Data Privacy

XC Scribe provides tools for managing your data in compliance with GDPR and privacy regulations. These features are available to organization admins under Settings > Data Privacy.

Export Your Data

You can download a complete copy of your organization's data at any time.

1. Navigate to Settings > Data Privacy.
2. Click Export My Data.
3. The system will prepare your export in the background. You'll see a progress indicator.
4. Once ready, a download link appears. Click it to save the file.

The export includes all projects, content items, data sources, settings, and account information associated with your organization.

Delete Your Account

If you need to permanently remove your organization and all its data, you can delete your account at any time.

Deletion is immediate and permanent

Account deletion runs immediately when you confirm. There is no grace period and no way to recover the account afterward. Export your data first if you want a copy.

How to Delete Your Account

1. Navigate to Settings > Data Privacy.
2. Click Delete Account.
3. A confirmation dialog appears. You must:
   • Type your exact organization name to confirm.
   • Enter your current password (or confirm via your SSO provider).
4. Click Permanently Delete Account.

As soon as the request succeeds, you're signed out and your account no longer exists.

What Gets Deleted

The following are erased without delay:

• Organization account and all user accounts within it.
• All projects, content items, and data sources.
• Uploaded and generated files (stored in S3).
• Store and blog connections (access tokens are revoked and removed).
• AI Studio requests.
• Notification history.
• Active subscription (cancelled immediately via Paddle).

What Is Retained (and Why)

Two categories of data are kept for legal and operational reasons:

• Invoices and billing records — anonymized (name, company, and address replaced with placeholders) and retained for the period required by applicable tax laws (typically 5 years). They are no longer linked to any identifiable person.
• System logs (IP addresses, request timestamps) — retained for up to 90 days for security and fraud prevention, then automatically purged.

Confirmation Email

After deletion completes, a confirmation email is sent to all users who had accounts in the organization. This is for your records only — the accounts are already gone when you receive it.

Who Can Access These Features

Only organization admins can export data or delete the account. Regular team members will see a message directing them to contact their admin.