Exporting or Erasing What a Visitor Talked to Your Team About
Chat has a dedicated GDPR workflow scoped to individual visitor conversations — separate from deleting a workspace account entirely.
A GDPR data-subject request against a live-chat tool is a specific, narrow ask: "what do you have on me, and can you delete it." That's a different problem from deleting an entire workspace account, and Chat handles it as one — a dedicated endpoint scoped to visitor conversations, not bundled into general account deletion.
Two ways to look something up
The lookup side supports two entry points, depending on what you already know. A GET request with an ?email= parameter returns which chats a given person has been part of — useful when someone emails your privacy inbox saying "I chatted with you a while back" without remembering details. A GET with ?chatId= returns the full export of that specific conversation as JSON — the complete record for a request that names the conversation directly.
Erasure is scoped and deliberate
Deleting is a DELETE request against ?chatId= — it erases that specific conversation. Both the lookup and the erasure paths are restricted to workspace owners and admins. That's a deliberate restriction: an erasure request is exactly the kind of action where you don't want it triggerable by just any team member with inbox access, since it's irreversible and directly affects your compliance record.
Why this is a different thing from account deletion
The distinction worth being precise about: this is not the same mechanism as deleting a workspace account, which is handled through a separate internal erasure path. That endpoint is for a business leaving the platform entirely. The chat GDPR endpoint is for the much more common and much narrower case — one visitor exercising their right to be forgotten by a business that carries on operating normally afterward. Conflating the two would either make individual erasure requests far more disruptive than they need to be, or make account-level deletion too narrow to actually satisfy what it's for.
Handling a real request
When a data-subject request comes in, start with the email lookup if that's all the requester gave you, confirm you've found the right conversation(s), and — if the request is for deletion, not just access — use the chat-scoped delete rather than reaching for anything at the account level. Keep a record outside the system of when the request came in and when it was fulfilled; the endpoint performs the export or the erasure, but your own compliance log is still yours to maintain.