Bump version to 0.18.1

CHANGELOG.md

@@ -4,6 +4,63 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [0.18.1] - 2026-09-16
+
+### Added
+- `Modules\Core\Payment\Privacy\PaymentDataProvider` — `lunar_transactions` (`card_type`/
+  `last_four`) and `stripe_payment_intents` were previously uncovered by any Privacy provider.
+  Pseudonymizes card metadata on erasure (same tax/accounting retention reasoning as
+  `OrderDataProvider`); deletes the Stripe correlation rows outright, since their only purpose
+  (resolving an async webhook callback) has already been served by the time an erasure request
+  runs. No Stripe Customer object exists anywhere in this app to also request deletion of — see
+  `docs/payments.md` "Reconciliation".
+- `Modules\Core\Auth\Privacy\UserSessionDataProvider` — `user_sessions` (`ip_address`,
+  `user_agent`) was previously uncovered. User-scope only; deleted outright on erasure, no legal
+  retention argument applies to login-session metadata.
+- `Modules\Core\Logging\Privacy\ActivityLogDataProvider` — Spatie's `activity_log` table
+  (`Modules\Core\Logging\ActivityLogService`, plus several Lunar models' native `LogsActivity`)
+  durably retained full PII snapshots in `properties` even after the real row was erased
+  elsewhere. Redacts `properties` by subject (`Customer`/`Address`/`CartAddress`/`OrderAddress`/
+  `Transaction`) on erasure; deliberately never touches `causer_id`, which is an actor reference,
+  not PII content. Must run before `AddressDataProvider` in `config('core.privacy.providers')` —
+  see the class's own docblock.
+- `ErasureOutcome::Failed` — a provider throwing an exception is now a genuine, distinct outcome
+  from `Skipped` (a deliberate no-op), surfaced in the erasure report rather than silently
+  aborting the request.
+
+### Fixed
+- `PrivacyService::completeErasure()` and `ExportDataSubjectJob::handle()` ran every registered
+  provider through a plain `array_map()` with no per-provider error handling — one provider
+  throwing aborted the entire request, discarding every other provider's already-computed
+  result and leaving the request stuck `Pending`/`Failed` with no report at all. Both now catch
+  per-provider (`PrivacyService::safeErase()`, `ExportDataSubjectJob::safeExport()`), logging the
+  exception and recording `ErasureOutcome::Failed`/`ProviderExportResult::$error` for that one
+  provider while every other provider's result is still recorded normally. Verified live:
+  simulating a throwing provider mid-erasure now correctly completes the request with a mixed
+  `erased`/`failed`/`erased` report instead of leaving it `Pending` forever.
+- `CartDataProvider`/`OrderDataProvider` never covered PII-adjacent keys living in `Cart.meta`/
+  `Order.meta`/`OrderAddress.meta` — `recovery_consent*`, `payment_method`, `checkout_fingerprint`
+  (Cart), `terms_accepted*` (Order), and `box_now_locker` (OrderAddress) all survived an erasure
+  request untouched. Both providers now clear these keys alongside their existing address/
+  free-text field erasure.
+- `CustomerDataProvider::eraseForUser()` left `otp_code`/`otp_expires_at`/`otp_attempts` on an
+  otherwise-erased `User` row. Now cleared alongside name/email.
+- `Modules\Core\Privacy\Filament\Resources\DataErasureRequestResource`'s "Outcome" section
+  referenced `docs/privacy.md` directly in staff-facing UI text (meaningless to a user with no
+  repo access) and rendered the per-provider report as raw JSON strings via a `KeyValueEntry`
+  (the wrong component for a list of structured rows). Replaced with a plain-language
+  description and a proper `RepeatableEntry` table (Data category / Outcome badge / Reason).
+
+### Changed
+- The 5 existing Privacy providers (`CustomerDataProvider`, `AddressDataProvider`,
+  `OrderDataProvider`, `CartDataProvider`, `ReviewDataProvider`) moved out of
+  `Modules\Core\Privacy\Providers` into their owning domain module's own `Privacy/` subdirectory
+  (e.g. `Modules\Core\Order\Privacy\OrderDataProvider`) — `Modules\Core\Privacy` now owns only
+  the shared contract, request lifecycle, and DTOs/enums. Matters concretely if a module is ever
+  extracted into its own composer package: the provider that knows how to erase that module's
+  data now travels with it, rather than being stranded in `Privacy` depending on a package that
+  no longer ships in this repo. See `docs/privacy.md` for the full reasoning.
+
 ## [0.18.0] - 2026-09-16
 
 ### Added

composer.json

@@ -2,7 +2,7 @@
   "name": "boboko/core",
   "description": "Core module — authentication and shared panel behaviour",
   "type": "library",
-  "version": "0.18.0",
+  "version": "0.18.1",
   "autoload": {
     "psr-4": {
       "Modules\\Core\\": "src/"

config/core.php

@@ -35,11 +35,19 @@ return [
 
     'privacy' => [
         'providers' => [
-            \Modules\Core\Privacy\Providers\CustomerDataProvider::class,
+            // ActivityLogDataProvider MUST run before AddressDataProvider —
-            \Modules\Core\Privacy\Providers\AddressDataProvider::class,
+            // it resolves which activity_log rows belong to this customer
-            \Modules\Core\Privacy\Providers\OrderDataProvider::class,
+            // (including ones keyed by an Address id) before
-            \Modules\Core\Privacy\Providers\CartDataProvider::class,
+            // AddressDataProvider hard-deletes those Address rows. See that
-            \Modules\Core\Privacy\Providers\ReviewDataProvider::class,
+            // provider's own class docblock.
+            \Modules\Core\Logging\Privacy\ActivityLogDataProvider::class,
+            \Modules\Core\Customer\Privacy\CustomerDataProvider::class,
+            \Modules\Core\Customer\Privacy\AddressDataProvider::class,
+            \Modules\Core\Order\Privacy\OrderDataProvider::class,
+            \Modules\Core\Cart\Privacy\CartDataProvider::class,
+            \Modules\Core\Review\Privacy\ReviewDataProvider::class,
+            \Modules\Core\Payment\Privacy\PaymentDataProvider::class,
+            \Modules\Core\Auth\Privacy\UserSessionDataProvider::class,
         ],
 
         'grace_period_days' => 30,

docs/payments.md

@@ -145,23 +145,20 @@ produced had it resolved synchronously.
 with no memory of the request that started the payment. Something has to persist enough to
 answer "which order/cart does gateway reference X belong to?" between the two calls.
 
-**Read directly from `lunarphp/stripe`'s own source** (`StripePaymentType::authorize()`,
+The precedent for this originally came from reading `lunarphp/stripe`'s own source
-`ProcessStripeWebhook`, `WebhookController`) to see how Lunar itself solves this — confirmed
+(`StripePaymentType::authorize()`, `ProcessStripeWebhook`, `WebhookController`) — that package
-it does **not** stash a generic opaque blob. It writes the correlating ids as real, typed
+solved this the same way, writing the correlating ids as real, typed columns on its own
-columns on `Lunar\Stripe\Models\StripePaymentIntent` (`cart_id`, `order_id`) at the moment the
+`StripePaymentIntent` model rather than a generic opaque blob. **`lunarphp/stripe` has since
-intent is created/first seen, then reads them back the same way when the webhook arrives:
+been removed from this project** in favour of depending on `stripe/stripe-php` directly (see
+CHANGELOG.md) — `Modules\Core\Payment\Models\StripePaymentIntent` is now a first-party model
+over the same table shape, kept for exactly the same reason.
 
-```php
+**`StripePaymentDriver` follows this pattern**: it reads `cart_id`/`order_id` out of `$context`
-// ProcessStripeWebhook::handle() — falls back through two real lookups,
+at `pay()`/`authorize()` time and writes them onto its own `StripePaymentIntent` row (`src/
-// neither of them a generic context blob:
+Payment/Models/StripePaymentIntent.php`, table `stripe_payment_intents`), then reads them back
-$cart = StripePaymentIntent::where('intent_id', $this->paymentIntentId)->first()?->cart
+the same way in `handleCallback()`. No generic `context` json column beyond what that table
-    ?: Cart::where('meta->payment_intent', '=', $this->paymentIntentId)->first();
+already carries (`context`, added for a different purpose — see that migration's own
-```
+docblock), no new table.
-
-**`StripePaymentDriver` follows this exact precedent**: it reads `cart_id`/`order_id` out of
-`$context` at `pay()`/`authorize()` time and writes them onto its own `StripePaymentIntent`
-row (a table already owned by `lunarphp/stripe`, already shaped for exactly this), then reads
-them back the same way in `handleCallback()`. No generic `context` json column, no new table.
 
 ### This pattern is per-driver, not a shared table
 
@@ -176,6 +173,48 @@ a shared generic one.
 
 ---
 
+## Reconciliation — a charge that succeeds on Stripe but is never written locally
+
+This app never creates or reuses a Stripe **Customer** object — every PaymentIntent is a
+one-off (`StripePaymentDriver::createAndConfirm()`'s own `$params` never includes a `customer`
+key), and nothing calls Stripe's Customer API anywhere in this codebase. That's a deliberate
+choice, not an oversight: a Customer object only earns its keep if something actually needs it
+(saved/reusable payment methods, subscriptions, Stripe-side lifetime-value grouping across
+orders) — none of which exist in this checkout flow today. Creating one anyway would just be
+more PII sitting on a third party's servers for no functional benefit, and it would become
+another cross-reference a future Payment privacy provider has to account for (detaching/
+deleting the Customer on erasure, not just the local PaymentIntent row). If a real feature
+needs it later (e.g. "save my card"), add it then, scoped to that feature.
+
+The gap this creates: with no Customer object and no other identifying field previously sent
+to Stripe, a PaymentIntent that succeeds on Stripe's side but is never written to our own DB
+(e.g. a database outage at exactly the wrong moment, between Stripe confirming the charge and
+`rememberIntent()`'s insert) would be **untraceable** back to a cart or order — nothing to
+search Stripe's dashboard by except amount, timestamp, and card last-4.
+
+**Fix**: `createAndConfirm()` now sets `metadata: ['cart_id' => ..., 'order_id' => ...]`
+(`array_filter()`-ed, since `order_id` isn't known yet at initial `pay()`/`authorize()` time —
+same null-coalesce `rememberIntent()` already does) on every PaymentIntent. This is metadata
+only, visible on Stripe's own dashboard/API for manual reconciliation — it does not create a
+Customer object and does not change anything about how `handleCallback()`/webhook correlation
+works (that still goes through `stripe_payment_intents`, per "Async resolution" above). It's
+purely a recovery aid for the case where our own write never happened at all.
+
+---
+
+## GDPR erasure/export
+
+`Modules\Core\Payment\Privacy\PaymentDataProvider` covers `lunar_transactions`
+(`card_type`/`last_four`) and `stripe_payment_intents` — see `docs/privacy.md` for the full
+right-of-erasure/right-of-access design. Pseudonymizes card metadata on erasure (same
+tax/accounting retention reasoning `Order`'s own provider uses) and deletes the Stripe
+correlation rows outright, since their only purpose — resolving an async webhook callback, see
+"Async resolution" above — has already been served by the time an erasure request runs. No
+Stripe Customer object exists anywhere in this app (see "Reconciliation" above) for this
+provider to also request deletion of.
+
+---
+
 ## Explicitly out of scope for this pass
 
 - **`Checkout`/`Order` wiring** — how `Checkout` calls into `Payment`, how `Order`/`Checkout`

docs/privacy.md

@@ -61,6 +61,17 @@ implements that method as a no-op — `ErasureOutcome::Skipped` with a reason fo
 payload for export (e.g. `AddressDataProvider::eraseForUser()`, since addresses belong to a
 Customer, not an individual).
 
