Every privacy request gets a deadline. We make sure you see it.
DsarFlow is the privacy-request tracker for companies OneTrust never calls back: a hosted intake form, automatic statutory deadlines (GDPR one month, CCPA 45 days), urgency countdowns, and a complete audit trail — from $39/mo.
The problem: privacy requests arrive; deadlines don't wait
GDPR gives you 1 month to respond (Art. 12(3)). CCPA/CPRA gives you 45 days (11 CCR § 7021 — and verification time does not extend it). The clock starts when the request arrives — not when someone notices the inbox.
Enterprise tools start around $10k/year (OneTrust) to $15k/year (TrustArc) — built for companies with privacy teams. Everyone else tracks requests in a spreadsheet and hopes.
A missed deadline isn't just embarrassing: it's the kind of paper trail regulators ask for. 'We lost track of it' is not a defense.
The workflow, not the lawyer
A hosted, embeddable intake form takes the request; DsarFlow stamps the statutory deadline from the regulation you pick and counts down in the tracker — ok, warning (≤7d), critical (≤3d), overdue.
A strict state machine moves requests received → identity pending → in progress → fulfilled. Illegal jumps (received → fulfilled) are rejected; every transition lands in the audit trail.
We're the workflow, not the lawyer — you still need the lawyer. The disclaimer is in the intake form, the admin UI, and every API response.
What you get
Hosted intake form
Embeddable privacy-request form with regulation picker (statutory windows shown) and the disclaimer built in.
Statutory deadline engine
GDPR one calendar month (Art. 12(3)), CCPA/CPRA 45 days, most US state laws 45 days, Iowa 90, Brazil LGPD 15 — every rule cites the statute it implements; extensions need a logged reason.
Urgency countdowns
Every request shows days-left with ok/warning/critical/overdue bands. Overdues are unmissable.
Strict state machine
received → identity_pending → in_progress → fulfilled. Illegal transitions rejected; no skipping steps.
Audit trail
Every transition, note, and actor timestamped per request. Export the whole history to CSV.
Identity confirmation
Real email-link verification (single-use, 72-hour links) before fulfillment, with a stronger detail check or manual review configurable per workspace. Sufficiency stays your call.
More of what DsarFlow does
Fulfillment workspace
Per-request data-source checklist, assignment, and a response-package builder that sends the requester a secure, expiring download link.
Denial workflow
Exemptions and denials require a reason code (identity not verified, manifestly unfounded, legal-obligation retention, …) — recorded in the audit trail with your explanation.
Quickstart
Check out on the pricing page — your workspace is provisioned automatically when Stripe confirms payment. Claim your workspace on the claim page : your API key (shown once), hosted intake link, and embed snippet. Put the form where requesters find it : link your privacy page to the hosted intake URL, or paste the embed snippet for the widget. Work requests in the API or tracker : confirm identity, assign an owner, check off data sources, assemble the response package, and send the requester a secure download link. Every step lands in the audit trail.
How it works
API reference
POST /t/{slug}/request — branded tenant intake (caps + suspension enforced; identity confirmation starts automatically). GET/POST /verify/{token} — requester identity confirmation (single-use email link). GET /api/v1/t/requests — tenant list with days-left, urgency, and the statute citation behind each deadline (tenant key). POST /api/v1/t/requests/{id}/transition — advance the state machine (denials need a reason code; extensions need a logged reason; illegal jumps → 400). Tasks, assignment, response packages + requester download links, audit trail, CSV export — see OPENAPI.md in the repo. POST /api/v1/stripe/webhook — provisioning + subscri
Support
Questions? Contact us — a human reads every message.
What we won't do
We don't do fake testimonials, invented customer counts, or guaranteed outcomes. Every claim on this site traces to something the software actually does — most of it demonstrable in the product repo today.
