Account Deletion
Request removal of your individual account data from DamLogics
Organization data is not affected
To provide its services, DamLogics holds individual account data as well as project data — PFMs, L2RAs, structures, files, and risk analysis, etc. The Organization is the owner and controller for project data. Deleting your individual account removes you from the platform but does not delete organization-owned data. To remove organization-owned data, contact your organization administrator or, if you are the organization owner, contact us directly.
Beta notice: Automated self-service account deletion is on our roadmap. During beta, submit requests via email and we will process them within 30 days.
Internal review needed
Self-service account deletion already exists via the Profile DangerZone UI (api.gdpr.deleteMyAccount). The beta notice claiming it is “on our roadmap” is inaccurate.
What gets deleted — individual account data
- Your account profile (name, email address, avatar)
- Authentication credentials and active sessions
- Your organization and project memberships
- Notification history addressed to you
- Access log entries referencing your account
What is not affected — organization-owned data
- Libraries, Projects, Project Details, PFMs, L2RAs, Risk Visualizations, MFUs — owned by your organization
- Files uploaded to projects — owned by your organization
- Your activity logs, comments and risk elicitation entries — retained as part of the project record
Internal review needed
“Comments and risk elicitation entries — retained” is incorrect. The deleteMyAccount implementation explicitly deletes l2raComments. Either the page or the code needs to be corrected.
Submit a request
Email us at privacy@damlogics.com with the subject "Account Deletion Request". Include the email address associated with your account.
Identity verification
We will verify your identity within 2 business days to protect against unauthorized deletion requests.
Processing
Once verified, your personal account data will be permanently removed within 30 days. You will receive a confirmation email when complete.
Internal review needed
Step 3 says data is “permanently removed.” The actual implementation uses an anonymize-in-place strategy — the user row persists as “Deleted User” with a synthetic email. This is legally defensible under GDPR but “permanently removed” is inaccurate. Consider “permanently anonymized” or “permanently de-identified.”