GDPR Compliance Guide

How Threadline addresses each GDPR right for both commenters and publishers.

Rights for Commenters

GDPR Right	How Threadline Supports It
Right to Access (Art. 15)	Dashboard → Settings → Data shows all data we hold about you.
Right to Rectification (Art. 16)	Edit your display name and email in dashboard settings.
Right to Erasure (Art. 17)	Close your account to delete all personal data. Comments are anonymized (not deleted) to preserve conversation context.
Right to Portability (Art. 20)	Export all data as JSON. See data export.
Right to Object (Art. 21)	Opt out of analytics tracking per-site. Contact support for global opt-out.
Right to Restrict Processing (Art. 18)	Close your account. Data is retained but not processed until you reopen.

Legal Basis for Processing

Comment content: Legitimate interest (providing the service you signed up for)
Email addresses: Consent (magic link authentication requires it)
IP addresses: Legitimate interest (spam prevention, rate limiting)
Pageview analytics: Legitimate interest (operating the service for publishers)

For Publishers (Data Controllers)

If you embed Threadline on your site, you are a data controller for your visitors' comments. Threadline acts as your data processor. Key points:

Download our standard Data Processing Agreement (DPA) from the GDPR overview; Publisher+ customers can request a countersigned copy
Data is stored in EU data centers for EU-based publishers
You can configure data retention periods per-site in your dashboard
Our full data mapping document is at security/compliance/gdpr/data-mapping.md in the repo

Implementation examples

Account deletion

Authenticated users schedule erasure via the account API (30-day recovery window):

DELETE /api/account/delete
Cookie: session=...

# 200
{
  "ok": true,
  "message": "Your account is scheduled for deletion.",
  "recoverable_until": "2026-06-12T14:00:00.000Z",
  "grace_days": 30
}

Export download

Download a machine-readable copy of account data (Art. 20):

GET /api/account/export
Cookie: session=...

# Returns application/json attachment:
# threadline-export-<userId>-<timestamp>.json

Guest claim / deletion notes

Guest comments can be claimed into an account via POST /api/auth/guest-claim with a claim token.
Unclaimed guest comments are hard-deleted after 24 hours - they are not retained for marketing or analytics.
Once claimed, the same export and deletion APIs above apply to that account.

DPA checklist for publishers

Identify yourselves as controller; Threadline as processor for embedded comments.
Download the standard DPA from /gdpr (or /legal/threadline-dpa.md) and request countersignature for Publisher+ and above before go-live in regulated regions.
Disclose Threadline in your privacy policy and cookie notice where applicable.
Configure retention and moderation settings that match your lawful basis.
Route erasure / access requests to Threadline tools or privacy@threadline.io within your SLA.
Confirm subprocessors and region (EU storage available for EU publishers).

Questions? Contact our DPO at privacy@threadline.io. We respond to GDPR-related requests within 30 days as required.