+A provider implementation lives inside the module that owns the data it erases/exports, under
+that module's own `Privacy/` subdirectory (e.g. `Modules\Core\Order\Privacy\OrderDataProvider`,
+`Modules\Core\Customer\Privacy\CustomerDataProvider`) — never inside `Modules\Core\Privacy`
+itself, which only owns the shared contract (`Contracts\PersonalDataProvider`), the request
+lifecycle (`Services\PrivacyManager`/`PrivacyService`), and the DTOs/enums every provider
+returns. This mirrors how this codebase already handles other cross-cutting-but-domain-specific
+code (e.g. a resource's own `Filament/Extensions/` subdirectory) — and matters concretely if a
+module is ever extracted into its own composer package (see `docs/modules.md`): the provider
+that knows how to erase that module's data must travel with it, not get stranded in `Privacy`
+depending on a package that no longer ships in this repo.
+
 A module registers by adding its provider class to `config('core.privacy.providers')` — the
 same shape as Lunar's own `config('lunar.search.indexers')` model→indexer map:
 
@@ -68,11 +79,11 @@ same shape as Lunar's own `config('lunar.search.indexers')` model→indexer map:
 // config/core.php
 'privacy' => [
     'providers' => [
-        \Modules\Core\Privacy\Providers\CustomerDataProvider::class,
+        \Modules\Core\Customer\Privacy\CustomerDataProvider::class,
-        \Modules\Core\Privacy\Providers\AddressDataProvider::class,
+        \Modules\Core\Customer\Privacy\AddressDataProvider::class,
-        \Modules\Core\Privacy\Providers\OrderDataProvider::class,
+        \Modules\Core\Order\Privacy\OrderDataProvider::class,
-        \Modules\Core\Privacy\Providers\CartDataProvider::class,
+        \Modules\Core\Cart\Privacy\CartDataProvider::class,
-        \Modules\Core\Privacy\Providers\ReviewDataProvider::class,
+        \Modules\Core\Review\Privacy\ReviewDataProvider::class,
         // A future module just adds its own provider here.
     ],
 ],
@@ -113,17 +124,40 @@ from the record staff (or the person themselves) look up.
 
 ## Providers shipped in core
 
-| Provider | `name()` | Covers | Customer-scope | User-scope |
+| Provider | `name()` | Lives in | Covers | Customer-scope | User-scope |
-|---|---|---|---|---|
+|---|---|---|---|---|---|
-| `CustomerDataProvider` | `customer` | `lunar_customers`, and separately the `User`'s own name/email | Erases the account's own fields only | Erases that User's name/email only, and detaches them from every linked Customer |
+| `ActivityLogDataProvider` | `activity_log` | `Modules\Core\Logging\Privacy` | `activity_log` (Spatie) for subject types `Customer`/`Address`/`CartAddress`/`OrderAddress`/`Transaction` | **Pseudonymized** — `properties` redacted, who/what/when metadata kept | Skipped — `causer_id` is an actor reference, not PII content; see below |
-| `AddressDataProvider` | `addresses` | `lunar_addresses` | Erased (deleted outright) | Skipped — belongs to a Customer, not an individual |
+| `CustomerDataProvider` | `customer` | `Modules\Core\Customer\Privacy` | `lunar_customers`, and separately the `User`'s own name/email/OTP fields | Erases the account's own fields only | Erases that User's name/email/OTP fields only, and detaches them from every linked Customer |
-| `OrderDataProvider` | `orders` | `lunar_orders`, `lunar_order_addresses` | **Pseudonymized, not erased** — see below | Skipped — belongs to a Customer, not an individual |
+| `AddressDataProvider` | `addresses` | `Modules\Core\Customer\Privacy` | `lunar_addresses` | Erased (deleted outright) | Skipped — belongs to a Customer, not an individual |
-| `CartDataProvider` | `carts` | `lunar_cart_addresses` | Erased | Skipped — belongs to a Customer, not an individual |
+| `OrderDataProvider` | `orders` | `Modules\Core\Order\Privacy` | `lunar_orders`, `lunar_order_addresses`, and their `meta` (`terms_accepted*`, `payment_method`, `box_now_locker`) | **Pseudonymized, not erased** — see below | Skipped — belongs to a Customer, not an individual |
-| `ReviewDataProvider` | `reviews` | `product_reviews` | Skipped — authored by an individual, not a business account | Pseudonymized by matching `reviewer_email`; rating/title/body text kept |
+| `CartDataProvider` | `carts` | `Modules\Core\Cart\Privacy` | `lunar_cart_addresses`, and `lunar_carts.meta` (`recovery_consent*`, `payment_method`, `checkout_fingerprint`) | Erased | Skipped — belongs to a Customer, not an individual |
+| `ReviewDataProvider` | `reviews` | `Modules\Core\Review\Privacy` | `product_reviews` | Skipped — authored by an individual, not a business account | Pseudonymized by matching `reviewer_email`; rating/title/body text kept |
+| `PaymentDataProvider` | `payments` | `Modules\Core\Payment\Privacy` | `lunar_transactions` (`card_type`/`last_four`), `stripe_payment_intents` | **Pseudonymized** — card metadata cleared, correlation rows deleted, amounts/statuses kept | Skipped — belongs to Customer-owned orders, not individual users |
+| `UserSessionDataProvider` | `sessions` | `Modules\Core\Auth\Privacy` | `user_sessions` (`ip_address`, `user_agent`) | Skipped — belongs to an individual User, not a business account | Erased (deleted outright) |
 
 `CustomerDataProvider` is the one provider that implements both scopes meaningfully, and keeps
 them from touching each other — see the class docblock for the full reasoning.
 
