People can ask you about the personal data your website holds about them: to see it, delete it, correct it, withdraw their consent or stop it being sold or shared. Kukie.io gives each site a request form and an inbox, on every plan. You answer each request yourself, from your own email. Kukie.io never answers for you.
Turn on the form
- Open your site and go to Privacy Requests.
- Under Request form, turn on Accept privacy requests.
- Choose the Language of the form and its email: English or Português (Brasil).
- Select Save.
The page then shows the form's address. Select Copy to copy it, or Open to see the form as your visitors do. Only owners and admins of the site's organisation can change these settings.
Link to the form
- Your privacy policy. A privacy policy you generate in Legal Documents links to the form while it is on, if you leave URL where people can submit privacy requests blank. After you turn the form on or off, generate the privacy policy again and publish it: the published version keeps its old text until you do.
- Your banner. In the Banner Editor, open Preferences modal and turn on Show a link to your privacy request form. The link appears in the preferences modal, below the description, while your form is on. Its text is set for each language in the same tab, under Privacy request link; leave it empty to use the built-in text.
- Anywhere else. Paste the form's address into a page, a footer or an email.
What happens when someone sends a request
- The person fills in their name, email address, what they would like to do and where they live. They can add details and, if your banner shows it, their consent ID.
- Kukie.io sends them one email with a link. The request reaches you only after they open the link and confirm. A request nobody confirms within 24 hours is deleted.
- Owners and admins of the organisation get an email saying a new request arrived. The email names the site, the request type and the suggested deadline, not the person.
- The request appears in Privacy Requests.
The email link proves only that the person controls that email address. Before you send anyone personal data, check that they are who they say they are.
California's rules do not let a business ask for that kind of check before it stops selling or sharing someone's personal information. Keep a way to opt out that needs no email confirmation as well, such as the banner's Do Not Sell My Personal Information link in your US region rules.
Work through a request
Open a request to see the person's details, when it arrived and its suggested deadline.
- Reply by email opens your email app with the person's address.
- Status: New, In progress, Completed or Declined. Select Save after a change.
- Deadline: suggested from where the person lives, for example one month in the European Union, 15 days in Brazil and 45 days in the United States (15 business days for a request to stop selling or sharing personal information). The law that applies to your site decides the real deadline, so change the date if it differs.
- Notes: what you did or what is next. Only owners and admins see notes; the person never does.
- Consent ID: if the person gave one, copy it and use Find a visitor's records in the Consent Log to find, export or delete their consent records.
Three days before the deadline of an open request, owners and admins get a reminder email. To stop both emails, turn off Privacy requests under Notifications.
Keep a record
Select Export CSV to download every request with its dates, status and details. Some laws, such as California's, ask a business to keep a record of the requests it received for 24 months.
How long requests are kept
- A request nobody confirms: deleted after 24 hours.
- A completed or declined request: deleted 24 months after it was closed. Reopening a request stops that clock.
- Deleting the site deletes all its requests at once.
Who can see requests
Requests carry people's names, email addresses and messages, so only the owners and admins of the site's organisation can see them. Editors see the page without any request on it.
