Someone has asked you for a copy of everything you hold about them — a Subject Access Request, or SAR, under GDPR. Yaplet gives you three CSV downloads: visitor profiles, conversations and messages. They cover your whole organisation rather than one person, so the last step is yours: filter each file down to the person who asked, and send them their own rows.
Only the organisation owner can run these exports. Every export is written to the audit log with a timestamp and your name.
1. Download the three files
- Go to Settings → Organization settings → Data Export.
- Click Download CSV on each of the three cards — Visitors, Conversations and Messages. Each one downloads on its own.
Visitors
One row per visitor: visitor ID, name, email, country, plan, your own external ID for them, custom data fields, the date they were created, when they were last seen, and whether they are banned.
Conversations
One row per conversation: conversation ID, the visitor's name and email, the channel it came from, its state, the agent it is assigned to, when it started, and when it was last updated.
Messages
One row per message: message ID, the conversation it belongs to, the visitor's name and email, the message text, its type, whether it was outbound, whether it was visible to the visitor, the agent, and the timestamp.
2. Filter down to the person who asked
Open each file in a spreadsheet and keep only the rows that match the requester. Their email address is the easiest handle: it appears in all three files. Start with the Visitors file to confirm you have the right person, then use the same email to filter Conversations and Messages. Send them the filtered rows — not the raw exports, which contain everybody else's data too.
3. Answer within the deadline
GDPR gives you 30 days (one month) from receiving the request, extendable to three months for genuinely complex cases. The download itself takes seconds, so the deadline is really about identifying the person correctly and checking what you send.
What the export does not include
- The contents of uploaded files and images sent in chat. Those are stored separately and would have to be collected by hand.
- Security risk signals and trust scores. These are data Yaplet derived rather than data you were given, and usually do not have to be disclosed — check with your legal advisor if you are unsure.
What may already be gone
Yaplet removes old data on a schedule, so a request about someone who has not visited for a long time can legitimately come back with nothing. Conversations are deleted after three years of inactivity on a paid plan, or 120 days on the free plan, and an anonymous visitor with no conversations left is deleted after 125 days of inactivity. Anyone who identified themselves — an email address, a phone number, or your own customer ID — is kept no matter how long they have been idle. See What Yaplet deletes automatically for the full schedule.
Keep the record
Every export is recorded in the audit log automatically. If a supervisory authority later asks when you handled the request, that entry is your dated proof.