+### `activity_log` is redacted by subject, never by causer
+
+`Modules\Core\Logging\ActivityLogService` (plus several Lunar models' own native `use
+LogsActivity` — `Customer`, `CartAddress`, `OrderAddress`, `Transaction`) durably retains a full
+snapshot of whatever it logged in `properties`, completely independent of the real row it
+describes — erasing/pseudonymizing a `Customer`/`Address`/`Order`/etc. elsewhere does nothing to
+this table on its own. `ActivityLogDataProvider::eraseForCustomer()` redacts `properties` on
+every row whose **subject** (not causer) resolves back to that customer, across all five
+PII-bearing subject types.
+
+It deliberately never touches `causer_id` — the causer is "who performed this action," not PII
+content, and erasing it would defeat the audit trail's own purpose. `eraseForUser()` is
+therefore a no-op: a `User` appears in this table only as a causer, never as subject content, so
+there's nothing to redact from the User side alone.
+
+**Ordering dependency**: `ActivityLogDataProvider` must run *before* `AddressDataProvider` in
+`config('core.privacy.providers')` — it resolves which `activity_log` rows are keyed by an
+`Address` id while those Address rows still exist; `AddressDataProvider` then hard-deletes them.
+Reversing the order would make matching those rows impossible once the addresses are gone.
+
 **`ReviewDataProvider` needs review.** It moved from Customer-scope to User-scope on the
 reasoning that authorship is a personal attribute, not a business-account attribute — but this
 hasn't been fully validated against how reviews are actually attributed in this codebase. The
@@ -169,7 +203,7 @@ no one — a business-account erasure must never block anyone's access.
 `Modules\Core\Auth\Services\UserOtpService` — nothing else changes).
 
 ```php
-use Modules\Core\Privacy\PrivacyService;
+use Modules\Core\Privacy\Services\PrivacyService;
 
 $service = app(PrivacyService::class);
 

src/Auth/Privacy/UserSessionDataProvider.php

@@ -0,0 +1,68 @@
+<?php
+
+namespace Modules\Core\Auth\Privacy;
+
+use Modules\Core\Auth\Models\UserSession;
+use Modules\Core\Privacy\Contracts\PersonalDataProvider;
+use Modules\Core\Privacy\DTOs\CustomerSubject;
+use Modules\Core\Privacy\Enums\ErasureOutcome;
+use Modules\Core\Privacy\DTOs\ProviderErasureResult;
+use Modules\Core\Privacy\DTOs\ProviderExportResult;
+use Modules\Core\Privacy\DTOs\UserSubject;
+
+/**
+ * Login-session device/location metadata (user_sessions) — ip_address and
+ * user_agent are device/location fingerprinting data tied 1:1 to a User via
+ * user_id, never to a Customer (business account), so this is User-scope
+ * only. No legal retention requirement applies to session metadata the way
+ * it does to Order (there's no tax/accounting reason to keep old login IPs
+ * around), so rows are deleted outright rather than pseudonymized.
+ *
+ * A hard delete here is safe regardless of whether the User row itself has
+ * already been erased — CustomerDataProvider::eraseForUser() nulls the
+ * User's own name/email but never touches user_sessions, and the table's
+ * own user_id FK is cascadeOnDelete() only if the User row itself were
+ * hard-deleted, which it never is (erasure here means "identity nulled,"
+ * not "row removed" — see docs/modules.md "Customer/User Pairing").
+ */
+class UserSessionDataProvider implements PersonalDataProvider
+{
+    public function name(): string
+    {
+        return 'sessions';
+    }
+
+    public function exportForCustomer(CustomerSubject $subject): ProviderExportResult
+    {
+        return new ProviderExportResult('sessions', []);
+    }
+
+    public function exportForUser(UserSubject $subject): ProviderExportResult
+    {
+        $sessions = UserSession::where('user_id', $subject->userId)->get();
+
+        return new ProviderExportResult('sessions', $sessions->map(fn (UserSession $session) => [
+            'id' => $session->id,
+            'ip_address' => $session->ip_address,
+            'user_agent' => $session->user_agent,
+            'last_used_at' => $session->last_used_at?->toIso8601String(),
+            'revoked_at' => $session->revoked_at?->toIso8601String(),
+        ])->all());
+    }
+
+    public function eraseForCustomer(CustomerSubject $subject): ProviderErasureResult
+    {
+        return new ProviderErasureResult('sessions', ErasureOutcome::Skipped, 'Login sessions belong to individual Users, not Customer accounts.');
+    }
+
+    public function eraseForUser(UserSubject $subject): ProviderErasureResult
+    {
+        $deleted = UserSession::where('user_id', $subject->userId)->delete();
+
+        if ($deleted === 0) {
+            return new ProviderErasureResult('sessions', ErasureOutcome::Skipped, 'No login sessions for this user.');
+        }
+
+        return new ProviderErasureResult('sessions', ErasureOutcome::Erased);
+    }
+}

src/Cart/Privacy/CartDataProvider.php

@@ -0,0 +1,108 @@
+<?php
+
+namespace Modules\Core\Cart\Privacy;
+
+use Lunar\Models\Cart;
+use Lunar\Models\CartAddress;
+use Modules\Core\Privacy\Contracts\PersonalDataProvider;
+use Modules\Core\Privacy\DTOs\CustomerSubject;
+use Modules\Core\Privacy\Enums\ErasureOutcome;
+use Modules\Core\Privacy\DTOs\ProviderErasureResult;
+use Modules\Core\Privacy\DTOs\ProviderExportResult;
+use Modules\Core\Privacy\DTOs\UserSubject;
+
+/**
+ * Carts and cart addresses (lunar_carts, lunar_cart_addresses) belong to the
+ * Customer (business account) via customer_id, not to an individual User, so this
+ * is Customer-scope only. Unlike Order/OrderAddress, an abandoned cart has no
+ * legal retention requirement, so its addresses are freely deleted. The Cart row
+ * itself is left alone (any completed order it produced is handled separately by
+ * OrderDataProvider, which is what retention law actually cares about) — only its
+ * address PII is removed.
+ *
+ * Also covers Cart.meta's own PII-adjacent keys — Modules\Core\Checkout\Services\
+ * CheckoutService::setRecoveryConsent()/selectPaymentMethod() write
+ * recovery_consent/recovery_consent_at/recovery_consent_policy_version and
+ * payment_method/checkout_fingerprint directly onto this same Cart row, which the
+ * address-only erase above never touched. Kept Customer-scope, consistent with
+ * how Cart itself is already classified — see docs/privacy.md for the
+ * User-vs-Customer discussion this raised.
+ */
+class CartDataProvider implements PersonalDataProvider
+{
+    private const META_KEYS = [
+        'recovery_consent',
+        'recovery_consent_at',
+        'recovery_consent_policy_version',
+        'payment_method',
+        'checkout_fingerprint',
+    ];
+
+    public function name(): string
+    {
+        return 'carts';
+    }
+
+    public function exportForCustomer(CustomerSubject $subject): ProviderExportResult
+    {
+        $carts = Cart::where('customer_id', $subject->customerId)->get();
+
+        $addresses = CartAddress::whereIn('cart_id', $carts->pluck('id'))->get();
+
+        return new ProviderExportResult('carts', [
+            'addresses' => $addresses->map(fn (CartAddress $address) => [
+                'type' => $address->type,
+                'first_name' => $address->first_name,
+                'last_name' => $address->last_name,
+                'line_one' => $address->line_one,
+                'city' => $address->city,
+                'postcode' => $address->postcode,
+                'contact_email' => $address->contact_email,
+                'contact_phone' => $address->contact_phone,
+            ])->all(),
+            'carts' => $carts->map(fn (Cart $cart) => [
+                'id' => $cart->id,
+                'meta' => $this->metaOnly($cart),
+            ])->all(),
+        ]);
+    }
+
+    public function exportForUser(UserSubject $subject): ProviderExportResult
+    {
+        return new ProviderExportResult('carts', []);
+    }
+
+    public function eraseForCustomer(CustomerSubject $subject): ProviderErasureResult
+    {
+        $carts = Cart::where('customer_id', $subject->customerId)->get();
+
+        CartAddress::whereIn('cart_id', $carts->pluck('id'))->delete();
+
+        foreach ($carts as $cart) {
+            $meta = (array) $cart->meta;
+
+            foreach (self::META_KEYS as $key) {
+                unset($meta[$key]);
+            }
+
+            $cart->update(['meta' => $meta]);
+        }
+
+        return new ProviderErasureResult('carts', ErasureOutcome::Erased);
+    }
+
+    public function eraseForUser(UserSubject $subject): ProviderErasureResult
+    {
+        return new ProviderErasureResult('carts', ErasureOutcome::Skipped, 'Carts belong to Customer accounts, not individual users.');
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function metaOnly(Cart $cart): array
+    {
+        $meta = (array) $cart->meta;
+
+        return array_intersect_key($meta, array_flip(self::META_KEYS));
+    }
+}

src/Command/ProcessErasureRequestsCommand.php

@@ -3,7 +3,7 @@
 namespace Modules\Core\Command;
 
 use Illuminate\Console\Command;
-use Modules\Core\Privacy\ErasureRequestStatus;
+use Modules\Core\Privacy\Enums\ErasureRequestStatus;
 use Modules\Core\Privacy\Jobs\EraseDataSubjectJob;
 use Modules\Core\Privacy\Models\DataErasureRequest;
 

src/CorePlugin.php

@@ -102,9 +102,21 @@ class CorePlugin implements Plugin
             CustomerResource::class => CustomerErasureRelationsExtension::class,
         ]);
 
-        Product::macro('reviews', function (): HasMany {
+        // resolveRelationUsing(), not macro() — Illuminate\Database\Eloquent\
-            /** @var Product $this */
+        // Model does not use the Macroable trait in this Laravel version, so
-            return $this->hasMany(ProductReview::class);
+        // Product::macro(...)/Customer::macro(...)/$userModel::macro(...)
+        // silently fall through to Model::__callStatic(), which instantiates
+        // the model and tries to call the method as a real one, hitting
+        // newQuery()->getConnection() — this crashes every console command
+        // and every request, since CorePlugin::register() runs during
+        // provider registration, before the DB connection is configured
+        // ("Call to a member function connection() on null"). This bit us
+        // once already; resolveRelationUsing() is Eloquent's real, intended,
+        // connection-free extension point for exactly this (Order::
+        // resolveRelationUsing('shipments', ...) in ShippingServiceProvider
+        // already uses it correctly).
+        Product::resolveRelationUsing('reviews', function (Product $product): HasMany {
+            return $product->hasMany(ProductReview::class);
         });
 
         // Customer::erasureRequests()/exportRequests() and the User-model
@@ -115,24 +127,22 @@ class CorePlugin implements Plugin
         // Customer or a User (see docs/privacy.md "User-scope vs Customer-scope"),
         // so this is a MorphMany built by hand rather than a bare Eloquent
         // convention lookup.
-        Customer::macro('erasureRequests', function (): MorphMany {
+        Customer::resolveRelationUsing('erasureRequests', function (Customer $customer): MorphMany {
-            /** @var Customer $this */
+            return $customer->morphMany(DataErasureRequest::class, 'subject', 'subject_type', 'subject_id');
-            return $this->morphMany(DataErasureRequest::class, 'subject', 'subject_type', 'subject_id');
         });
 
-        Customer::macro('exportRequests', function (): MorphMany {
+        Customer::resolveRelationUsing('exportRequests', function (Customer $customer): MorphMany {
-            /** @var Customer $this */
+            return $customer->morphMany(DataExportRequest::class, 'subject', 'subject_type', 'subject_id');
-            return $this->morphMany(DataExportRequest::class, 'subject', 'subject_type', 'subject_id');
         });
 
         $userModel = config('auth.providers.users.model');
 
-        $userModel::macro('erasureRequests', function (): MorphMany {
