Let people download their data
Give users a self-service export of the personal data you hold about them, in a format they and other services can read.
Skip to the promptWho needs this
- You have users in the EU or UK (right of access and right to data portability) or in a US state with a right to know or access.
- You want to answer data requests without manual work.
Why it matters
- Under the GDPR, people can ask for a copy of their personal data plus information about how it's used (Art. 15), and receive data they gave you in a structured, machine-readable format they can take elsewhere (Art. 20). You have one month to respond.
- California and other US states give a right to know or access, with a 45-day response time in California.
- A self-service export answers most requests instantly, and it forces you to know where the data lives.
Before you paste
- Your personal data map, so the export covers every table and service.
- Where to store generated files temporarily (for example a private storage bucket).
The prompt
Copy it into your AI builder. Fill in anything in [brackets] first, and review every change before you ship it.
Add "Download my data" to account settings. 1. WHAT TO INCLUDE A ZIP file with: - profile.json: account details, settings, preferences - content/: everything the person created (posts, projects, uploads as files), as JSON plus the original files - consents.json: every consent they gave or withdrew, with timestamps and versions - billing.json: orders and invoices (amounts, dates, plan), without full card numbers - activity.json: important account events (sign-ins, password changes, exports, deletions requested) - README.txt explaining each file in plain words, plus: why you use their data, who you share it with (list the services), how long you keep it, and how to delete their account. This answers the extra questions GDPR Art. 15 says people are entitled to ask. 2. WHAT TO LEAVE OUT - Other people's personal data (for example other members of a shared workspace), password hashes, secrets and tokens, internal notes that would reveal other people's information or trade secrets. 3. HOW IT RUNS - Generate the export in a background job if it can take more than a few seconds; email the person when it's ready. - Store the file in a private bucket and give a signed download link that expires after 24 hours. - Ask the person to re-enter their password (or a code) before starting an export. - Check ownership on the server: the export only ever contains data for the signed-in user ID, never an ID passed from the browser. - Rate-limit exports (for example one per hour) and log each request with a timestamp. When you're done: list every file you changed, explain each change in one line, and give me a step-by-step test for each numbered item above. Don't change anything unrelated.
Builder tips
Lovable
Ask for the export as a Supabase Edge Function that writes to a private bucket and returns a signed URL.
Cursor
Ask it to generate the export's README from the same list of tables it exports, so the two never drift apart.
Claude Code
Start in plan mode (Shift+Tab) so you approve the plan before any file changes, then let it run the checks it lists.
Common mistakes
- Exporting by an ID from the request, so a changed URL exports someone else's data.
- Public, permanent download links.
- Including other people's data from shared spaces.
- Forgetting files the person uploaded.
Check it worked
- 1Export from a test account that has content, uploads and a test purchase: every part appears in the ZIP.
- 2Open profile.json in a text editor and the README in plain text: both make sense to a non-developer.
- 3Copy the download link into a private window after 24 hours: it no longer works.
- 4Try requesting another user's export by changing an ID in the network request: refused.
What a SafeLaunch scan adds
SafeLaunch checks which rights each of your markets gives people and whether your product and privacy notice cover them.
One free fix in your inbox each week
A new copy-paste prompt for Lovable, Cursor or Claude Code every week, with the rule behind it and how to check it worked. No spam, unsubscribe in one click.
By signing up you agree to get this weekly email. We send it with Kit, and you can unsubscribe at any time. What we share with Kit is in our privacy notice.
Questions
Sources
General guidance for common problems, not legal advice. Whether a rule applies depends on where you operate, who your users are and the size of your business.