Your data: export and deletion — admin

Settings → Your data, and a person's own page. Phase 5 week 27.

Who opens it: an Owner, because somebody asked for a copy of what the organization holds, or because the organization is leaving. What they came to do: download everything, answer one person's request, or close the organization for good. What must be true when they leave: they have a file they can open, or they know exactly what will be deleted and when — and that they can still stop it.

Export everything

Settings → Your data → Export everything builds one zip, in the background, with:

• organization.json — the organization itself;
• data/{table}.json and data/{table}.csv — every row of every table the organization owns: events, forms, registrations, attendees, tickets, check-ins, messages, payments, the audit log and the rest;
• files/… — every file you stored: form uploads, ticket images, brand files, imports, print batches, rosters.

Passwords, API key hashes, tokens, webhook secrets and DKIM keys are left out. Money is in integer cents; times are UTC. The export is listed on the page when it is ready; Download works for 7 days, and the file is deleted after that. Asking, building and downloading each leave a row on your audit log.

One person's details

On a person's page (Attendees → the person):

• Export personal data downloads everything held about them — their record and answers, their contact details, tickets, days, check-ins, messages and payments — as person.json, with the files they uploaded. Anybody who may read people can.
• Erase personal data is for a deletion request. It cannot be undone, so only an Owner can, with a reason and the current code from their authenticator app. Their live tickets are voided, their uploads deleted, and their name, date of birth, address, phone and answers removed. Their contact is emptied too, unless somebody else in their household shares it.

What erasing keeps, on purpose: check-in rows (a check-in is never altered or deleted — the row names a record, not a person), payments (a financial record), and earlier rows on the audit log, which are kept until your plan's retention removes them. If the person had complained about your email, the address is kept as a one-way hash so they are not mailed again if they register again.

Delete the organization

Settings → Your data → Delete the organization asks why, for your organization's address name, and for the current code from your authenticator app. Nothing is deleted that day: the deletion is scheduled 30 days out, the page shows the date, and Cancel the deletion stops it at any time before then.

On the day, everything that belongs to the organization is deleted: every event, person, ticket, check-in, message, file and audit row, and the accounts of members who belong to no other organization. Backups holding it roll off within a further 30 days. What survives is an address that complained about your email, as a one-way hash, and EntryWick's own record that the organization was deleted, when, by whom and why.

EntryWick can also export or schedule the deletion of an organization from its own console, for an Owner who has lost access; it leaves the same rows on your audit log.

If you stop using EntryWick

Your plan says how long we keep what you have collected: 12 months on Free, 24 on Starter and Growth, 36 on Scale, and whatever your contract says on Enterprise. The clock only starts once you stop — the day a subscription runs out, or, if you were never paying, the end of your last event. A committee that runs one event a year is never counting down, and a plan you cancel keeps its own period: leaving Growth keeps your 24 months rather than dropping you to 12.

Thirty days before anything would be deleted, every Owner gets an email with the date and a link to download the lot. The same date appears here on Settings → Your data, with Cancel the deletion beside it, exactly as if somebody had asked for it.

Using EntryWick again calls it off by itself — publish an event or start a subscription and the deletion is cancelled and the clock reset. There is nothing to reply to and nobody to ask.