+        $userModel::resolveRelationUsing('erasureRequests', function ($user): MorphMany {
-            return $this->morphMany(DataErasureRequest::class, 'subject', 'subject_type', 'subject_id');
+            return $user->morphMany(DataErasureRequest::class, 'subject', 'subject_type', 'subject_id');
         });
 
-        $userModel::macro('exportRequests', function (): MorphMany {
+        $userModel::resolveRelationUsing('exportRequests', function ($user): MorphMany {
-            return $this->morphMany(DataExportRequest::class, 'subject', 'subject_type', 'subject_id');
+            return $user->morphMany(DataExportRequest::class, 'subject', 'subject_type', 'subject_id');
         });
 
         LunarStaff::addActivitylogExcept([

src/Customer/Privacy/AddressDataProvider.php

@@ -1,14 +1,14 @@
 <?php
 
-namespace Modules\Core\Privacy\Providers;
+namespace Modules\Core\Customer\Privacy;
 
 use Lunar\Models\Address;
 use Modules\Core\Privacy\Contracts\PersonalDataProvider;
-use Modules\Core\Privacy\CustomerSubject;
+use Modules\Core\Privacy\DTOs\CustomerSubject;
-use Modules\Core\Privacy\ErasureOutcome;
+use Modules\Core\Privacy\Enums\ErasureOutcome;
-use Modules\Core\Privacy\ProviderErasureResult;
+use Modules\Core\Privacy\DTOs\ProviderErasureResult;
-use Modules\Core\Privacy\ProviderExportResult;
+use Modules\Core\Privacy\DTOs\ProviderExportResult;
-use Modules\Core\Privacy\UserSubject;
+use Modules\Core\Privacy\DTOs\UserSubject;
 
 /**
  * A customer's saved addresses (lunar_addresses) — belong to the Customer

src/Customer/Privacy/CustomerDataProvider.php

@@ -1,14 +1,14 @@
 <?php
 
-namespace Modules\Core\Privacy\Providers;
+namespace Modules\Core\Customer\Privacy;
 
 use Lunar\Models\Customer;
 use Modules\Core\Privacy\Contracts\PersonalDataProvider;
-use Modules\Core\Privacy\CustomerSubject;
+use Modules\Core\Privacy\DTOs\CustomerSubject;
-use Modules\Core\Privacy\ErasureOutcome;
+use Modules\Core\Privacy\Enums\ErasureOutcome;
-use Modules\Core\Privacy\ProviderErasureResult;
+use Modules\Core\Privacy\DTOs\ProviderErasureResult;
-use Modules\Core\Privacy\ProviderExportResult;
+use Modules\Core\Privacy\DTOs\ProviderExportResult;
-use Modules\Core\Privacy\UserSubject;
+use Modules\Core\Privacy\DTOs\UserSubject;
 
 /**
  * The Customer record itself (lunar_customers) and, on the User side, the User's
@@ -108,6 +108,13 @@ class CustomerDataProvider implements PersonalDataProvider
         $user->update([
             'name' => null,
             'email' => "erased-user-{$user->id}@example.invalid",
+            // A live OTP code left on an otherwise-erased row is a residual
+            // secret tied to an identity that no longer exists here — clear
+            // it alongside name/email rather than leaving it to expire on
+            // its own 10-minute window.
+            'otp_code' => null,
+            'otp_expires_at' => null,
+            'otp_attempts' => 0,
         ]);
 
         return new ProviderErasureResult('customer', ErasureOutcome::Erased);

src/Export/CsvColumn.php

@@ -2,6 +2,8 @@
 
 namespace Modules\Core\Export;
 
+use Closure;
+
 /**
  * One column in a CsvWriter schema: a header label plus a closure that pulls this
  * column's value out of one record. The closure doesn't care what shape a record
@@ -12,10 +14,10 @@ namespace Modules\Core\Export;
 final class CsvColumn
 {
     /**
-     * @param  \Closure(mixed): (string|int|float|null)  $value
+     * @param Closure(mixed):((string|int|float|null)) $value
      */
     public function __construct(
         public readonly string $header,
-        public readonly \Closure $value,
+        public readonly Closure $value,
     ) {}
 }

src/Logging/Privacy/ActivityLogDataProvider.php

@@ -0,0 +1,148 @@
+<?php
+
+namespace Modules\Core\Logging\Privacy;
+
+use Lunar\Models\Address;
+use Lunar\Models\Cart;
+use Lunar\Models\CartAddress;
+use Lunar\Models\Customer;
+use Lunar\Models\Order;
+use Lunar\Models\OrderAddress;
+use Lunar\Models\Transaction;
+use Modules\Core\Privacy\Contracts\PersonalDataProvider;
+use Modules\Core\Privacy\DTOs\CustomerSubject;
+use Modules\Core\Privacy\Enums\ErasureOutcome;
+use Modules\Core\Privacy\DTOs\ProviderErasureResult;
+use Modules\Core\Privacy\DTOs\ProviderExportResult;
+use Modules\Core\Privacy\DTOs\UserSubject;
+use Spatie\Activitylog\Models\Activity;
+
+/**
+ * Spatie's own activity_log table (Modules\Core\Logging\ActivityLogService,
+ * plus several Lunar models' native `use LogsActivity` — Customer,
+ * CartAddress, OrderAddress, Transaction) durably retains a full snapshot
+ * of whatever it logged in `properties` (created/updated/deleted
+ * attributes, including a before/after diff on update), completely
+ * independent of the real row it describes. Erasing/pseudonymizing
+ * Customer/Address/CartAddress/OrderAddress/Transaction elsewhere (see
+ * Customer\Privacy\CustomerDataProvider, Customer\Privacy\
+ * AddressDataProvider, Cart\Privacy\CartDataProvider, Order\Privacy\
+ * OrderDataProvider, Payment\Privacy\PaymentDataProvider) does nothing to
+ * this table — a full copy of the old PII survives here regardless.
+ *
+ * Redacts by SUBJECT only, never by `causer_id` — the causer is "who did
+ * this," not PII content, and erasing it would erode the audit trail's own
+ * purpose (see this provider's own eraseForUser(), which is a deliberate
+ * no-op). Genuinely Customer-scope only: every subject type here
+ * (Customer, Address, CartAddress, OrderAddress, Transaction) resolves to
+ * a business account via its own chain (Address/Customer directly;
+ * CartAddress via cart_id -&gt; Cart.customer_id; OrderAddress/Transaction
+ * via order_id -&gt; Order.customer_id) — none of it is a User's own data on
+ * its own.
+ *
+ * MUST run before Customer\Privacy\AddressDataProvider in
+ * config('core.privacy.providers') — that provider hard-deletes Address
+ * rows, and once gone there is no way to re-derive which activity_log
+ * rows (subject_type = Address) belonged to this customer. This provider
+ * resolves that address id list itself, before anything deletes it.
+ */
+class ActivityLogDataProvider implements PersonalDataProvider
+{
+    private const REDACTED = '[redacted]';
+
+    public function name(): string
+    {
+        return 'activity_log';
+    }
+
+    public function exportForCustomer(CustomerSubject $subject): ProviderExportResult
+    {
+        $activities = Activity::query()
+            ->where(fn ($query) => $this->scopeToCustomer($query, $subject->customerId))
+            ->get();
+
+        return new ProviderExportResult('activity_log', $activities->map(fn (Activity $activity) => [
+            'id' => $activity->id,
+            'log_name' => $activity->log_name,
+            'description' => $activity->description,
+            'subject_type' => $activity->subject_type,
+            'subject_id' => $activity->subject_id,
+            'event' => $activity->event,
+            'properties' => $activity->properties?->toArray(),
+            'created_at' => $activity->created_at?->toIso8601String(),
+        ])->all());
+    }
+
+    public function exportForUser(UserSubject $subject): ProviderExportResult
+    {
+        return new ProviderExportResult('activity_log', []);
+    }
+
+    public function eraseForCustomer(CustomerSubject $subject): ProviderErasureResult
+    {
+        $affected = Activity::query()
+            ->where(fn ($query) => $this->scopeToCustomer($query, $subject->customerId))
+            ->get();
+
+        if ($affected->isEmpty()) {
+            return new ProviderErasureResult('activity_log', ErasureOutcome::Skipped, 'No activity log entries for this customer.');
+        }
+
+        foreach ($affected as $activity) {
+            $activity->update(['properties' => $this->redact($activity->properties?->toArray() ?? [])]);
+        }
+
+        return new ProviderErasureResult(
+            'activity_log',
+            ErasureOutcome::Pseudonymized,
+            'PII-bearing properties redacted on matching audit log entries; who/what/when metadata (log_name, subject, event, timestamp, causer) retained for audit integrity.'
+        );
+    }
+
+    public function eraseForUser(UserSubject $subject): ProviderErasureResult
+    {
+        return new ProviderErasureResult(
+            'activity_log',
+            ErasureOutcome::Skipped,
+            'A User only ever appears here as causer_id (who performed an action), not as the PII content of a log entry — redacting that would erode the audit trail\'s own record of who acted.'
+        );
+    }
+
+    private function scopeToCustomer($query, int $customerId): void
+    {
+        $customerMorph = (new Customer)->getMorphClass();
+        $addressMorph = (new Address)->getMorphClass();
+        $cartAddressMorph = (new CartAddress)->getMorphClass();
+        $orderAddressMorph = (new OrderAddress)->getMorphClass();
+        $transactionMorph = (new Transaction)->getMorphClass();
+
+        $addressIds = Address::where('customer_id', $customerId)->pluck('id');
+        $cartIds = Cart::where('customer_id', $customerId)->pluck('id');
+        $cartAddressIds = CartAddress::whereIn('cart_id', $cartIds)->pluck('id');
+        $orderIds = Order::where('customer_id', $customerId)->pluck('id');
+        $orderAddressIds = OrderAddress::whereIn('order_id', $orderIds)->pluck('id');
+        $transactionIds = Transaction::whereIn('order_id', $orderIds)->pluck('id');
+
+        $query
+            ->where(fn ($q) => $q->where('subject_type', $customerMorph)->where('subject_id', $customerId))
+            ->orWhere(fn ($q) => $q->where('subject_type', $addressMorph)->whereIn('subject_id', $addressIds))
+            ->orWhere(fn ($q) => $q->where('subject_type', $cartAddressMorph)->whereIn('subject_id', $cartAddressIds))
+            ->orWhere(fn ($q) => $q->where('subject_type', $orderAddressMorph)->whereIn('subject_id', $orderAddressIds))
+            ->orWhere(fn ($q) => $q->where('subject_type', $transactionMorph)->whereIn('subject_id', $transactionIds));
+    }
+
+    /**
+     * @param  array<string, mixed>  $properties
+     * @return array<string, mixed>
+     */
+    private function redact(array $properties): array
+    {
+        return array_map(function ($value) {
+            if (is_array($value)) {
+                return array_map(fn () => self::REDACTED, $value);
+            }
+
+            return self::REDACTED;
+        }, $properties);
+    }
+}

src/Order/Privacy/OrderDataProvider.php

@@ -0,0 +1,148 @@
+<?php
+
+namespace Modules\Core\Order\Privacy;
+
+use Lunar\Models\Order;
+use Lunar\Models\OrderAddress;
+use Modules\Core\Privacy\Contracts\PersonalDataProvider;
+use Modules\Core\Privacy\DTOs\CustomerSubject;
+use Modules\Core\Privacy\Enums\ErasureOutcome;
+use Modules\Core\Privacy\DTOs\ProviderErasureResult;
+use Modules\Core\Privacy\DTOs\ProviderExportResult;
+use Modules\Core\Privacy\DTOs\UserSubject;
+
+/**
+ * Orders and order addresses (lunar_orders, lunar_order_addresses) belong to the
+ * Customer (business account) via customer_id, not to an individual User, so this
+ * is Customer-scope only. They're also subject to legal retention (tax/accounting
+ * law generally requires invoices be kept for several years — GDPR Art. 17(3)(b)
+ * explicitly allows this to override an erasure request). eraseForCustomer()
+ * therefore pseudonymizes the PII-bearing free-text fields in place rather than
+ * deleting the order: totals, line items, tax data, and the order itself all
+ * remain intact and auditable.
+ *
+ * Also covers PII-adjacent keys living in Order.meta and OrderAddress.meta —
+ * Modules\Core\Checkout\Services\CheckoutService::initiatePayment() writes
+ * terms_accepted/terms_accepted_at/terms_accepted_policy_version/payment_method
+ * onto Order.meta, and Modules\Core\Shipping\Carriers\BoxNow\
+ * BoxNowFulfillmentService writes the shopper's chosen box_now_locker onto
+ * OrderAddress.meta — neither of which the free-text column erase above ever
+ * touched. Kept Customer-scope, consistent with Order/OrderAddress themselves.
+ */
