Privara

A self-hosted register for GDPR and CCPA / CPRA data requests, each tracked against its own deadline.

The problem it solves

DSARs arrive by email and the clock starts immediately, but most organizations have nothing tracking them — no deadline dashboard, no audit trail, just a shared inbox. Enterprise GRC platforms cover far more than DSAR tracking and are usually priced by quote; Privara is for a team that just needs to log requests and see, at a glance, how many days each one has left in the one-month period.

• Requests tracked in an inbox with no deadline visibility
• No audit trail of who did what and when
• Enterprise GRC suites priced and scoped for far more than DSAR tracking

Every feature

• Correspondence attachments per request. The identity document, the reply letter, the export you sent — filed on the request record itself, byte-sniffed on upload and served only through a signed-in controller. The paper trail lives where the deadline does.
• Deadline tracking against Article 12(3). The dashboard flags overdue and due-soon requests, with deadline math that follows Article 12(3) as the product implements it, month-end clamping included.
• Public submission form. A public form that confirms the requester controls the email address they gave. Any further identity checks are yours to run and record.
• Append-only audit log. Every status change, internal note and extension grant is timestamped in the request's history.
• Six request types. Captures access, deletion, rectification, portability, objection and restriction-of-processing requests, shown throughout the admin interface.
• Reusable response templates. Save canned acknowledgment, completion, and refusal text for reuse across requests.
• CSV/JSON export. Export request data for reporting or record-keeping.
• Installable mobile app (PWA). Add it to a phone or tablet home screen straight from the browser — a full-screen app served from your own server, with no app store involved. Business data is not stored offline on the device; what you see is read live.
• A checklist for every request. Keep a list of the systems that hold personal data (CRM, mailing tool, accounts, backups) and load it onto a request in one click. Each system gets an owner and a done mark with who, when and a note, so your register shows which systems were searched, corrected or erased, and by whom. Privara records the work; it never connects to those systems.
• California requests too. Each request runs on its own clock: GDPR's one month or the CCPA / CPRA's 45 days, extendable once. Your form can ask which law applies.
• Identity checks you can show. Record each check beyond the email link, with who and when, and set a minimum before any request is answered.
• In your requesters' languages. The form, status page and verification email in English, German, French, Spanish, Italian, Dutch and Polish.
• On your own website. Put the request form on your privacy page with one snippet; only the sites you list can show it.
• Reply from your templates. Write to the requester from one of your templates, with the reference, name, request type and deadline already filled in. Send it through your own mail server; the message you sent stays in the request's timeline.
• Updates from inside the app. The Updates page installs a new release with your license key: Ownware's signature is checked, a backup is taken first, and the app puts the previous version back by itself if the update is interrupted or the database step or start-up check of the new version fails. It never checks by itself.
• Backups by themselves. Automatic backups, an optional copy to S3-compatible storage you own, and a weekly check that the latest backup reads back. The Health page names anything that needs attention.
• Own It 4.0.1 — fixes and an up-to-date manual. For Privara, 4.0.1 fixes an installer and its invite page that had lost their styling, a rollback that a page opened during an update could stop and a command-line update that ended in an error after putting the previous version back. Its manual, FAQ and QUICKSTART now cover everything 4.0 added, including two Nginx rules that keep the data folder private. Your license covers it: press Check for updates on the Updates page, or download it from your order page.
• Own It 4.0.2 — the installer opens on every host. For Privara, 4.0.2 fixes a fresh install on an Apache host: the one-page setup at /install/ looped back to itself and never opened, and now it opens. Privara's Docker image also gives the web server the whole app folder, so a Docker install can finish and update itself. Your license covers it: press Check for updates on the Updates page, or download it from your order page.

Release notes in full

• Own It 4.1: client installations and your other tools. For Privara, 4.1 makes two changes that every app gets. An Extended license bought from October 4, 2026 covers up to ten client installations, one per client project: hand each one over to the client or host it for them, with the client's logo and colors from the app's branding settings. The API reference now shows how to connect Privara to Zapier, Make or n8n, using its own webhooks and API key. Your license covers the update: press Check for updates on the Updates page, or download it from your order page.
• Own It 4.0: it updates and backs itself up. For Privara, 4.0 means updates from inside the app: the Updates page checks for a new release with your license key, verifies Ownware's signature, takes a backup and puts the previous version back by itself if the update is interrupted or the database step or start-up check of the new version fails. A new install can start with a sample business and remove it in one click; backups run by themselves, with an optional offsite copy and a weekly check that the latest one reads back; and the Health page says whether the install is looking after itself.
• Own It 3.3: replies from your templates. Privara 3.3 turns your response templates into replies: write to the requester from one, with the reference, name, request type and deadline filled in, send it through your own mail server, and keep what you sent in the request's timeline. The template import's dry run now also shows a row with an unknown request type as skipped before you confirm.
• Own It 3.2: every system, every clock. The 3.2 wave gave Privara a checklist of the systems to search, correct or erase on each request, with an owner and a done mark per system, and California's CCPA / CPRA clock beside GDPR's month. It also records the identity checks you made, puts the request form on your own website and in your requesters' languages, and prints a one-page response record that says whether a request was answered on time.
• Own It 3.1: it writes to the people you serve. The 3.1 wave gave the catalog a way to reach the other side of the transaction: counterparty email through your own SMTP server, calendar feeds your own calendar subscribes to, attachments filed where the paperwork belongs, and export presets other people's software imports. Each outbound feature ships switched off and runs on your own credentials; a failed send is recorded, and the action that triggered it stands. What this app gained is listed at the top of this section.
• Own It 3.0: works for your AI, not just for you. An AI assistant can read the register, log a request that arrived by post and move requests through the workflow over MCP — writing through the same transition function the browser uses, so it cannot set a status the screen would refuse. Overdue is computed from the Article 12(3) deadline and cannot be set by anyone.
• Own It 2.0: API, 2FA, backups, dark mode. Privara 2.0 adds the 2.0 owner layer. Upgrade by replacing the files — the database migrates itself, and it is still the same one-time purchase.