Add it to any website with one line of code, auto generated in your dashboard. Every cookie choice and privacy request gets captured, enforced, and tracked to its legal deadline, then recorded in a timestamped audit trail.
No per-request fees. No surprise overages. Cancel any time.
Is this just another cookie banner or accessibility widget?
No. The widget is the front door. The real system is behind it: a workflow that captures, verifies, tracks, and proves your response to every privacy and accessibility request, with a complete audit trail. Banners display text. DataRightsOS manages the legal obligation that starts the moment someone clicks.
How do you stop someone from filing a deletion request for another person?
Every request requires email verification. When a request is submitted, we send the email address on file a one-time, single-use, expiring confirmation link. Nothing becomes actionable until that person clicks it and proves they control the inbox. That closes the most common abuse in privacy tooling: a stranger trying to access or delete data that isn't theirs. Your "verified" record then means something real.
What happens the moment a request comes in?
The 45-day clock starts (that's the CCPA/CPRA response window). We immediately email the requester to confirm receipt and verify identity, create the request in your dashboard, and begin a live countdown. As the deadline approaches, your team gets reminders so nothing slips.
How do I prove to a regulator or a court that I actually handled a request?
Every action is written to an immutable audit trail: when the request arrived, when identity was verified and how, each system the data was cleared from, who did it, and when you responded to the requester. A checkbox is not proof. A timestamped, itemized record is, and that record is your defense if you're ever audited or sued.
Do you delete my customers' data for me automatically?
We don't reach into your systems, and you should be cautious of any tool that claims it can erase data everywhere automatically. Instead, DataRightsOS gives your team a guided, per-system checklist (your CRM, email platform, billing, backups) so each location is cleared and proven, and it connects to Zapier to help action removals in the tools you already use. You stay in control; we make sure nothing is missed and everything is documented.
Does this make me ADA or WCAG "compliant"?
No tool can make you compliant, and any that promises it is a legal risk to you. DataRightsOS provides a proper accessibility statement and a "report a barrier" channel that routes complaints into the same tracked-and-proven workflow as your privacy requests. Real accessibility comes from an accessible site; we give you the statement, the intake, and the audit trail that show good-faith effort.
Which laws does this help with?
US state privacy laws including CCPA/CPRA (California), VCDPA (Virginia), CTDPA (Connecticut) and the growing list of others, plus AI use disclosure and cookie consent. The widget shows the statement that applies to each visitor's state.
What if a requester never confirms their identity?
If they never click the verification link, the request expires and you're not obligated to act on it. The attempt is still logged. "We asked them to verify and they didn't" is itself a defensible record, and it keeps unverified or abusive requests from clogging your team's queue.
Do you tell the requester when their request is done?
Yes. When you mark a request complete, the requester automatically receives a confirmation from your business's identity, not ours. Closing the loop in writing lowers the odds of a complaint and is part of a defensible response.
How long do you keep my records?
Core keeps request and audit records for one year; Proof and Agency keep them indefinitely. For a compliance record, longer is safer, because audits and lawsuits can look back years after a request was handled.
Can it look like my own brand?
Your logo appears at the top of the widget on every plan. On the Agency plan you can fully white-label it, including using your own product name and removing the "Powered by DataRightsOS" badge.
Can it work with the tools I already use?
Yes. An outbound webhook sends each new request to Zapier or your own systems, so you can automatically create a task, alert your team in Slack, or kick off removals in connected apps the moment a verified request arrives.
Who is this for?
Any business that collects personal information through its website and faces multi-state privacy and accessibility obligations, especially those without a legal or privacy team on staff: law firms, agencies and their clients, local and regional service businesses. If you'd struggle to prove how you handled a deletion request from two years ago, this is for you.