+class OrderDataProvider implements PersonalDataProvider
+{
+    private const ORDER_META_KEYS = [
+        'terms_accepted',
+        'terms_accepted_at',
+        'terms_accepted_policy_version',
+        'payment_method',
+    ];
+
+    private const ADDRESS_META_KEYS = [
+        'box_now_locker',
+    ];
+
+    public function name(): string
+    {
+        return 'orders';
+    }
+
+    public function exportForCustomer(CustomerSubject $subject): ProviderExportResult
+    {
+        $orders = Order::where('customer_id', $subject->customerId)->with('addresses')->get();
+
+        return new ProviderExportResult('orders', $orders->map(fn (Order $order) => [
+            'id' => $order->id,
+            'reference' => $order->reference,
+            'status' => $order->status,
+            'total' => $order->total?->decimal(),
+            'placed_at' => $order->placed_at?->toIso8601String(),
+            'meta' => $this->onlyKeys((array) $order->meta, self::ORDER_META_KEYS),
+            'addresses' => $order->addresses->map(fn (OrderAddress $address) => [
+                'type' => $address->type,
+                'first_name' => $address->first_name,
+                'last_name' => $address->last_name,
+                'line_one' => $address->line_one,
+                'city' => $address->city,
+                'postcode' => $address->postcode,
+                'contact_email' => $address->contact_email,
+                'contact_phone' => $address->contact_phone,
+                'meta' => $this->onlyKeys((array) $address->meta, self::ADDRESS_META_KEYS),
+            ])->all(),
+        ])->all());
+    }
+
+    public function exportForUser(UserSubject $subject): ProviderExportResult
+    {
+        return new ProviderExportResult('orders', []);
+    }
+
+    public function eraseForCustomer(CustomerSubject $subject): ProviderErasureResult
+    {
+        $orders = Order::where('customer_id', $subject->customerId)->with('addresses')->get();
+
+        if ($orders->isEmpty()) {
+            return new ProviderErasureResult('orders', ErasureOutcome::Skipped, 'No orders for this customer.');
+        }
+
+        foreach ($orders as $order) {
+            $order->update([
+                'customer_reference' => null,
+                'notes' => null,
+                'meta' => $this->withoutKeys((array) $order->meta, self::ORDER_META_KEYS),
+            ]);
+
+            foreach ($order->addresses as $address) {
+                $address->update([
+                    'title' => null,
+                    'first_name' => 'Erased',
+                    'last_name' => 'Customer',
+                    'company_name' => null,
+                    'tax_identifier' => null,
+                    'line_one' => null,
+                    'line_two' => null,
+                    'line_three' => null,
+                    'delivery_instructions' => null,
+                    'contact_email' => null,
+                    'contact_phone' => null,
+                    'meta' => $this->withoutKeys((array) $address->meta, self::ADDRESS_META_KEYS),
+                ]);
+            }
+        }
+
+        return new ProviderErasureResult(
+            'orders',
+            ErasureOutcome::Pseudonymized,
+            'Order and address free-text fields and PII-bearing meta keys cleared; order records, totals, and line items retained for legal/tax record-keeping.'
+        );
+    }
+
+    public function eraseForUser(UserSubject $subject): ProviderErasureResult
+    {
+        return new ProviderErasureResult('orders', ErasureOutcome::Skipped, 'Orders belong to Customer accounts, not individual users.');
+    }
+
+    /**
+     * @param  array<string, mixed>  $meta
+     * @param  array<int, string>  $keys
+     * @return array<string, mixed>
+     */
+    private function onlyKeys(array $meta, array $keys): array
+    {
+        return array_intersect_key($meta, array_flip($keys));
+    }
+
+    /**
+     * @param  array<string, mixed>  $meta
+     * @param  array<int, string>  $keys
+     * @return array<string, mixed>
+     */
+    private function withoutKeys(array $meta, array $keys): array
+    {
+        foreach ($keys as $key) {
+            unset($meta[$key]);
+        }
+
+        return $meta;
+    }
+}

src/Payment/Drivers/StripePaymentDriver.php

@@ -115,6 +115,25 @@ class StripePaymentDriver implements
             $params['payment_method'] = $data['payment_method'];
         }
 
+        // Reconciliation safety net: this app never creates a Stripe Customer
+        // object and attaches no other identifying info to the PaymentIntent
+        // (see docs/payments.md "Reconciliation" for the full reasoning), so
+        // without this, a charge that succeeds on Stripe's side but is never
+        // written to our own DB (e.g. a DB outage at exactly the wrong
+        // moment) would be untraceable back to a cart/order — nothing to
+        // search Stripe's dashboard by except amount/time/card last-4.
+        // array_filter() drops order_id when it's not yet known (still null
+        // in $context at initial pay()/authorize() time — see
+        // rememberIntent()'s own null-coalesce for the same case).
+        $metadata = array_filter([
+            'cart_id' => $context['cart_id'] ?? null,
+            'order_id' => $context['order_id'] ?? null,
+        ]);
+
+        if ($metadata !== []) {
+            $params['metadata'] = $metadata;
+        }
+
         try {
             $paymentIntent = $this->stripe->getClient()->paymentIntents->create($params);
         } catch (ApiErrorException $e) {

src/Payment/Filament/Resources/PaymentMethodResource.php

@@ -60,9 +60,9 @@ class PaymentMethodResource extends Resource
 {
     protected static ?string $model = PaymentMethod::class;
 
-    protected static string|\BackedEnum|null $navigationIcon = 'heroicon-o-credit-card';
+    protected static string | \BackedEnum | null $navigationIcon = 'heroicon-o-credit-card';
 
-    protected static string|\UnitEnum|null $navigationGroup = 'Settings';
+    protected static string | \UnitEnum | null $navigationGroup = 'Settings';
 
     protected static ?string $modelLabel = 'Payment Method';
 

src/Payment/Filament/Resources/PaymentMethodResource/Pages/ListPaymentMethods.php

@@ -2,6 +2,7 @@
 
 namespace Modules\Core\Payment\Filament\Resources\PaymentMethodResource\Pages;
 
+use Filament\Actions\CreateAction;
 use Filament\Actions;
 use Filament\Resources\Pages\ListRecords;
 use Modules\Core\Payment\Filament\Resources\PaymentMethodResource;
@@ -15,7 +16,7 @@ class ListPaymentMethods extends ListRecords
     protected function getHeaderActions(): array
     {
         return [
-            Actions\CreateAction::make()
+            CreateAction::make()
                 ->schema(PaymentMethodResource::getFormComponents())
                 ->fillForm(fn () => [
                     'position' => (PaymentMethod::max('position') ?? 0) + 1,

src/Payment/Privacy/PaymentDataProvider.php

@@ -0,0 +1,108 @@
+<?php
+
+namespace Modules\Core\Payment\Privacy;
+
+use Lunar\Models\Order;
+use Lunar\Models\Transaction;
+use Modules\Core\Payment\Models\StripePaymentIntent;
+use Modules\Core\Privacy\Contracts\PersonalDataProvider;
+use Modules\Core\Privacy\DTOs\CustomerSubject;
+use Modules\Core\Privacy\Enums\ErasureOutcome;
+use Modules\Core\Privacy\DTOs\ProviderErasureResult;
+use Modules\Core\Privacy\DTOs\ProviderExportResult;
+use Modules\Core\Privacy\DTOs\UserSubject;
+
+/**
+ * Payment records (lunar_transactions, stripe_payment_intents) belong to the
+ * Customer (business account) via the Order they're attached to, not to an
+ * individual User, so this is Customer-scope only — same chain
+ * OrderDataProvider already uses (Order.customer_id).
+ *
+ * Like Order itself, payment/transaction records are subject to the same
+ * tax/accounting legal retention argument (GDPR Art. 17(3)(b)) — a payment
+ * record is part of the same financial audit trail as the order it settled,
+ * so this pseudonymizes the card-identifying fields in place rather than
+ * deleting the transaction: amount, status, and the transaction/order link
+ * all remain intact and auditable.
+ *
+ * No Stripe Customer object exists anywhere in this app (see docs/
+ * payments.md "Reconciliation") — there is nothing to request deletion of
+ * on Stripe's side. The only local, erasable PII is the card brand/last-4
+ * on Transaction and the cart_id/order_id/context correlation row on
+ * stripe_payment_intents, which is deleted outright once its Order is
+ * settled (its only purpose was resolving an async webhook callback — see
+ * docs/payments.md "Async resolution" — which has already happened by the
+ * time an erasure request would run).
+ */
+class PaymentDataProvider implements PersonalDataProvider
+{
+    public function name(): string
+    {
+        return 'payments';
+    }
+
+    public function exportForCustomer(CustomerSubject $subject): ProviderExportResult
+    {
+        $orderIds = Order::where('customer_id', $subject->customerId)->pluck('id');
+
+        $transactions = Transaction::whereIn('order_id', $orderIds)->get();
+        $intents = StripePaymentIntent::whereIn('order_id', $orderIds)->get();
+
+        return new ProviderExportResult('payments', [
+            'transactions' => $transactions->map(fn (Transaction $transaction) => [
+                'id' => $transaction->id,
+                'order_id' => $transaction->order_id,
+                'type' => $transaction->type,
+                'status' => $transaction->status,
+                'amount' => $transaction->amount,
+                'card_type' => $transaction->card_type,
+                'last_four' => $transaction->last_four,
+                'reference' => $transaction->reference,
+            ])->all(),
+            'stripe_payment_intents' => $intents->map(fn (StripePaymentIntent $intent) => [
+                'id' => $intent->id,
+                'order_id' => $intent->order_id,
+                'intent_id' => $intent->intent_id,
+                'status' => $intent->status,
+            ])->all(),
+        ]);
+    }
+
+    public function exportForUser(UserSubject $subject): ProviderExportResult
+    {
+        return new ProviderExportResult('payments', []);
+    }
+
+    public function eraseForCustomer(CustomerSubject $subject): ProviderErasureResult
+    {
+        $orderIds = Order::where('customer_id', $subject->customerId)->pluck('id');
+
+        if ($orderIds->isEmpty()) {
+            return new ProviderErasureResult('payments', ErasureOutcome::Skipped, 'No orders, and therefore no payment records, for this customer.');
+        }
+
+        Transaction::whereIn('order_id', $orderIds)->update([
+            'card_type' => null,
+            'last_four' => null,
+        ]);
+
+        // stripe_payment_intents only ever existed to correlate a webhook
+        // callback back to a cart/order (see docs/payments.md "Async
+        // resolution") — that correlation has already served its purpose by
+        // the time an erasure request runs, so these rows are deleted
+        // outright rather than pseudonymized, unlike Transaction, which is
+        // the actual audit-trail record.
+        StripePaymentIntent::whereIn('order_id', $orderIds)->delete();
+
+        return new ProviderErasureResult(
+            'payments',
+            ErasureOutcome::Pseudonymized,
+            'Card brand/last-four cleared from transaction records; amounts, statuses, and references retained for legal/tax record-keeping. Stripe correlation rows (no longer needed post-settlement) deleted.'
+        );
+    }
+
+    public function eraseForUser(UserSubject $subject): ProviderErasureResult
+    {
+        return new ProviderErasureResult('payments', ErasureOutcome::Skipped, 'Payments belong to Customer-owned orders, not individual users.');
+    }
+}

src/Privacy/Contracts/PersonalDataProvider.php

@@ -2,10 +2,10 @@
 
 namespace Modules\Core\Privacy\Contracts;
 
-use Modules\Core\Privacy\CustomerSubject;
+use Modules\Core\Privacy\DTOs\CustomerSubject;
