Personal Data Management
Introduction
Chargebee understands that you as a merchant are responsible to your customers for the data you collect on them. Modern data protection and privacy laws such as the GDPR require that personally identifiable information (PII) not be retained in systems longer than is necessary for meeting business needs.
Personal Data Management helps you align Chargebee with your customer data retention policies.
Use it to configure Chargebee to delete PII for customers who no longer use your services.
Eligibility for PII Deletion
First, we must define which set of customer records are eligible for PII deletion.
PII for a customer record can be deleted when and only when all subscriptions associated with the record are in cancelled state.
Deletion Requests vs Deletion
When you choose to delete PII for a customer, whether it gets deleted immediately or after a certain interval is configurable in Chargebee. Thus, for the sake of clarity, we will use the term deletion request to signify the act of issuing a command to delete PII in the Chargebee system. Such a command can be issued via the user interface (whether manual or automatic) or via API.
STEP 1: Configure what gets deleted
Go to Settings > Configure Chargebee > Customer Data Privacy > Personal Data. Under List of Personal Data, Chargebee lists the customer information you can delete. Select the fields that are personally identifiable information (PII) under your company policies. The fields selected here are the ones that will get deleted for eligible customer records once a deletion request is issued.
MRR and other aggregate revenue metrics are not affected by clearing PII. This is because no information from the customer's record that contributes to aggregate data is cleared using this feature.
To serve legal and auditing purposes, Chargebee does not allow you to delete stored invoices and event logs for your customers.
STEP 2: Configure how long data is retained
Whenever a request is raised (whether automatically, manually or via API) for deletion of PII in Chargebee, the deletion happens after the time period set under Settings > Configure Chargebee > Personal Data > Data retention period. This time period can range between zero (immediate deletion) to 3 months.
If, during this period, a subscription is activated for a customer record marked for PII deletion, the customer record is ineligible for PII deletion and the deletion request for that record is canceled.
If you wish to manually cancel a scheduled deletion, you must contact support during the data retention period.
Warning Once deleted, the data cannot be recovered. Be careful when you set the data retention period field to "immediately".
STEP 3: Issue deletion requests
Once the above 2 settings have been configured, you can issue PII deletion requests in Chargebee using either the user interface or the API.
The following options exist on the user interface:
1. Automatic deletion:
You can choose to have Chargebee trigger deletion requests for all customer records automatically the moment they become eligible for PII deletion.
To do this, turn on the Clear data automatically? switch under Settings > Personal Data.
Warning Once deleted, data cannot be recovered so be careful with this feature especially when the data retention period field is set to "immediately".
2. Manual deletion:
You can use the web interface to issue deletion requests for individual customer records. This is done using the Clear Personal Data button on the customer details page. The button is only shown for eligible customer records.
Review what data is cleared by clicking Manage settings below the button.
3. Bulk Deletions:
To issue PII deletion requests for all eligible customer records or a subset of them, use a bulk operation. See the FAQ.
A Special Case for PII Deletion
A key feature in Chargebee is that any data item that is newly selected in Step 1 gets deleted immediately for all customer records for which PII was deleted previously.
The following diagram explains this:
- Assume the Customer details field alone was marked for deletion.
- After some time, a PII deletion request is issued.
- The data retention period follows after which a set of customer records X have the values of their Customer details field cleared permanently.
- Later, the Mail logs field is marked for deletion too.
- Then immediately, on saving the settings in the previous step, mail logs for all records in the set X get deleted.
Summary
The Delete Personal Data feature is key for having your customer data privacy policies in place. The operation permanently deletes personal information from the customer record after a configurable data retention period. A customer record is only eligible for this operation when all its subscriptions are in the cancelled state. The deletion requests can be issued via the web interface or API.
Data Restoration for Accidental Deletion
Payment methods are stored at the payment gateway. If you delete a payment method from a customer record in Chargebee, it is removed from Chargebee immediately and from the payment gateway after seven days. This restoration window applies to that payment-method deletion. It does not apply when you delete the customer. Contact Chargebee Support during those seven days to restore the payment method at the gateway.
