file.
Erasure requests
Members ask for erasure themselves, from the Privacy tab of their own profile, with Request account deletion and an optional reason. Until you act on it they see A deletion request is pending review. and can withdraw it with Cancel this request.
Every request appears on the Data Requests page in the audience tabs. It is a queue, and every item in it carries a deadline.
The page has three tabs: Open requests, Erased accounts, and Rejected and withdrawn.
The deadline
The law gives you 30 days from the request. Each item shows how many days are left, and an item past that point is marked overdue.
Open requests are sorted Most urgent first, so the item closest to its deadline is the one you see first. Newest is the other order. On a normal week the list is short and this takes minutes.
The deadline is not advisory. Leaving requests unanswered is a compliance problem, not an inbox problem.
Erasing an account
Opening a request shows the member, when they asked, and any reason they gave.
Erasing is permanent, so you confirm twice: you tick I understand this erasure is permanent and cannot be reversed., and only then does Erase permanently work.
What happens is precise.
| Removed | Kept |
|---|---|
| Name, email, address, avatar | Orders, invoices and payments, anonymised |
| Logins, sessions and API tokens | Posts, comments and chat messages, under an anonymised name |
The account is anonymised rather than deleted from existence, because financial records have to survive. Your books stay correct and complete, and nothing in them points back at a person any more.
Posts, comments and chat messages stay for a similar reason: the threads and conversations other members took part in still make sense.
There is no undo. Once an account is erased, you cannot restore the person's name or reach them again. Be sure the request is genuine and from the account holder.
When erasing is blocked
An administrator of your platform cannot be erased. The request then shows why, and the erasure stays refused until you remove their admin role or transfer ownership. The same applies to a request whose account no longer exists or that has already been resolved.
Rejecting a request
Not every request has to be granted. If there is a lawful reason to refuse, use Reject request. Reason for rejecting (optional) lets you note why, and that note is kept with the request.
Rejecting is for genuine grounds, such as an open legal obligation. It is not for inconvenience. Write the reason down even though it is optional: it is what you show if anyone asks later.
Deleting a member yourself
Delete on the profile, Delete Member in the row menu and Delete in the bulk actions of the member list all run exactly the same erasure as the queue. The account is anonymised, financial records are kept, and nothing is lost from your books.
Each of these deletions is recorded on the data requests page too, under Erased accounts, marked By admin. If the person already had an open request, deleting them closes that request instead of adding a second entry. So the request, the decision and the date of the erasure sit in one place, however the erasure started.
Administrators are refused here as well. Deleting a single administrator stops before anything is recorded. A bulk delete skips administrators and your own account, and tells you how many accounts were deleted and how many were skipped.
Contacts
Contacts are handled from the contacts list rather than here. An unsubscribe is not an erasure. An unsubscribed contact stays on your list with their address suppressed, so you can prove they must not be emailed.