Every privacy request gets a deadline. We make sure you see it.
DsarFlow is the privacy-request tracker for companies OneTrust never calls back: a hosted intake form, automatic statutory deadlines (GDPR one month, CCPA 45 days), urgency countdowns, and a complete audit trail — from $39/mo.
The problem: privacy requests arrive; deadlines don't wait
GDPR gives you 1 month to respond (Art. 12(3)). CCPA/CPRA gives you 45 days (11 CCR § 7021 — and verification time does not extend it). The clock starts when the request arrives — not when someone notices the inbox.
Enterprise tools start around $10k/year (OneTrust) to $15k/year (TrustArc) — built for companies with privacy teams. Everyone else tracks requests in a spreadsheet and hopes.
A missed deadline isn't just embarrassing: it's the kind of paper trail regulators ask for. 'We lost track of it' is not a defense.
The workflow, not the lawyer
A hosted, embeddable intake form takes the request; DsarFlow stamps the statutory deadline from the regulation you pick and counts down in the tracker — ok, warning (≤7d), critical (≤3d), overdue.
A strict state machine moves requests received → identity pending → in progress → fulfilled. Illegal jumps (received → fulfilled) are rejected; every transition lands in the audit trail.
We're the workflow, not the lawyer — you still need the lawyer. The disclaimer is in the intake form, the admin UI, and every API response.
What you get
Hosted intake form
Embeddable privacy-request form with regulation picker (statutory windows shown) and the disclaimer built in.
Statutory deadline engine
GDPR one calendar month (Art. 12(3)), CCPA/CPRA 45 days, most US state laws 45 days, Iowa 90, Brazil LGPD 15 — every rule cites the statute it implements; extensions need a logged reason.
Urgency countdowns
Every request shows days-left with ok/warning/critical/overdue bands. Overdues are unmissable.
Strict state machine
received → identity_pending → in_progress → fulfilled. Illegal transitions rejected; no skipping steps.
Audit trail
Every transition, note, and actor timestamped per request. Export the whole history to CSV.
Identity confirmation
Real email-link verification (single-use, 72-hour links) before fulfillment, with a stronger detail check or manual review configurable per workspace. Sufficiency stays your call.