-use Modules\Core\Privacy\ProviderErasureResult;
+use Modules\Core\Privacy\DTOs\ProviderErasureResult;
-use Modules\Core\Privacy\ProviderExportResult;
+use Modules\Core\Privacy\DTOs\ProviderExportResult;
-use Modules\Core\Privacy\UserSubject;
+use Modules\Core\Privacy\DTOs\UserSubject;
 
 /**
  * Implemented by any module that holds personal data and wants it included in

src/Privacy/DTOs/CustomerSubject.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace Modules\Core\Privacy;
+namespace Modules\Core\Privacy\DTOs;
 
 use Lunar\Models\Customer;
 

src/Privacy/DTOs/ErasureReport.php

@@ -1,6 +1,8 @@
 <?php
 
-namespace Modules\Core\Privacy;
+namespace Modules\Core\Privacy\DTOs;
+
+use Modules\Core\Privacy\Enums\ErasureOutcome;
 
 /**
  * Every registered provider's outcome, assembled into one right-of-erasure response

src/Privacy/DTOs/ExportReport.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace Modules\Core\Privacy;
+namespace Modules\Core\Privacy\DTOs;
 
 /**
  * Every registered provider's export, assembled into one right-of-access response.
@@ -25,7 +25,13 @@ class ExportReport
         $data = [];
 
         foreach ($this->results as $result) {
-            $data[$result->provider] = $result->data;
+            // A provider that threw (ProviderExportResult::$error set — see
+            // Modules\Core\Privacy\Jobs\ExportDataSubjectJob::safeExport())
+            // surfaces as an explicit error marker rather than an empty
+            // array indistinguishable from "genuinely nothing to export."
+            $data[$result->provider] = $result->error !== null
+                ? ['error' => $result->error]
+                : $result->data;
         }
 
         return $data;

src/Privacy/DTOs/ProviderErasureResult.php

@@ -1,6 +1,8 @@
 <?php
 
-namespace Modules\Core\Privacy;
+namespace Modules\Core\Privacy\DTOs;
+
+use Modules\Core\Privacy\Enums\ErasureOutcome;
 
 /**
  * One provider's outcome on an erasure request. `reason` is required whenever

src/Privacy/DTOs/ProviderExportResult.php

@@ -1,11 +1,17 @@
 <?php
 
-namespace Modules\Core\Privacy;
+namespace Modules\Core\Privacy\DTOs;
 
 /**
  * One provider's contribution to a right-of-access export. `provider` is a short,
  * stable machine name (e.g. 'customer', 'orders', 'reviews') used as the top-level
  * key when PrivacyService assembles every provider's data into one export payload.
+ *
+ * `error` is set only when the provider threw an exception instead of returning
+ * normally — see Modules\Core\Privacy\Jobs\ExportDataSubjectJob, which catches
+ * per-provider so one provider throwing doesn't discard every other provider's
+ * already-gathered data for the same request. `data` is empty whenever `error` is
+ * set, never a partial/best-effort payload.
  */
 class ProviderExportResult
 {
@@ -15,5 +21,6 @@ class ProviderExportResult
     public function __construct(
         public readonly string $provider,
         public readonly array $data,
+        public readonly ?string $error = null,
     ) {}
 }

src/Privacy/DTOs/UserSubject.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace Modules\Core\Privacy;
+namespace Modules\Core\Privacy\DTOs;
 
 use Illuminate\Contracts\Auth\Authenticatable;
 use Lunar\Base\LunarUser;

src/Privacy/Enums/ErasureOutcome.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace Modules\Core\Privacy\Enums;
+
+/**
+ * What actually happened to a provider's data on an erasure request. Erased/
+ * Pseudonymized/Retained/Skipped are never failures — Retained is a valid, often
+ * legally-required outcome (e.g. an Order kept intact for tax retention), distinct
+ * from a provider erroring out. Failed is the one genuine failure case: a provider
+ * threw an exception instead of returning normally — see Modules\Core\Privacy\
+ * Services\PrivacyService::completeErasure(), which catches per-provider so one
+ * provider throwing doesn't discard every other provider's already-computed
+ * result for the same request.
+ */
+enum ErasureOutcome: string
+{
+    case Erased = 'erased';
+    case Pseudonymized = 'pseudonymized';
+    case Retained = 'retained';
+    case Skipped = 'skipped';
+    case Failed = 'failed';
+}

src/Privacy/Enums/ErasureRequestStatus.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace Modules\Core\Privacy;
+namespace Modules\Core\Privacy\Enums;
 
 enum ErasureRequestStatus: string
 {

src/Privacy/Enums/ExportRequestStatus.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace Modules\Core\Privacy;
+namespace Modules\Core\Privacy\Enums;
 
 enum ExportRequestStatus: string
 {

src/Privacy/ErasureOutcome.php

@@ -1,16 +0,0 @@
-<?php
-
-namespace Modules\Core\Privacy;
-
-/**
- * What actually happened to a provider's data on an erasure request. None of these
- * are failures — Retained is a valid, often legally-required outcome (e.g. an Order
- * kept intact for tax retention), distinct from a provider erroring out.
- */
-enum ErasureOutcome: string
-{
-    case Erased = 'erased';
-    case Pseudonymized = 'pseudonymized';
-    case Retained = 'retained';
-    case Skipped = 'skipped';
-}

src/Privacy/Events/PersonalDataGathered.php

@@ -2,7 +2,7 @@
 
 namespace Modules\Core\Privacy\Events;
 
-use Modules\Core\Privacy\ExportReport;
+use Modules\Core\Privacy\DTOs\ExportReport;
 use Modules\Core\Privacy\Models\DataExportRequest;
 
 /**

src/Privacy/Filament/Extensions/CustomerErasureActionsExtension.php

@@ -8,7 +8,7 @@ use Filament\Notifications\Notification;
 use Lunar\Admin\Support\Extending\BaseExtension;
 use Lunar\Models\Customer;
 use Modules\Core\Auth\Models\Staff;
-use Modules\Core\Privacy\PrivacyService;
+use Modules\Core\Privacy\Services\PrivacyService;
 
 /**
  * Adds "Request erasure" / "Request export" header actions to the Customer
@@ -33,7 +33,7 @@ class CustomerErasureActionsExtension extends BaseExtension
                 ->color('danger')
                 ->requiresConfirmation()
                 ->modalDescription('Opens a cancellable grace-period erasure request for this Customer account. No linked User\'s login is affected.')
-                ->form([
+                ->schema([
                     Checkbox::make('immediate')
                         ->label('Erase immediately (skip the 30-day grace period)')
                         ->helperText('Staff-only, for a formal legal request or regulator inquiry that genuinely requires urgency — not a routine deletion. Runs synchronously, cannot be cancelled once submitted.')

src/Privacy/Filament/Resources/DataErasureRequestResource.php

@@ -2,21 +2,25 @@
 
 namespace Modules\Core\Privacy\Filament\Resources;
 
-use Filament\Forms\Components\KeyValue;
+use Filament\Schemas\Schema;
-use Filament\Forms\Components\Placeholder;
+use Filament\Actions\ViewAction;
-use Filament\Forms\Components\TextInput;
+use Filament\Actions\Action;
-use Filament\Forms\Form;
+use Filament\Infolists\Components\RepeatableEntry;
+use Filament\Infolists\Components\RepeatableEntry\TableColumn;
+use Filament\Infolists\Components\TextEntry;
+use Filament\Schemas\Components\Section;
+use Modules\Core\Privacy\Enums\ErasureOutcome;
+use Modules\Core\Privacy\Filament\Resources\DataErasureRequestResource\Pages\ListDataErasureRequests;
+use Modules\Core\Privacy\Filament\Resources\DataErasureRequestResource\Pages\ViewDataErasureRequest;
 use Filament\Resources\Resource;
-use Filament\Tables\Actions\Action;
-use Filament\Tables\Actions\ViewAction;
 use Filament\Tables\Columns\TextColumn;
 use Filament\Tables\Filters\SelectFilter;
 use Filament\Tables\Table;
 use Lunar\Models\Customer;
-use Modules\Core\Privacy\ErasureRequestStatus;
+use Modules\Core\Privacy\Enums\ErasureRequestStatus;
 use Modules\Core\Privacy\Filament\Resources\DataErasureRequestResource\Pages;
 use Modules\Core\Privacy\Models\DataErasureRequest;
-use Modules\Core\Privacy\PrivacyService;
+use Modules\Core\Privacy\Services\PrivacyService;
 
 /**
  * Read-mostly audit view over data_erasure_requests — staff can see every request
@@ -30,53 +34,114 @@ class DataErasureRequestResource extends Resource
 {
     protected static ?string $model = DataErasureRequest::class;
 
-    protected static ?string $navigationIcon = 'heroicon-o-shield-exclamation';
+    protected static string | \BackedEnum | null $navigationIcon = 'heroicon-o-shield-exclamation';
 
-    protected static ?string $navigationGroup = 'Privacy';
+    protected static string | \UnitEnum | null $navigationGroup = 'Privacy';
 
     protected static ?string $modelLabel = 'Erasure Request';
 
     protected static ?string $pluralModelLabel = 'Erasure Requests';
 
-    public static function form(Form $form): Form
+    /**
+     * A real infolist, not form()'s disabled inputs/Placeholders — ViewRecord
+     * falls back to rendering form() in read-only mode when a resource has no
+     * infolist() at all (Filament\Resources\Pages\ViewRecord::hasInfolist()),
+     * which is what this resource did before: every field rendered as a
+     * plain, unstyled label/value pair with no grouping, badges, or icons.
+     */
+    public static function infolist(Schema $schema): Schema
     {
-        return $form->schema([
+        return $schema->components([
-            Placeholder::make('subject')
+            Section::make('Request')
-                ->label('Subject')
+                ->icon('heroicon-o-shield-exclamation')
-                ->content(fn (DataErasureRequest $record) => sprintf(
+                ->columns(4)
-                    '%s (%s)',
+                ->components([
-                    DataErasureRequest::displayNameFor($record->subject),
+                    TextEntry::make('subject')
-                    $record->isForCustomer() ? 'Customer account' : 'Individual user'
+                        ->label('Subject')
-                )),
+                        ->state(fn (DataErasureRequest $record) => DataErasureRequest::displayNameFor($record->subject))
-            Placeholder::make('requested_by')
+                        ->weight('bold')
-                ->label('Requested by')
+                        ->size('lg'),
-                ->content(fn (DataErasureRequest $record) => DataErasureRequest::displayNameFor($record->requestedBy)),
+                    TextEntry::make('subject_type')
-            TextInput::make('email')
+                        ->label('Scope')
-                ->label('Email (snapshot at request time)')
+                        ->formatStateUsing(fn (DataErasureRequest $record) => $record->isForCustomer() ? 'Customer account' : 'Individual user')
-                ->disabled(),
+                        ->badge()
-            Placeholder::make('status')
+                        ->icon(fn (DataErasureRequest $record) => $record->isForCustomer() ? 'heroicon-o-building-office' : 'heroicon-o-user')
-                ->content(fn (DataErasureRequest $record) => $record->status->value),
+                        ->color(fn (DataErasureRequest $record) => $record->isForCustomer() ? 'info' : 'warning'),
-            Placeholder::make('scheduled_for')
+                    TextEntry::make('email')
-                ->label('Scheduled for')
+                        ->label('Email (snapshot at request time)')
-                ->content(fn (DataErasureRequest $record) => $record->scheduled_for->toDayDateTimeString()),
+                        ->icon('heroicon-o-envelope')
-            Placeholder::make('cancelled_at')
+                        ->copyable(),
-                ->label('Cancelled at')
+                    TextEntry::make('requested_by')
-                ->content(fn (DataErasureRequest $record) => $record->cancelled_at?->toDayDateTimeString() ?? '—'),
+                        ->label('Requested by')
-            Placeholder::make('completed_at')
+                        ->state(fn (DataErasureRequest $record) => DataErasureRequest::displayNameFor($record->requestedBy))
-                ->label('Completed at')
+                        ->icon('heroicon-o-user-circle'),
-                ->content(fn (DataErasureRequest $record) => $record->completed_at?->toDayDateTimeString() ?? '—'),
