[Product][Privacy][P2] Implement or Verify Account Deletion and Data Export Flows

[AnshRaj112]

Backlog ID: ISSUE-KMP-096 | Epic: EPIC-01 | Complexity: Large

Full-stack issue: also tracked in the paired repository (AnshRaj112/kampyn-frontend).

Description

ISSUE-KMP-096 is a Medium severity / P2 priority Architecture issue in Both, under Data Privacy.

Problem overview

This work item asks the team to: Implement or Verify Account Deletion and Data Export Flows.

Today the system behaves as follows: Unknown/incomplete from audit.

That is incorrect or insufficient for a production multi-tenant platform. After this issue is fixed, the expected outcome is: Documented deletion/export meeting product/legal needs; technical controls enforced.

Why this issue exists

Privacy posture gap.

If this remains unresolved, realistic consequences include: Inability to honor deletion/export requests.

This finding is grounded in the technical audit: Audit Data Privacy account deletion/export Needs product verification.

Implementation scope

Concrete touchpoints are listed later in this issue (1 file path(s) and 1 API/function touchpoint(s)). Use those lists during implementation and code review so nothing in scope is missed.

Recommended direction (outcome-focused, not a mandatory design): Verify existing; implement gaps; never claim legal compliance solely from tech.

Planning

• Estimated complexity: Large
• Priority rationale: Needs verification then implement.
• Notes: Needs verification / product decision.
• Depends on: none listed — can be scheduled as soon as an owner is assigned.

Definition of done

Close this issue only when every Acceptance Criteria checkbox is complete and the Testing Requirements have been run (or waived with written rationale on the PR). The title states the change; this description, the expected behavior, and the acceptance criteria together define success.

Current Behavior

Unknown/incomplete from audit.

Expected Behavior

Documented deletion/export meeting product/legal needs; technical controls enforced.

Why This Matters

Privacy posture gap.

Evidence From Audit

Audit Data Privacy account deletion/export Needs product verification.

Risk / Impact

Inability to honor deletion/export requests.

Recommended Direction

Verify existing; implement gaps; never claim legal compliance solely from tech.

Acceptance Criteria

• Documented user/tenant data deletion path
• Export path for user data if required by product
• Authz on both flows

Testing Requirements

• Integration test

Affected Files

• Needs discovery

Affected Functions / APIs

• Needs discovery

Notes

Needs verification / product decision.

---

Created from KAMPYN_GITHUB_ISSUES.md