GDPR Mode (EU and UK)

GDPR mode makes EmbedAuth handle your app's users the way a processor has to under data protection law. It is included in the Pro and Enterprise plans, and you turn it on for each app separately from the app's GDPR page in the dashboard. Only owners and admins can change it, because turning it on accepts an agreement on your organization's behalf.

There are two switches, one for each law:

• EU GDPR mode, for users in the European Union and the EEA. Turning it on accepts the Data Processing Agreement.
• UK GDPR mode, for users in the United Kingdom, under the UK GDPR and the Data Protection Act 2018. Turning it on accepts the Data Processing Agreement together with its UK Addendum, and adds a privacy complaints channel.

Turn on each one your users fall under. Either switch turns on all the protections below. If your organization moves to the free plan, the switches keep their settings but stop applying until you upgrade again.

What it does

• Deleting the app deletes its users. Without GDPR mode a deleted app is only marked deleted.
• Old data is removed on a schedule. An hourly task removes, for example, IP addresses and browser details on sign-in events after 90 days, and sign-in events after a year. The app's GDPR page shows the full schedule.
• Users can take a copy of their data. There is a Download your data link in the account widget, an export endpoint for your server, and a download of every user on the GDPR page.
• No third-party fonts. The widgets load their fonts from EmbedAuth instead of Google Fonts.

Telling your users how you use their data stays your job. Set your privacy policy's address under Settings → Legal Links, and the sign-in widget links to it where people sign up.

Privacy complaints (UK GDPR mode)

Since June 2026, UK law requires every controller to let people complain about how it uses their personal data. You have to acknowledge each complaint within 30 days, look into it, and tell the person the outcome. In UK GDPR mode, EmbedAuth runs that channel for you:

1. Your users complain through a form at https://embedauth.com/privacy-concern/{clientId}. The account widget links it, and you should link it from your privacy policy too. The GDPR page shows your app's exact address.
2. EmbedAuth emails the complainant at once to confirm it arrived. That email is the acknowledgement.
3. Your organization's owners and admins get an email, and your webhooks receive privacy.complaint_received.
4. You read the complaint on the app's GDPR page and answer there. Send update keeps the person informed. Send outcome and resolve tells them the outcome and closes it. Every answer is emailed to them and kept with the complaint.

Resolved complaints are kept for a year. A complaint is deleted along with the user who made it.

The webhook

Subscribe to privacy.complaint_received on the dashboard's Webhooks page. The payload is signed like every other event:

{
  "event": "privacy.complaint_received",
  "timestamp": "2026-10-14T10:00:00.000Z",
  "data": {
    "complaintId": "3f2a9c1e-…",
    "reference": "PC-3F2A9C1E",
    "userId": "u_123",
    "email": "[email protected]",
    "name": "Ada",
    "message": "…",
    "receivedAt": "2026-10-14T10:00:00Z"
  }
}

userId is the user's sub when the complainant's email matches one of the app's users. Otherwise it is null, since anyone can complain, not only people with an account.