Privacy Operations API Documentation

Read supplied privacy policies, notices, and records, list stated categories and retention periods, and point at missing or inconsistent fields. Payment is the exact USDC price on Base with x402.

{
  "policy": "# Purposes\n# Retention\nWe collect addresses for sign in.\n",
  "requirements": [
    {
      "kind": "section",
      "name": "Purposes"
    },
    {
      "kind": "section",
      "name": "Legal basis"
    }
  ]
}

{
  "checkedAt": "2026-11-03T17:00:00.000Z",
  "gdprCompliance": false,
  "legalConclusion": false,
  "recordsAccessed": false,
  "recordsDeleted": false,
  "status": "checked",
  "sections": [
    {
      "name": "Purposes"
    },
    {
      "name": "Retention"
    }
  ],
  "requirements": [
    {
      "name": "Purposes",
      "present": true,
      "interpretation": "stated"
    },
    {
      "name": "Legal basis",
      "present": false,
      "interpretation": "none"
    }
  ],
  "findings": [
    {
      "kind": "ignored",
      "code": "unlabeled_line",
      "subject": "policy",
      "detail": "Lines without a recognized label were not read and their text was not copied."
    },
    {
      "kind": "missing",
      "code": "section_missing",
      "subject": "Legal basis",
      "detail": "This required section was not in the supplied headings. This is not a legal conclusion."
    }
  ],
  "limitations": [
    "This is not a GDPR compliance determination or a legal conclusion.",
    "Categories, purposes, retention periods, and stated legal bases are copied only from labeled fields supplied by the caller.",
    "Email addresses and other direct identifiers are not copied into the response.",
    "No external customer record is accessed or deleted.",
    "A missing item means it was not in the supplied documents."
  ]
}

curl -i -X POST "https://brainiac.software/api/v1/privacy-operations/policy-structure-audit" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "policy": "# Purposes\n# Retention\nWe collect addresses for sign in.\n",
  "requirements": [
    {
      "kind": "section",
      "name": "Purposes"
    },
    {
      "kind": "section",
      "name": "Legal basis"
    }
  ]
}
JSON

{
  "categories": [
    {
      "name": "account email",
      "purpose": "sign in",
      "basis": "contract",
      "retention": "30 days"
    },
    {
      "name": "support notes",
      "purpose": "support"
    }
  ]
}

{
  "checkedAt": "2026-11-03T17:00:00.000Z",
  "gdprCompliance": false,
  "legalConclusion": false,
  "recordsAccessed": false,
  "recordsDeleted": false,
  "status": "extracted",
  "categories": [
    {
      "name": "account email",
      "purpose": "sign in",
      "basis": "contract",
      "retention": "30 days",
      "document": "",
      "basisStated": true,
      "interpretation": "stated"
    },
    {
      "name": "support notes",
      "purpose": "support",
      "basis": "",
      "retention": "",
      "document": "",
      "basisStated": false,
      "interpretation": "stated"
    }
  ],
  "findings": [
    {
      "kind": "missing",
      "code": "basis_missing",
      "subject": "support notes",
      "detail": "No legal basis was stated for this category. None was inferred."
    },
    {
      "kind": "missing",
      "code": "retention_missing",
      "subject": "support notes",
      "detail": "No retention period was stated for this category."
    }
  ],
  "limitations": [
    "This is not a GDPR compliance determination or a legal conclusion.",
    "Categories, purposes, retention periods, and stated legal bases are copied only from labeled fields supplied by the caller.",
    "Email addresses and other direct identifiers are not copied into the response.",
    "No external customer record is accessed or deleted.",
    "A missing item means it was not in the supplied documents."
  ]
}

curl -i -X POST "https://brainiac.software/api/v1/privacy-operations/personal-data-inventory-extract" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "categories": [
    {
      "name": "account email",
      "purpose": "sign in",
      "basis": "contract",
      "retention": "30 days"
    },
    {
      "name": "support notes",
      "purpose": "support"
    }
  ]
}
JSON