What you get
Starter
1 brand, up to 25 requests/mo Hosted intake form (embeddable) Statutory deadline engine Urgency countdowns + audit trail
Growth
5 brands, unlimited requests Team assignment + fulfillment workspace Response packages + CSV export + API access
Scale
Deadline-rule table with statute citations Rule updates as state privacy laws change Checkout opens Stripe's secure payment page. After payment your workspace is provisioned automatically — open the claim page from the success screen to reveal your API key, hosted intake link, and embed snippet (shown once).
The details
Your workspace is ready
Your payment provisioned a workspace automatically. Reveal its credentials below — the session from your checkout is the key to this page, no email needed.
Save these credentials now
Your API key is shown exactly once. We keep only a one-time claim record — once revealed, the stored copy is wiped, so if you lose the key it cannot be shown again. Tenant API key (manage requests, tasks, packages) Hosted intake form (link this from your privacy page) Embed page (widget snippet for your own site)
Quickstart — 3 steps
Put the form where requesters find it. Link your privacy page to the hosted intake URL above, or open the embed page and paste the widget snippet into your site. Submit a test request against your own form. You'll get the identity-confirmation email; click it and watch the request move to in-progress with its statutory deadline counting down. Work it to done. Assign an owner, check off the data sources, assemble the response package, and send the requester the secure download link — every step is in the audit trail. DsarFlow tracks privacy requests and deadlines. It is not legal advice and does not determine your legal obligations — confirm a
Going further
Just checked out?
Stripe sends you back here with your checkout session in the URL after payment. If you arrived without it, use the link in your Stripe receipt, or claim from the command line: curl -X POST https://dsarflow-api.onrender.com/api/v1/claim -H 'Content-Type: application/json' -d '{"session_id":"cs_..."}'
Hero
Privacy requests, answered on time. Someone asks for their data — or for you to delete it. The clock starts: 30 days (GDPR), 45 days (California). DsarFlow gives you the intake form, the countdown, and the audit trail. $39/mo. Live this afternoon. [Start tracking — $39/mo] [Try the deadline calculator]
The problem
three privacy requests a year. head, and the first DSAR is a panic. calendar problem, not a bad intention.
In depth
How it works
1. Intake — embed our form (or use the hosted link). Requesters pick their request type and regulation; you get a reference number. 2. Verify — identity-verification workflow step, so you don't hand personal data to the wrong person. 3. Track — every request gets a countdown (30/45 days per regulation), urgency bands, and a tracked path: received → verified → in progress → fulfilled. Nothing slips; every step is logged for your audit trail.
Comparison (factual)
OneTrust ~$10k/yr as widely published; $29/mo SMB band verified Oct 2026.
FAQ
Does this make us GDPR/CCPA compliant? No — and beware anyone who promises that. DsarFlow is the workflow: requests tracked, deadlines visible, actions logged. Compliance is your program; we're one good tool in it. Talk to your lawyer about obligations. What if we get the deadline wrong? Our countdowns use published statutory timelines (GDPR 30 days, CCPA 45 days, etc.), adjustable in settings. Your counsel confirms what applies to you. Who verifies identity? You do, following your procedure — we run the workflow step and record it. Can we export everything? Yes — CSV export of all requests and full audit trails, anytime, free.
More capabilities
Honest footnote
DsarFlow tracks privacy requests and deadlines. It is not legal advice and does not determine your legal obligations. New product — no customers yet, no fake logos. Try the deadline calculator free. Compliance review of our deadline tables and copy by a qualified privacy attorney is completed before launch — we'll say who and when here once done.
The wedge (use verbatim in marketing)
$39/mo DSAR autopilot for the "too small for OneTrust" company: hosted intake form, identity-verification workflow, deadline countdown, audit trail — live in an afternoon, no $10k/yr platform. OneTrust starts around $10k/yr; TrustArc around $15k/yr. SMBs handle privacy requests in spreadsheets and miss 30/45-day deadlines. DsarFlow is the workflow they actually need: requests come in, deadlines count down, nothing slips, every step is logged.
Who it's for
customers and no privacy team trust) without enterprise software