+                    TextEntry::make('status')
-            Placeholder::make('caused_by')
+                        ->badge()
-                ->label('Caused by (cascade)')
+                        ->formatStateUsing(fn (ErasureRequestStatus $state) => ucfirst($state->value))
-                ->content(fn (DataErasureRequest $record) => $record->causedBy
+                        ->color(fn (ErasureRequestStatus $state) => match ($state) {
-                    ? "Request #{$record->causedBy->id} (".DataErasureRequest::displayNameFor($record->causedBy->subject).')'
+                            ErasureRequestStatus::Pending => 'warning',
-                    : 'Not a cascade — directly requested')
+                            ErasureRequestStatus::Cancelled => 'gray',
-                ->visible(fn (DataErasureRequest $record) => $record->caused_by_request_id !== null),
+                            ErasureRequestStatus::Completed => 'success',
-            KeyValue::make('report')
+                        }),
-                ->label('Per-provider outcome')
+                    TextEntry::make('created_at')
-                ->disabled()
+                        ->label('Requested at')
+                        ->dateTime()
+                        ->icon('heroicon-o-calendar'),
+                    TextEntry::make('scheduled_for')
+                        ->label('Scheduled for')
+                        ->dateTime()
+                        ->icon('heroicon-o-calendar-days'),
+                    TextEntry::make('completed_at')
+                        ->label('Completed at')
+                        ->dateTime()
+                        ->placeholder('—')
+                        ->icon('heroicon-o-check-circle')
+                        ->color(fn (DataErasureRequest $record) => $record->completed_at ? 'success' : 'gray'),
+                    TextEntry::make('cancelled_at')
+                        ->label('Cancelled at')
+                        ->dateTime()
+                        ->placeholder('—')
+                        ->icon('heroicon-o-x-circle')
+                        ->color(fn (DataErasureRequest $record) => $record->cancelled_at ? 'danger' : 'gray')
+                        ->visible(fn (DataErasureRequest $record) => $record->cancelled_at !== null),
+                    TextEntry::make('caused_by')
+                        ->label('Cascade')
+                        ->icon('heroicon-o-arrow-turn-down-right')
+                        ->state(fn (DataErasureRequest $record) => $record->causedBy
+                            ? "From request #{$record->causedBy->id} (".DataErasureRequest::displayNameFor($record->causedBy->subject).')'
+                            : 'Directly requested')
+                        ->color(fn (DataErasureRequest $record) => $record->caused_by_request_id !== null ? 'info' : 'gray'),
+                ]),
+
+            Section::make('Outcome')
+                ->description('What happened to each data category once the erasure ran. "Retained"/"Pseudonymized" usually means the data is kept in an anonymized form for legal or accounting reasons.')
+                ->icon('heroicon-o-document-check')
                 ->visible(fn (DataErasureRequest $record) => $record->report !== null)
-                ->helperText('Each provider\'s outcome once the erasure completed — see docs/privacy.md.'),
+                ->components([
-        ])->columns(2);
+                    RepeatableEntry::make('report')
+                        ->hiddenLabel()
+                        ->table([
+                            TableColumn::make('Data category'),
+                            TableColumn::make('Outcome'),
+                            TableColumn::make('Reason'),
+                        ])
+                        ->components([
+                            TextEntry::make('provider'),
+                            TextEntry::make('outcome')
+                                ->badge()
+                                ->formatStateUsing(fn (string $state) => ucfirst($state))
+                                ->color(fn (string $state) => match ($state) {
+                                    ErasureOutcome::Erased->value => 'success',
+                                    ErasureOutcome::Pseudonymized->value, ErasureOutcome::Retained->value => 'info',
+                                    ErasureOutcome::Skipped->value => 'gray',
+                                    ErasureOutcome::Failed->value => 'danger',
+                                    default => 'gray',
+                                }),
+                            TextEntry::make('reason')
+                                ->placeholder('—'),
+                        ]),
+                ]),
+        ]);
     }
 
     public static function table(Table $table): Table
@@ -139,7 +204,7 @@ class DataErasureRequestResource extends Resource
                         ];
                     }),
             ])
-            ->actions([
+            ->recordActions([
                 ViewAction::make(),
                 Action::make('cancel')
                     ->label('Cancel')
@@ -154,8 +219,8 @@ class DataErasureRequestResource extends Resource
     public static function getPages(): array
     {
         return [
-            'index' => Pages\ListDataErasureRequests::route('/'),
+            'index' => ListDataErasureRequests::route('/'),
-            'view' => Pages\ViewDataErasureRequest::route('/{record}'),
+            'view' => ViewDataErasureRequest::route('/{record}'),
         ];
     }
 

src/Privacy/Filament/Resources/DataExportRequestResource.php

@@ -2,16 +2,18 @@
 
 namespace Modules\Core\Privacy\Filament\Resources;
 
-use Filament\Forms\Components\Placeholder;
+use Filament\Schemas\Schema;
-use Filament\Forms\Components\TextInput;
+use Filament\Actions\ViewAction;
-use Filament\Forms\Form;
+use Filament\Actions\Action;
+use Filament\Infolists\Components\TextEntry;
+use Filament\Schemas\Components\Section;
+use Modules\Core\Privacy\Filament\Resources\DataExportRequestResource\Pages\ListDataExportRequests;
+use Modules\Core\Privacy\Filament\Resources\DataExportRequestResource\Pages\ViewDataExportRequest;
 use Filament\Resources\Resource;
-use Filament\Tables\Actions\Action;
-use Filament\Tables\Actions\ViewAction;
 use Filament\Tables\Columns\TextColumn;
 use Filament\Tables\Filters\SelectFilter;
 use Filament\Tables\Table;
-use Modules\Core\Privacy\ExportRequestStatus;
+use Modules\Core\Privacy\Enums\ExportRequestStatus;
 use Modules\Core\Privacy\Filament\Resources\DataExportRequestResource\Pages;
 use Modules\Core\Privacy\Models\DataErasureRequest;
 use Modules\Core\Privacy\Models\DataExportRequest;
@@ -25,36 +27,85 @@ class DataExportRequestResource extends Resource
 {
     protected static ?string $model = DataExportRequest::class;
 
-    protected static ?string $navigationIcon = 'heroicon-o-arrow-down-tray';
+    protected static string | \BackedEnum | null $navigationIcon = 'heroicon-o-arrow-down-tray';
 
-    protected static ?string $navigationGroup = 'Privacy';
+    protected static string | \UnitEnum | null $navigationGroup = 'Privacy';
 
     protected static ?string $modelLabel = 'Export Request';
 
     protected static ?string $pluralModelLabel = 'Export Requests';
 
-    public static function form(Form $form): Form
+    /**
+     * A real infolist, not form()'s disabled inputs/Placeholders — see
+     * DataErasureRequestResource::infolist()'s own docblock for why.
+     */
+    public static function infolist(Schema $schema): Schema
     {
-        return $form->schema([
+        return $schema->components([
-            Placeholder::make('subject')
+            Section::make('Request')
-                ->label('Subject')
+                ->icon('heroicon-o-arrow-down-tray')
-                ->content(fn (DataExportRequest $record) => sprintf(
+                ->columns(4)
-                    '%s (%s)',
+                ->components([
-                    DataErasureRequest::displayNameFor($record->subject),
+                    TextEntry::make('subject')
-                    $record->isForCustomer() ? 'Customer account' : 'Individual user'
+                        ->label('Subject')
-                )),
+                        ->state(fn (DataExportRequest $record) => DataErasureRequest::displayNameFor($record->subject))
-            TextInput::make('email')
+                        ->weight('bold')
-                ->label('Email (snapshot at request time)')
+                        ->size('lg'),
-                ->disabled(),
+                    TextEntry::make('subject_type')
-            Placeholder::make('status')
+                        ->label('Scope')
-                ->content(fn (DataExportRequest $record) => $record->status->value),
+                        ->formatStateUsing(fn (DataExportRequest $record) => $record->isForCustomer() ? 'Customer account' : 'Individual user')
-            Placeholder::make('completed_at')
+                        ->badge()
-                ->label('Completed at')
+                        ->icon(fn (DataExportRequest $record) => $record->isForCustomer() ? 'heroicon-o-building-office' : 'heroicon-o-user')
-                ->content(fn (DataExportRequest $record) => $record->completed_at?->toDayDateTimeString() ?? '—'),
+                        ->color(fn (DataExportRequest $record) => $record->isForCustomer() ? 'info' : 'warning'),
-            Placeholder::make('file_path')
+                    TextEntry::make('email')
-                ->label('Export file')
+                        ->label('Email (snapshot at request time)')
-                ->content(fn (DataExportRequest $record) => $record->file_path ?? 'Not generated yet'),
+                        ->icon('heroicon-o-envelope')
-        ])->columns(2);
+                        ->copyable(),
+                    TextEntry::make('status')
+                        ->badge()
+                        ->formatStateUsing(fn (ExportRequestStatus $state) => ucfirst($state->value))
+                        ->color(fn (ExportRequestStatus $state) => match ($state) {
+                            ExportRequestStatus::Pending => 'warning',
+                            ExportRequestStatus::Failed => 'danger',
+                            ExportRequestStatus::Completed => 'success',
+                        }),
+                    TextEntry::make('created_at')
+                        ->label('Requested at')
+                        ->dateTime()
+                        ->icon('heroicon-o-calendar'),
+                    TextEntry::make('completed_at')
+                        ->label('Completed at')
+                        ->dateTime()
+                        ->placeholder('Not generated yet')
+                        ->icon('heroicon-o-check-circle')
+                        ->color(fn (DataExportRequest $record) => $record->completed_at ? 'success' : 'gray'),
+                    TextEntry::make('file_path')
+                        ->label('File')
+                        // Just the filename, not the full server path — a raw
+                        // filesystem path (/var/www/.../export_2_....zip) isn't
+                        // actionable for staff and previously rendered as if it
+                        // were a clickable link. The actual download is the
+                        // "Download" header action below (self::downloadAction()),
+                        // shared with the table's row action.
+                        ->state(fn (DataExportRequest $record) => $record->file_path ? basename($record->file_path) : 'Not generated yet')
+                        ->icon('heroicon-o-document')
+                        ->color(fn (DataExportRequest $record) => $record->file_path ? 'success' : 'gray'),
+                ]),
+        ]);
+    }
+
+    /**
+     * Shared by the table's row action and the view page's header action
+     * (ViewDataExportRequest::getHeaderActions()) so "is this downloadable"