{
  "categories": [
    {
      "name": "account email",
      "purpose": "sign in",
      "basis": "contract",
      "retention": "30 days"
    },
    {
      "name": "support notes",
      "purpose": "support",
      "basis": "consent",
      "retention": "soon"
    }
  ],
  "requirements": [
    {
      "kind": "category",
      "name": "billing"
    }
  ]
}

{
  "checkedAt": "2026-11-03T17:00:00.000Z",
  "gdprCompliance": false,
  "legalConclusion": false,
  "recordsAccessed": false,
  "recordsDeleted": false,
  "status": "checked",
  "periods": [
    {
      "category": "account email",
      "period": "30 days",
      "unit": "day",
      "count": 30,
      "readable": true,
      "interpretation": "stated"
    },
    {
      "category": "support notes",
      "period": "soon",
      "unit": "",
      "count": 0,
      "readable": false,
      "interpretation": "stated"
    }
  ],
  "findings": [
    {
      "kind": "observation",
      "code": "period_unreadable",
      "subject": "support notes",
      "detail": "The stated retention period is not a day, month, year, account lifetime, or until deletion. It was not rewritten."
    },
    {
      "kind": "missing",
      "code": "retention_required_missing",
      "subject": "billing",
      "detail": "This caller-required category has no stated retention period."
    }
  ],
  "limitations": [
    "This is not a GDPR compliance determination or a legal conclusion.",
    "Categories, purposes, retention periods, and stated legal bases are copied only from labeled fields supplied by the caller.",
    "Email addresses and other direct identifiers are not copied into the response.",
    "No external customer record is accessed or deleted.",
    "A missing item means it was not in the supplied documents."
  ]
}

curl -i -X POST "https://brainiac.software/api/v1/privacy-operations/data-retention-policy-check" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "categories": [
    {
      "name": "account email",
      "purpose": "sign in",
      "basis": "contract",
      "retention": "30 days"
    },
    {
      "name": "support notes",
      "purpose": "support",
      "basis": "consent",
      "retention": "soon"
    }
  ],
  "requirements": [
    {
      "kind": "category",
      "name": "billing"
    }
  ]
}
JSON

{
  "policy": "Category: account email | sign in | contract | 30 days\n",
  "notice": "Category: account email | marketing | contract | 30 days\n"
}

{
  "checkedAt": "2026-11-03T17:00:00.000Z",
  "gdprCompliance": false,
  "legalConclusion": false,
  "recordsAccessed": false,
  "recordsDeleted": false,
  "status": "compared",
  "comparisons": [
    {
      "category": "account email",
      "field": "purpose",
      "policy": "sign in",
      "notice": "marketing",
      "match": false,
      "interpretation": "stated"
    },
    {
      "category": "account email",
      "field": "basis",
      "policy": "contract",
      "notice": "contract",
      "match": true,
      "interpretation": "stated"
    },
    {
      "category": "account email",
      "field": "retention",
      "policy": "30 days",
      "notice": "30 days",
      "match": true,
      "interpretation": "stated"
    }
  ],
  "findings": [
    {
      "kind": "conflict",
      "code": "value_differs",
      "subject": "account email purpose",
      "detail": "The stated purpose differs between the policy and the notice. Neither value was chosen."
    }
  ],
  "limitations": [
    "This is not a GDPR compliance determination or a legal conclusion.",
    "Categories, purposes, retention periods, and stated legal bases are copied only from labeled fields supplied by the caller.",
    "Email addresses and other direct identifiers are not copied into the response.",
    "No external customer record is accessed or deleted.",
    "A missing item means it was not in the supplied documents."
  ]
}

curl -i -X POST "https://brainiac.software/api/v1/privacy-operations/notice-consistency-check" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "policy": "Category: account email | sign in | contract | 30 days\n",
  "notice": "Category: account email | marketing | contract | 30 days\n"
}
JSON

