> ## Documentation Index
> Fetch the complete documentation index at: https://docs.davazmysel.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy and data retention

> Consent requirements, per-domain data retention, and GDPR data subject requests.

## Consent before tracking

Your workspace has a single **Require consent before tracking** toggle, under **Settings → Workspace → Settings & Integrations** (Consent card) — it applies to every domain, since the tracking snippet is installed once per workspace rather than per domain. When it's on, the snippet stays completely silent — no events, no cookies — until the visitor consents. See [consent mode](/tracking/install-snippet#consent-mode) for how to wire up a consent banner.

## Data retention

Under **Settings → Workspace → Settings & Integrations** (Data retention card), choose how long Dava keeps raw event data for your workspace: **30, 90, 180, or 365 days** (the default). This is a single workspace-wide policy, not set per domain. Events older than the retention period are removed automatically by a daily cleanup job.

## GDPR data subject requests

Under **Settings → Privacy**, the **Data subject requests** section handles right-to-access and right-to-erasure requests. Only the workspace owner can use it.

<Steps>
  <Step title="Find the person">
    Search by **email address** or **contact ID**. Dava shows how many events match, with a sample. Emails are hashed in your browser before being sent — Dava stores and matches hashes, not plain addresses.
  </Step>

  <Step title="Export (right to access)">
    **Export CSV** downloads every matching event: event type, time, page URL, and source.
  </Step>

  <Step title="Delete (right to erasure)">
    **Delete All Events** removes every event for that person after a confirmation. This cannot be undone.
  </Step>
</Steps>