Data export
Self-service export of your own Pact data as a downloadable ZIP of JSON and CSV — what's included, how the download link is secured, and how it differs from a DSAR.
Any signed-in Pact user can export their own data from /settings/privacy. This is the GDPR Article 20 portability right applied to you as a user of Pact — distinct from the DSAR inbox, which handles requests from external data subjects (your contacts and leads).
Requesting an export
The flow is asynchronous so a large account never blocks the request:
- 1
Request
POST /v1/me/privacy/exportqueues a background export job and returns202 Acceptedwith the request ID. Prior exports are listed onGET /v1/me/privacy. - 2
Assemble
A worker (
process_export) gathers your records across tables, builds an in-memory ZIP, and marks the request ready. - 3
Download
GET /v1/me/privacy/export/download/{token}serves the ZIP. See the security note below on why this route is token-only.
What's in the ZIP
The archive (_build_zip) contains a complete machine-readable pact-data-export.json plus a CSV per section. The sections gathered (core/gdpr.py) are:
- profile — your user record, with credential fields stripped
- contacts_created — contacts you created
- sequences_authored — sequences you authored
- activity_audit — audit/activity entries you generated
- api_keys — key metadata only (hashes and scopes, never the secret)
- sessions — session metadata (created/last-seen/user-agent, never the token)
- meeting_intelligence — summaries and transcript text for meetings you hosted
- export_metadata — tenant, user,
exported_at, and aformat_version
Secrets are never exported
The export is deliberately PII-complete but secret-free: API-key rows carry hashes and scopes but not the key value, session rows list metadata but not the auth token, and raw meeting-recording URLs are excluded (the provider artifact expires and retention purges it anyway).
How the download link is secured
The download URL points at a full-PII ZIP and is served by an unauthenticated, token-only route — it has to be clickable from an email without a live session. That makes link hygiene a security control: the token window is deliberately short and the link is single-purpose, so a URL that later leaks (a forwarded mail, a shared inbox) is not a long-lived door into a bundle of personal data. When the ZIP lives in object storage, the download route redirects to a signed, expiring URL rather than streaming bytes through the app.
Export vs. DSAR vs. deletion
| Surface | Who it serves | Entry point |
|---|---|---|
| Data export (this page) | A Pact user (you) | /settings/privacy → /v1/me/privacy/export |
| DSAR | External data subjects | DSAR inbox (compliance team) |
| Account deletion | A Pact user (you) | /v1/me/privacy/delete (30-day grace) |
Deletion is the mirror of export: POST /v1/me/privacy/delete starts a 30-day grace period with a cancellation link, and a cron entrypoint (process_expired_deletions) anonymizes users whose grace period has lapsed by hard-deleting the user record and scrubbing PII from related rows.