{
  "cookies": [
    {
      "name": "session",
      "purpose": "sign in",
      "duration": "session",
      "consent": "required"
    },
    {
      "name": "analytics",
      "purpose": "measurement",
      "duration": "30 days",
      "consent": "optional"
    }
  ],
  "consents": [
    {
      "name": "analytics",
      "state": "not-set"
    }
  ]
}

{
  "checkedAt": "2026-11-03T17:00:00.000Z",
  "gdprCompliance": false,
  "legalConclusion": false,
  "recordsAccessed": false,
  "recordsDeleted": false,
  "status": "checked",
  "consentEnforced": false,
  "cookies": [
    {
      "name": "session",
      "purpose": "sign in",
      "duration": "session",
      "consent": "required",
      "consentState": "",
      "interpretation": "stated"
    },
    {
      "name": "analytics",
      "purpose": "measurement",
      "duration": "30 days",
      "consent": "optional",
      "consentState": "not-set",
      "interpretation": "stated"
    }
  ],
  "findings": [
    {
      "kind": "missing",
      "code": "consent_not_set",
      "subject": "analytics",
      "detail": "This cookie is marked optional and no opt-in or opt-out state was supplied. Consent was not enforced."
    }
  ],
  "limitations": [
    "This is not a GDPR compliance determination or a legal conclusion.",
    "Categories, purposes, retention periods, and stated legal bases are copied only from labeled fields supplied by the caller.",
    "Email addresses and other direct identifiers are not copied into the response.",
    "No external customer record is accessed or deleted.",
    "A missing item means it was not in the supplied documents."
  ]
}

curl -i -X POST "https://brainiac.software/api/v1/privacy-operations/cookie-consent-configuration-audit" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "cookies": [
    {
      "name": "session",
      "purpose": "sign in",
      "duration": "session",
      "consent": "required"
    },
    {
      "name": "analytics",
      "purpose": "measurement",
      "duration": "30 days",
      "consent": "optional"
    }
  ],
  "consents": [
    {
      "name": "analytics",
      "state": "not-set"
    }
  ]
}
JSON

{
  "requests": [
    {
      "id": "R-100",
      "type": "deletion",
      "received": "2026-11-01"
    },
    {
      "id": "R-200",
      "type": "erase me",
      "received": "2026-02-31"
    }
  ]
}

{
  "checkedAt": "2026-11-03T17:00:00.000Z",
  "gdprCompliance": false,
  "legalConclusion": false,
  "recordsAccessed": false,
  "recordsDeleted": false,
  "status": "classified",
  "requests": [
    {
      "id": "R-100",
      "type": "deletion",
      "recognized": true,
      "received": "2026-11-01",
      "legalDeadline": false,
      "interpretation": "stated"
    },
    {
      "id": "R-200",
      "type": "erase me",
      "recognized": false,
      "received": "",
      "legalDeadline": false,
      "interpretation": "stated"
    }
  ],
  "findings": [
    {
      "kind": "observation",
      "code": "type_unrecognized",
      "subject": "R-200",
      "detail": "The request type is not one of access, deletion, correction, export, objection, or restriction. It was not remapped."
    },
    {
      "kind": "observation",
      "code": "date_unreadable",
      "subject": "R-200",
      "detail": "The received date is not a real YYYY-MM-DD day. It was not rewritten."
    }
  ],
  "limitations": [
    "This is not a GDPR compliance determination or a legal conclusion.",
    "Categories, purposes, retention periods, and stated legal bases are copied only from labeled fields supplied by the caller.",
    "Email addresses and other direct identifiers are not copied into the response.",
    "No external customer record is accessed or deleted.",
    "A missing item means it was not in the supplied documents."
  ]
}

curl -i -X POST "https://brainiac.software/api/v1/privacy-operations/data-subject-request-classify" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "requests": [
    {
      "id": "R-100",
      "type": "deletion",
      "received": "2026-11-01"
    },
    {
      "id": "R-200",
      "type": "erase me",
      "received": "2026-02-31"
    }
  ]
}
JSON

