GDPR Compliance

Tuteliq provides built-in endpoints for GDPR data subject rights so you can fulfill privacy obligations without building custom infrastructure.

Privacy is not a premium feature. All GDPR endpoints are available on every tier, including free.

Data Subject Rights

Right to Erasure (Article 17)

Delete all stored data associated with a user account, including analysis history, cached results, and metadata.

curl -X DELETE https://api.tuteliq.ai/account/data \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "user_id": "usr_abc123", "confirm": true }'

Response:

{
  "status": "accepted",
  "deletion_id": "del_xyz789",
  "estimated_completion": "2026-02-16T13:00:00Z",
  "records_queued": 142
}

Erasure requests are processed asynchronously. Most deletions complete within 1 hour. You will receive a deletion.completed webhook event if webhooks are configured.

Right to Data Portability (Article 20)

Export all data associated with a user account in a machine-readable JSON format.

curl https://api.tuteliq.ai/account/data/export \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -G -d "user_id=usr_abc123" -d "format=json"

Response:

{
  "status": "processing",
  "export_id": "exp_def456",
  "format": "json",
  "estimated_completion": "2026-02-16T12:45:00Z",
  "download_url": null
}

Once processing is complete, the download_url field will contain a time-limited signed URL. You can poll the export status or configure a webhook for the export.ready event.

JSON
CSV

curl https://api.tuteliq.ai/account/data/export \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -G -d "user_id=usr_abc123" -d "format=json"

curl https://api.tuteliq.ai/account/data/export \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -G -d "user_id=usr_abc123" -d "format=csv"

Right to Rectification (Article 16)

Update or correct stored metadata associated with a user account.

curl -X PATCH https://api.tuteliq.ai/account/data \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "user_id": "usr_abc123",
    "corrections": {
      "display_name": "Updated Name",
      "age": 14,
      "region": "EU"
    }
  }'

Response:

{
  "status": "updated",
  "user_id": "usr_abc123",
  "fields_modified": ["display_name", "age", "region"],
  "updated_at": "2026-02-16T12:00:00Z"
}

Manage data processing consent on a per-user basis.

curl -X POST https://api.tuteliq.ai/account/consent \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "user_id": "usr_abc123",
    "purposes": ["safety_analysis", "emotional_analysis", "voice_analysis"],
    "legal_basis": "explicit_consent",
    "consented_at": "2026-02-16T10:00:00Z"
  }'

curl -X DELETE https://api.tuteliq.ai/account/consent \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "user_id": "usr_abc123",
    "purposes": ["emotional_analysis"]
  }'

When consent is withdrawn for a specific purpose, any subsequent API calls for that purpose involving the user will return a 403 with error code CONSENT_REQUIRED.

Public Transparency Endpoints

The following endpoints are publicly accessible and require no authentication. They are intended to support your own transparency and compliance documentation.

Endpoint	Description
`GET /compliance/dpa`	Current Data Processing Agreement (PDF)
`GET /compliance/sub-processors`	List of sub-processors with locations and roles
`GET /compliance/retention`	Data retention policy by data type

Example: Sub-Processors

curl https://api.tuteliq.ai/compliance/sub-processors

{
  "last_updated": "2026-01-15T00:00:00Z",
  "sub_processors": [
    {
      "name": "Google Cloud Platform",
      "location": "United States / EU",
      "purpose": "Infrastructure and compute",
      "dpa_url": "https://cloud.google.com/terms/data-processing-addendum"
    },
    {
      "name": "Upstash",
      "location": "EU",
      "purpose": "Rate limiting and caching",
      "dpa_url": "https://upstash.com/trust/dpa"
    }
  ]
}

Example: Retention Policy

curl https://api.tuteliq.ai/compliance/retention

{
  "policies": [
    {
      "data_type": "analysis_results",
      "retention_period": "90 days",
      "auto_delete": true
    },
    {
      "data_type": "audio_files",
      "retention_period": "24 hours",
      "auto_delete": true
    },
    {
      "data_type": "api_logs",
      "retention_period": "30 days",
      "auto_delete": true
    },
    {
      "data_type": "account_metadata",
      "retention_period": "Until deletion requested",
      "auto_delete": false
    }
  ]
}

Audio submitted to /safety/voice and the voice streaming endpoint is never stored. It is transcribed and analysed in memory and discarded when the request completes; there is no 24-hour window and no audio at rest. The same applies to images, video, documents and message text. What can be retained is the classification result, and only if incident logging is enabled.

Getting Started

SDKs

MCP Server

Integrations

Verification

Advanced

Compliance

GDPR Compliance

Data Subject Rights

Right to Erasure (Article 17)

Right to Data Portability (Article 20)

Right to Rectification (Article 16)

Public Transparency Endpoints

Example: Sub-Processors

Example: Retention Policy

​Data Subject Rights

​Right to Erasure (Article 17)

​Right to Data Portability (Article 20)

​Right to Rectification (Article 16)

​Consent Management

​Record Consent

​Withdraw Consent

​Public Transparency Endpoints

​Example: Sub-Processors

​Example: Retention Policy

Data Subject Rights

Right to Erasure (Article 17)

Right to Data Portability (Article 20)

Right to Rectification (Article 16)

Consent Management

Record Consent

Withdraw Consent

Public Transparency Endpoints

Example: Sub-Processors

Example: Retention Policy