This can be helpful if:
- You accidentally or unintentionally delete a payment method without realizing that it would get deleted from the payment gateway as well.
- You migrate your Chargebee account from one data center to another (say, from the US to the EU region) and you accidentally remove the payment method before our migration team removes it from the old site.
Points to note:
- During this seven-day window, if you have any scheduled transactions to be processed through the removed payment method, those transactions will not be processed as the payment method is already removed from Chargebee.
- You don't have to make any changes to your Chargebee site as this functionality is automatically enabled for all Chargebee customers.
- This applies to payment gateway integrations supported by Chargebee except Checkout.com and Vantiv (Worldpay). Those gateways do not allow deletion of payment methods.
- Configure Chargebee > Personal Data > Payment Method Information overrides restoration after an accidental deletion. After personal data is deleted under the Personal Data configuration, it is not restored.
FAQ
Can personal data be retrieved once deleted?
No. This feature has been designed to help you comply with data privacy regulations such as the GDPR. As a result, once deleted the information is lost for good.
How can I prevent a scheduled deletion from going through?
A scheduled deletion gets executed when the data retention period expires. Contact support well within that period to cancel any scheduled deletions.
How is "Clear Personal Data" different from "Delete Customer"?
Clear Personal Data purges sensitive customer information from customer records that are no longer in use. Delete Customer includes Clear Personal Data and also removes the customer record from the web interface.
Here are some finer points of difference between the two actions:
| Clear Personal Data | Delete Customer |
|---|---|
| Permanently deletes selected personal information from the customer record. | Permanently deletes selected personal information and clears the customer record from the web interface but retains it in the database. The event logs are available on the web interface even after this action. |
| No aggregate revenue metrics are affected by this action. | Aggregate metrics are affected. |
| Can only be done for eligible customer records. | Any customer record is eligible for this action. |
| The information is deleted for good and cannot be retrieved. | The List customers API can return information that this action did not permanently delete. |
Why does "Delete Customer" not permanently delete the entire customer record? I have concerns around privacy.
Delete Customer does not delete the entire customer record permanently, because you may still need non-personal information for auditing. However, to protect customer data privacy, whenever Delete Customer is invoked, Delete Personal Data is automatically invoked for the customer record ensuring that the selected PII is deleted permanently.
Could you explain how I can delete PII for one or more customer records using the Chargebee user interface?
For existing customer records in Chargebee, you may issue delete PII requests for either a group of records or individual records at a time:
Case 1: Delete for a group of eligible records in the system.
If you wish to delete PII for some/all the eligible records in the system, you may do so using one of the following options:
Option 1: Automatic deletion: this can be done only for all eligible records. Here's how:
Enable automatic deletion as described in part 1 of step 3. This will instantly schedule all eligible customer records that are currently in the Chargebee system for PII deletion. You can turn this off immediately if you do not wish to delete PII for any further records that become eligible.
Option 2: Bulk operations: this option can be used to delete PII for all eligible records or for a subset of the records as desired. Here are the steps: (1) Navigate to Customers and click on the drop-down menu for preset filters. (2) Select the "Has Only Cancelled or No Subscriptions" filter as shown below:
(3) This would list all the customer records that are eligible for personal data deletion. (4) If you wish to filter further, you can click on the filter icon on the left of the drop-down menu, choose your filters and then click on Apply Filter. (5) Click Export > Export as CSV. Let the .zip file download. (6) Navigate to Settings > Import & Export Data > Choose a bulk operation. (7) Under Choose an Operation, select Customers > choose Clear Customers' PII from the list > Click Proceed. (8) When prompted to upload the CSV file, use customers.csv in the ZIP file downloaded in step 5. and proceed.
** Case 2: Delete PII for an individual customer record**
For clearing PII using the user interface for an individual customer record, navigate to the details page of the customer record and use the feature described under part 2 of step 3.
Once PII is deleted for a customer, can a new subscription be created for them?
Yes, a new subscription can be created for such customer records. Once a subscription is created, the customer record would turn ineligible for PII deletion preventing any scheduled deletions from taking place.