{
  "requests": [
    {
      "id": "R-100",
      "type": "deletion",
      "received": "2026-11-01"
    },
    {
      "id": "R-200",
      "type": "deletion",
      "received": "2026-11-01"
    }
  ],
  "evidence": [
    {
      "requestId": "R-100",
      "action": "deleted",
      "date": "2026-11-02"
    }
  ]
}

{
  "checkedAt": "2026-11-03T17:00:00.000Z",
  "gdprCompliance": false,
  "legalConclusion": false,
  "recordsAccessed": false,
  "recordsDeleted": false,
  "status": "checked",
  "checks": [
    {
      "requestId": "R-100",
      "action": "deleted",
      "recognized": true,
      "date": "2026-11-02",
      "deletionStated": true,
      "interpretation": "stated"
    }
  ],
  "findings": [
    {
      "kind": "observation",
      "code": "deletion_stated",
      "subject": "R-100",
      "detail": "The supplied record says deleted. No external record was deleted."
    },
    {
      "kind": "missing",
      "code": "evidence_missing",
      "subject": "R-200",
      "detail": "This deletion request has no supplied evidence. No record was deleted."
    }
  ],
  "limitations": [
    "This is not a GDPR compliance determination or a legal conclusion.",
    "Categories, purposes, retention periods, and stated legal bases are copied only from labeled fields supplied by the caller.",
    "Email addresses and other direct identifiers are not copied into the response.",
    "No external customer record is accessed or deleted.",
    "A missing item means it was not in the supplied documents."
  ]
}

curl -i -X POST "https://brainiac.software/api/v1/privacy-operations/data-deletion-evidence-check" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "requests": [
    {
      "id": "R-100",
      "type": "deletion",
      "received": "2026-11-01"
    },
    {
      "id": "R-200",
      "type": "deletion",
      "received": "2026-11-01"
    }
  ],
  "evidence": [
    {
      "requestId": "R-100",
      "action": "deleted",
      "date": "2026-11-02"
    }
  ]
}
JSON

{
  "policy": "# Purposes\nCategory: account email | sign in | contract | 30 days\n",
  "notice": "Category: account email | marketing | contract | 30 days\n",
  "requirements": [
    {
      "kind": "section",
      "name": "Legal basis"
    },
    {
      "kind": "category",
      "name": "billing"
    }
  ],
  "cookies": [
    {
      "name": "analytics",
      "purpose": "measurement",
      "duration": "30 days",
      "consent": "optional"
    }
  ],
  "consents": [
    {
      "name": "analytics",
      "state": "not-set"
    }
  ],
  "requests": [
    {
      "id": "R-100",
      "type": "deletion",
      "received": "2026-11-01"
    },
    {
      "id": "R-200",
      "type": "deletion",
      "received": "2026-11-01"
    }
  ],
  "evidence": [
    {
      "requestId": "R-100",
      "action": "deleted",
      "date": "2026-11-02"
    }
  ]
}

