Under GDPR, visitors have the right to request a copy of all personal data you hold about them (a Subject Access Request, or SAR). Yaplet makes this straightforward: you search for the visitor, export three CSV files covering their profile, conversations, and messages, and send the files to the requester.
Only the workspace owner can perform data exports. The export is logged in the audit log with a timestamp and your name.
1. Find the visitor
- Go to Security → Visitors.
- Search for the visitor by email or name.
- Click the visitor's name to open their profile.
2. Export the data
- On the visitor's security profile, click Export data (or similar GDPR action button).
- Yaplet generates three CSV files:
Visitor profile CSV
Contains: visitor ID, name, email, country, external ID, custom data fields, subscription plan, created date, last seen date, ban status.
Conversations CSV
Contains: conversation ID, visitor name and email, channel/source, conversation state, assigned agent, created date, last message date.
Messages CSV
Contains: message ID, conversation ID, visitor name and email, message content, message type, whether it was outbound, assigned agent, timestamp.
3. Deliver to the requester
Send the exported CSV files to the person who made the request. GDPR requires you to respond within 30 days of receiving the SAR (1 month, extendable to 3 months for complex cases).
What the export does not include
- Uploaded media file contents (images, attachments sent in chat) — these are stored separately and would require a manual download from the storage system.
- Security risk signals and trust scores — these are derived/processed data and typically do not need to be disclosed under SAR rules, but check with your legal team if in doubt.
Keep records
The audit log automatically records each export. You can use this to demonstrate compliance if a supervisory authority asks when you processed the SAR.