What do you do when someone asks you to delete their data?

You published a site on Webflow, Lovable, or a static host. The contact form stores messages. Then someone emails and asks you to delete their data.

The privacy page explains what you collect. This is the follow-through. Find those rows and remove them.

I am not a lawyer, and this is not advice for your country. Read the rules that apply to your audience.

Start from the address they used

Treat the email in the request as the search key. A small site rarely has another identifier.

Write down every place that address can live:

• A contact message, quote form, or job application
• A waiting list or newsletter
• A testimonial they submitted
• A file they uploaded, like a CV
• A list in another vendor you pasted in, such as Kit

A form that only shows “Thanks” in the browser still counts if you stored the row. Cookieless pageviews that never stored an email do not. You cannot erase a person you cannot find.

If you never collected anything, reply and say so. Keep a short note of the request and the date.

Search each store, then delete

Open each dashboard. Search for the address they sent, such as jordan@flaviocopes.com.

If they asked for a copy of what you held, export it first. Then delete the rows. Delete the files too. A CSV on your laptop is still a copy.

If a public page shows their quote, take it down. An approved testimonial on a wall is still their data.

Do not leave a “deleted” flag that keeps the email in a table. Remove the record.

One website, one search

Sitebase keeps a Privacy page under Utilities on each website. Type the email and click Find their data.

The result lists form submissions, waiting list and newsletter subscribers, and testimonials on that site. Testimonials themselves store no email. Sitebase matches them through the submission that created the quote.

Cookie banner consent logs record a choice, not an email. They will not appear in this search.

Sitebase is in private beta. Public signup isn’t open.

If they asked for a copy, click Download JSON. The file looks like this:

{
  "exportedAt": "2026-10-18T15:02:44.000Z",
  "website": "flaviocopes.com",
  "subjectEmail": "jordan@flaviocopes.com",
  "submissions": [
    {
      "feature": "Contact form",
      "email": "jordan@flaviocopes.com",
      "payload": {
        "name": "Jordan Lee",
        "message": "Please remove my inquiry."
      },
      "submittedAt": "2026-09-03T14:22:11.000Z"
    }
  ],
  "subscribers": [],
  "testimonials": []
}

Send that file if they asked to see what you stored. Then click Erase 1 record permanently and confirm the dialog.

The rows go. Uploaded files go with them. Approved testimonials disappear from the live wall because those embeds are republished.

The activity log records that an erasure happened. It does not store the email.

The search is per website. If they used a second site in your account, open that site and search again.

Analytics is not in the list. Sitebase analytics counts visitors with a hash that changes every day. It never stored their email, so there is nothing identifiable to find.

If the search returns nothing, the page says so. You still check the other tools on your stack.

Check the rest of the stack

Sitebase only holds the forms and lists you put on that site. If the same address is in Kit or a payment provider, delete it there. Do the same for any sheet you exported last month.

Name those tools on the privacy policy so people know where to look. Use a contact email on that page that you read.

Reply after you check the live page

Open the published site in a fresh window. If they had a quote on a wall, confirm it is gone.

Reply to the same address. Say what you deleted. If you found nothing, say that.

Then walk the other checks in the launch checklist.