{
  "checkedAt": "2026-11-03T17:00:00.000Z",
  "gdprCompliance": false,
  "legalConclusion": false,
  "recordsAccessed": false,
  "recordsDeleted": false,
  "status": "checked",
  "sectionCount": 1,
  "categoryCount": 2,
  "sections": [
    {
      "name": "Purposes"
    }
  ],
  "categories": [
    {
      "name": "account email",
      "purpose": "sign in",
      "basis": "contract",
      "retention": "30 days",
      "document": "policy",
      "basisStated": true,
      "interpretation": "stated"
    },
    {
      "name": "account email",
      "purpose": "marketing",
      "basis": "contract",
      "retention": "30 days",
      "document": "notice",
      "basisStated": true,
      "interpretation": "stated"
    }
  ],
  "periods": [
    {
      "category": "account email",
      "period": "30 days",
      "unit": "day",
      "count": 30,
      "readable": true,
      "interpretation": "stated"
    },
    {
      "category": "account email",
      "period": "30 days",
      "unit": "day",
      "count": 30,
      "readable": true,
      "interpretation": "stated"
    }
  ],
  "comparisons": [
    {
      "category": "account email",
      "field": "purpose",
      "policy": "sign in",
      "notice": "marketing",
      "match": false,
      "interpretation": "stated"
    },
    {
      "category": "account email",
      "field": "basis",
      "policy": "contract",
      "notice": "contract",
      "match": true,
      "interpretation": "stated"
    },
    {
      "category": "account email",
      "field": "retention",
      "policy": "30 days",
      "notice": "30 days",
      "match": true,
      "interpretation": "stated"
    }
  ],
  "consentEnforced": false,
  "cookies": [
    {
      "name": "analytics",
      "purpose": "measurement",
      "duration": "30 days",
      "consent": "optional",
      "consentState": "not-set",
      "interpretation": "stated"
    }
  ],
  "requests": [
    {
      "id": "R-100",
      "type": "deletion",
      "recognized": true,
      "received": "2026-11-01",
      "legalDeadline": false,
      "interpretation": "stated"
    },
    {
      "id": "R-200",
      "type": "deletion",
      "recognized": true,
      "received": "2026-11-01",
      "legalDeadline": false,
      "interpretation": "stated"
    }
  ],
  "checks": [
    {
      "requestId": "R-100",
      "action": "deleted",
      "recognized": true,
      "date": "2026-11-02",
      "deletionStated": true,
      "interpretation": "stated"
    }
  ],
  "findings": [
    {
      "kind": "missing",
      "code": "section_missing",
      "subject": "Legal basis",
      "detail": "This required section was not in the supplied headings. This is not a legal conclusion."
    },
    {
      "kind": "missing",
      "code": "retention_required_missing",
      "subject": "billing",
      "detail": "This caller-required category has no stated retention period."
    },
    {
      "kind": "conflict",
      "code": "value_differs",
      "subject": "account email purpose",
      "detail": "The stated purpose differs between the policy and the notice. Neither value was chosen."
    },
    {
      "kind": "missing",
      "code": "consent_not_set",
      "subject": "analytics",
      "detail": "This cookie is marked optional and no opt-in or opt-out state was supplied. Consent was not enforced."
    },
    {
      "kind": "observation",
      "code": "deletion_stated",
      "subject": "R-100",
      "detail": "The supplied record says deleted. No external record was deleted."
    },
    {
      "kind": "missing",
      "code": "evidence_missing",
      "subject": "R-200",
      "detail": "This deletion request has no supplied evidence. No record was deleted."
    }
  ],
  "limitations": [
    "This is not a GDPR compliance determination or a legal conclusion.",
    "Categories, purposes, retention periods, and stated legal bases are copied only from labeled fields supplied by the caller.",
    "Email addresses and other direct identifiers are not copied into the response.",
    "No external customer record is accessed or deleted.",
    "A missing item means it was not in the supplied documents."
  ]
}

curl -i -X POST "https://brainiac.software/api/v1/privacy-operations/documentation-report" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "policy": "# Purposes\nCategory: account email | sign in | contract | 30 days\n",
  "notice": "Category: account email | marketing | contract | 30 days\n",
  "requirements": [
    {
      "kind": "section",
      "name": "Legal basis"
    },
    {
      "kind": "category",
      "name": "billing"
    }
  ],
  "cookies": [
    {
      "name": "analytics",
      "purpose": "measurement",
      "duration": "30 days",
      "consent": "optional"
    }
  ],
  "consents": [
    {
      "name": "analytics",
      "state": "not-set"
    }
  ],
  "requests": [
    {
      "id": "R-100",
      "type": "deletion",
      "received": "2026-11-01"
    },
    {
      "id": "R-200",
      "type": "deletion",
      "received": "2026-11-01"
    }
  ],
  "evidence": [
    {
      "requestId": "R-100",
      "action": "deleted",
      "date": "2026-11-02"
    }
  ]
}
JSON