# Data protection

> **Not legal advice.** This describes what Convoro does and what it leaves to
> you. If you run a community that processes personal data of people in the EU
> or UK, get advice about your own obligations.

---

## The thing to understand first

**You are the data controller. Convoro is not.**

You decide why personal data is processed on your forum and on what lawful
basis. You owe the privacy notice, the records of processing, the breach
process, and the answers to requests. Convoro is the software you use to do
that.

So this page is in two halves: **what the software gives you**, and **what you
still have to do yourself**. Installing Convoro does not make a site compliant,
and no software can.

---

## What Convoro holds

The whole personal-data footprint, so you can describe it accurately in your
own privacy notice:

| Where | What |
|---|---|
| `users` | username, email, and whatever somebody puts in their own profile — title, signature, avatar, timezone |
| `posts`, `topics`, `messages` | what people wrote |
| `password_resets` | the IP address a reset was asked from. **The only IP Convoro stores.** Deleted after 7 days |
| `mail_outbox` | recipient address for queued mail. Sent rows deleted after 7 days |
| `topic_reads`, `forum_reads` | which threads somebody has read. Pruned after 30 days |
| `follows`, `notifications`, `reactions` | what somebody follows and was told about |
| `username_history` | names somebody used to have, held 90 days |
| `data_exports` | copies of the above, deleted after 7 days |
| Sessions | on disk, expiring on the session lifetime |

**Convoro does not** log requests, store user agents, run analytics, load
third-party scripts, or record what anybody reads beyond the marks they
benefit from.

---

## Answering requests

Everything a member can do for themselves, an administrator can do for them —
because requests arrive by email and have to be answered within a month.

### Access and portability (Art. 15, 20)

**Settings → Account → Request a copy.** Produces a zip with `data.json` for
moving to another service and `data.html` to read.

It contains nothing belonging to anybody else, even from shared conversations,
and no credentials.

Exports are built by cron, so **this needs the cron entry below or nothing is
ever produced.**

### Erasure (Art. 17)

**Settings → Account → Delete my account**, or Admin → Members → Erase.

Erases the personal data and keeps the content, unattributed. That is
deliberate: Art. 17 is a right to erase *personal data*, and Art. 17(3) exempts
processing needed for freedom of expression and information — which a
discussion archive is. Removing the posts as well would tear holes in threads
other people built.

An administrator can also remove the content, which is the spam option.

**There is no undo.**

### Rectification (Art. 16)

Members edit their own profile, email and username. An administrator can edit
any of it.

### Objection and withdrawal (Art. 21, 7(3))

Every notification email carries an unsubscribe link that works without signing
in. Settings → Notifications turns email off entirely without un-following
anything.

---

## Cron

**Without these, exports are never built and retention is never enforced.**

```bash
* * * * * cd /path/to/convoro && php tools/convoro privacy:export >/dev/null 2>&1
0 3 * * * cd /path/to/convoro && php tools/convoro privacy:prune >/dev/null 2>&1
```

`privacy:prune` deletes expired password-reset tokens and their IPs, old read
marks, old exports, and sent mail past its keep window.

---

## Consent

**Admin → Settings → Joining and consent.**

Turning it on records **what version** of your terms and privacy notice each
account agreed to, and when. Art. 7(1) requires you to be able to *demonstrate*
consent, and "they must have ticked the box" is not a record.

**Change the version string whenever you change the notice**, or you cannot
tell who agreed to which one.

The minimum age question asks people to confirm they are old enough. The GDPR
sets the digital-consent age between 13 and 16 depending on the member state,
so the number is yours. Only the confirmation is stored, never a date of birth.

---

## Cookies

Convoro sets three, and **none of them needs a consent banner**:

| Cookie | Why it is exempt |
|---|---|
| `convoro_session` | strictly necessary — nothing works without it |
| `convoro_remember` | set only when somebody ticks "remember me" |
| `cv_theme` | set only when somebody picks a theme |

A test in the suite fails if a fourth cookie appears, so this stays true rather
than quietly drifting.

**If you add an extension that loads analytics, embeds, or third-party
anything, this changes** and the site will need a consent mechanism. That is
your call to make, not the software's.

---

## What you still have to do

None of this is something Convoro can do for you.

- **Write a privacy notice.** It describes *your* purposes, *your* hosting,
  *your* retention and *your* contact details. Publish it as a page and point
  the setting at it.
- **Identify your lawful basis.** Running a forum somebody signed up for is
  usually contract, not consent — which matters, because consent can be
  withdrawn and contract cannot.
- **Keep records of processing** (Art. 30) if you are in scope. The table above
  is a starting point, not the record.
- **Have a breach process.** Art. 33 gives you 72 hours.
- **Get a data processing agreement** with your host, your mail provider, and
  anybody else who touches the data (Art. 28).
- **Decide whether you need a DPO** (Art. 37) and whether you need an EU or UK
  representative (Art. 27).
- **Check your extensions.** Anything you install can collect whatever it
  likes. The footprint above describes Convoro, not Convoro plus a plugin.
