Build GDPR compliance system: data export, account deletion, consent

- Data export (Art. 15/20): GET /api/gdpr/export serves a full JSON export of the user's data (credentials/tokens excluded, exclusions declared) - Right to erasure (Art. 17): self-service deletion with 30-day grace period (Settings -> Privacy & Data), cancellable; daily /api/cron/gdpr drain cancels Stripe billing, purges Spaces files, cascade-deletes the account, anonymizes consent rows, and writes audit evidence - Migration 0011: account_deletion_requests (partial unique index = one pending per user) + FK-less consent_log (survives erasure) - Consent: terms/privacy acceptance logged at signup (email + Google); cookie banner with analytics opt-out (umami.disabled), choices logged server-side for signed-in users via POST /api/gdpr/consent - Admin deleteUser upgraded to the same full purge (was leaving Spaces files and Stripe subscriptions orphaned) - /gdpr legal page now points at the self-service tools - scripts/verify-gdpr.ts: end-to-end verification vs live dev DB (22/22) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-03 06:03:27 -04:00
parent 0d11018019
commit 5a555c715e
24 changed files with 5069 additions and 9 deletions
@@ -2,6 +2,7 @@ import type { Metadata } from "next"
 import { Geist, Geist_Mono } from "next/font/google"
 import { Toaster } from "@/components/ui/toaster"
 import { UmamiAnalytics } from "@/components/analytics/umami"
+import { CookieConsent } from "@/components/shared/cookie-consent"
 import "./globals.css"

 const geistSans = Geist({
@@ -70,6 +71,7 @@ export default function RootLayout({
      <body suppressHydrationWarning className="min-h-full flex flex-col bg-[#09090b] text-white">
        {children}
        <Toaster />
+        <CookieConsent />
        <UmamiAnalytics />
      </body>
    </html>