+     * and the download itself are defined in exactly one place.
+     */
+    public static function downloadAction(): Action
+    {
+        return Action::make('download')
+            ->label('Download')
+            ->icon('heroicon-o-arrow-down-tray')
+            ->visible(fn (DataExportRequest $record) => $record->status === ExportRequestStatus::Completed && $record->file_path && file_exists($record->file_path))
+            ->action(fn (DataExportRequest $record) => response()->download($record->file_path));
     }
 
     public static function table(Table $table): Table
@@ -100,21 +151,17 @@ class DataExportRequestResource extends Resource
                         ExportRequestStatus::Failed->value => 'Failed',
                     ]),
             ])
-            ->actions([
+            ->recordActions([
                 ViewAction::make(),
-                Action::make('download')
+                self::downloadAction(),
-                    ->label('Download')
-                    ->icon('heroicon-o-arrow-down-tray')
-                    ->visible(fn (DataExportRequest $record) => $record->status === ExportRequestStatus::Completed && $record->file_path && file_exists($record->file_path))
-                    ->action(fn (DataExportRequest $record) => response()->download($record->file_path)),
             ]);
     }
 
     public static function getPages(): array
     {
         return [
-            'index' => Pages\ListDataExportRequests::route('/'),
+            'index' => ListDataExportRequests::route('/'),
-            'view' => Pages\ViewDataExportRequest::route('/{record}'),
+            'view' => ViewDataExportRequest::route('/{record}'),
         ];
     }
 

src/Privacy/Filament/Resources/DataExportRequestResource/Pages/ViewDataExportRequest.php

@@ -8,4 +8,11 @@ use Modules\Core\Privacy\Filament\Resources\DataExportRequestResource;
 class ViewDataExportRequest extends ViewRecord
 {
     protected static string $resource = DataExportRequestResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DataExportRequestResource::downloadAction(),
+        ];
+    }
 }

src/Privacy/Jobs/EraseDataSubjectJob.php

@@ -8,7 +8,7 @@ use Illuminate\Foundation\Bus\Dispatchable;
 use Illuminate\Queue\InteractsWithQueue;
 use Illuminate\Queue\SerializesModels;
 use Modules\Core\Privacy\Models\DataErasureRequest;
-use Modules\Core\Privacy\PrivacyService;
+use Modules\Core\Privacy\Services\PrivacyService;
 
 /**
  * Runs PrivacyService::completeErasure() for one due DataErasureRequest, dispatched

src/Privacy/Jobs/ExportDataSubjectJob.php

@@ -2,19 +2,23 @@
 
 namespace Modules\Core\Privacy\Jobs;
 
+use Throwable;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Foundation\Bus\Dispatchable;
 use Illuminate\Queue\InteractsWithQueue;
 use Illuminate\Queue\SerializesModels;
 use Illuminate\Support\Facades\Event;
-use Modules\Core\Privacy\CustomerSubject;
+use Illuminate\Support\Facades\Log;
+use Modules\Core\Privacy\Contracts\PersonalDataProvider;
+use Modules\Core\Privacy\DTOs\CustomerSubject;
 use Modules\Core\Privacy\Events\PersonalDataGathered;
-use Modules\Core\Privacy\ExportReport;
+use Modules\Core\Privacy\DTOs\ExportReport;
-use Modules\Core\Privacy\ExportRequestStatus;
+use Modules\Core\Privacy\DTOs\ProviderExportResult;
+use Modules\Core\Privacy\Enums\ExportRequestStatus;
 use Modules\Core\Privacy\Models\DataExportRequest;
-use Modules\Core\Privacy\PrivacyManager;
+use Modules\Core\Privacy\Services\PrivacyManager;
-use Modules\Core\Privacy\UserSubject;
+use Modules\Core\Privacy\DTOs\UserSubject;
 
 /**
  * Gathers every registered PersonalDataProvider's export data for one request, all
@@ -26,7 +30,7 @@ use Modules\Core\Privacy\UserSubject;
  * generated PDF), that's the point to reconsider — not before.
  *
  * Calls each provider's *ForCustomer() or *ForUser() method depending on the
- * request's polymorphic subject — see Modules\Core\Privacy\PrivacyService and
+ * request's polymorphic subject — see Modules\Core\Privacy\Services\PrivacyService and
  * docs/privacy.md "User-scope vs Customer-scope".
  *
  * Writing the gathered data to a file is intentionally NOT done here — see
@@ -48,10 +52,16 @@ class ExportDataSubjectJob implements ShouldQueue
     {
         if ($this->request->isForCustomer()) {
             $subject = new CustomerSubject(customerId: $this->request->subject_id);
-            $results = array_map(fn ($provider) => $provider->exportForCustomer($subject), $manager->providers());
+            $results = array_map(
+                fn (PersonalDataProvider $provider) => $this->safeExport($provider, 'exportForCustomer', $subject),
+                $manager->providers()
+            );
         } else {
             $subject = new UserSubject(userId: $this->request->subject_id, email: $this->request->email);
-            $results = array_map(fn ($provider) => $provider->exportForUser($subject), $manager->providers());
+            $results = array_map(
+                fn (PersonalDataProvider $provider) => $this->safeExport($provider, 'exportForUser', $subject),
+                $manager->providers()
+            );
         }
 
         Event::dispatch(new PersonalDataGathered(
@@ -60,8 +70,33 @@ class ExportDataSubjectJob implements ShouldQueue
         ));
     }
 
-    public function failed(\Throwable $exception): void
+    public function failed(Throwable $exception): void
     {
         $this->request->update(['status' => ExportRequestStatus::Failed]);
     }
+
+    /**
+     * Catches per-provider so one provider throwing doesn't discard every
+     * other provider's already-gathered export data for this same request —
+     * without this, the whole array_map aborts, handle() never reaches
+     * Event::dispatch(), and failed() marks the ENTIRE request Failed even
+     * though most providers may have already gathered their data
+     * successfully. Logged via Log::error() so a thrown provider is still
+     * visible to staff, not just an empty/missing section in the export.
+     *
+     * @param  'exportForCustomer'|'exportForUser'  $method
+     */
+    private function safeExport(PersonalDataProvider $provider, string $method, CustomerSubject|UserSubject $subject): ProviderExportResult
+    {
+        try {
+            return $provider->{$method}($subject);
+        } catch (Throwable $e) {
+            Log::error("Privacy provider {$provider->name()}::{$method}() threw during export", [
+                'provider' => $provider->name(),
+                'exception' => $e,
+            ]);
+
+            return new ProviderExportResult($provider->name(), [], $e->getMessage());
+        }
+    }
 }

src/Privacy/Listeners/CancelErasureOnLoginListener.php

@@ -4,9 +4,9 @@ namespace Modules\Core\Privacy\Listeners;
 
 use Illuminate\Contracts\Queue\ShouldQueue;
 use Modules\Core\Auth\Events\UserAuthenticated;
-use Modules\Core\Privacy\ErasureRequestStatus;
+use Modules\Core\Privacy\Enums\ErasureRequestStatus;
 use Modules\Core\Privacy\Models\DataErasureRequest;
-use Modules\Core\Privacy\PrivacyService;
+use Modules\Core\Privacy\Services\PrivacyService;
 
 /**
  * Logging back in during a pending erasure request's grace period IS the "I

src/Privacy/Listeners/CascadeCustomerErasureListener.php

@@ -7,7 +7,7 @@ use Illuminate\Contracts\Queue\ShouldQueue;
 use Lunar\Base\LunarUser;
 use Lunar\Models\Customer;
 use Modules\Core\Privacy\Events\UserErasureRequested;
-use Modules\Core\Privacy\PrivacyService;
+use Modules\Core\Privacy\Services\PrivacyService;
 
 /**
  * When a User's erasure leaves a Customer account with no remaining User at all,

src/Privacy/Listeners/WriteExportToCsvListener.php

@@ -8,7 +8,7 @@ use Modules\Core\Export\CsvColumn;
 use Modules\Core\Export\CsvWriter;
 use Modules\Core\Privacy\Events\PersonalDataExportFileWritten;
 use Modules\Core\Privacy\Events\PersonalDataGathered;
-use Modules\Core\Privacy\ExportRequestStatus;
+use Modules\Core\Privacy\Enums\ExportRequestStatus;
 use ZipArchive;
 
 /**
@@ -19,9 +19,11 @@ use ZipArchive;
  * listener) without touching how the data is gathered.
  *
  * Column schema: every provider's data is either a list of associative arrays
- * (rows directly) or a single associative array (one row) — see the providers in
+ * (rows directly) or a single associative array (one row) — see the providers
- * Modules\Core\Privacy\Providers, all of which return exactly one of those two
+ * registered in config('core.privacy.providers'), each living in its own owning
- * shapes. Any nested array value within a row (e.g. an order's `addresses`) is
+ * module's Privacy/ subdirectory (e.g. Modules\Core\Order\Privacy\
+ * OrderDataProvider), all of which return exactly one of those two shapes. Any
+ * nested array value within a row (e.g. an order's `addresses`) is
  * JSON-encoded into that one cell rather than exploded into further columns —
  * CsvWriter's generic stringify() behavior, not special-cased here.
  */

src/Privacy/Models/DataErasureRequest.php

@@ -7,12 +7,12 @@ use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Database\Eloquent\Relations\MorphTo;
 use Lunar\Models\Customer;
-use Modules\Core\Privacy\ErasureRequestStatus;
+use Modules\Core\Privacy\Enums\ErasureRequestStatus;
 
 /**
  * A pending, cancelled, or completed right-of-erasure request — the grace-period
  * record between "subject/staff asked for this" and "providers actually erased
- * their data" (see Modules\Core\Privacy\PrivacyService, which creates/processes
+ * their data" (see Modules\Core\Privacy\Services\PrivacyService, which creates/processes
  * these).
  *
  * `subject` is polymorphic — either a Lunar Customer (business account) or a User

src/Privacy/Models/DataExportRequest.php

@@ -5,7 +5,7 @@ namespace Modules\Core\Privacy\Models;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\MorphTo;
 use Lunar\Models\Customer;
-use Modules\Core\Privacy\ExportRequestStatus;
+use Modules\Core\Privacy\Enums\ExportRequestStatus;
 
 /**
  * A right-of-access export request. Created synchronously (fast — one insert), then

src/Privacy/Providers/CartDataProvider.php

@@ -1,62 +0,0 @@
-<?php
-
-namespace Modules\Core\Privacy\Providers;
-
-use Lunar\Models\Cart;
-use Lunar\Models\CartAddress;
-use Modules\Core\Privacy\Contracts\PersonalDataProvider;
-use Modules\Core\Privacy\CustomerSubject;
-use Modules\Core\Privacy\ErasureOutcome;
-use Modules\Core\Privacy\ProviderErasureResult;
-use Modules\Core\Privacy\ProviderExportResult;
-use Modules\Core\Privacy\UserSubject;
-
-/**
- * Carts and cart addresses (lunar_carts, lunar_cart_addresses) belong to the
- * Customer (business account) via customer_id, not to an individual User, so this
- * is Customer-scope only. Unlike Order/OrderAddress, an abandoned cart has no
- * legal retention requirement, so its addresses are freely deleted. The Cart row
- * itself is left alone (any completed order it produced is handled separately by
- * OrderDataProvider, which is what retention law actually cares about) — only its
- * address PII is removed.
- */
-class CartDataProvider implements PersonalDataProvider
-{
-    public function name(): string
-    {
-        return 'carts';
-    }
-
-    public function exportForCustomer(CustomerSubject $subject): ProviderExportResult
-    {
-        $addresses = CartAddress::whereIn('cart_id', Cart::where('customer_id', $subject->customerId)->pluck('id'))->get();
-
-        return new ProviderExportResult('carts', $addresses->map(fn (CartAddress $address) => [
-            'type' => $address->type,
-            'first_name' => $address->first_name,
-            'last_name' => $address->last_name,
-            'line_one' => $address->line_one,
-            'city' => $address->city,
-            'postcode' => $address->postcode,
-            'contact_email' => $address->contact_email,
-            'contact_phone' => $address->contact_phone,
-        ])->all());
-    }
-
-    public function exportForUser(UserSubject $subject): ProviderExportResult
-    {
-        return new ProviderExportResult('carts', []);
-    }
-
-    public function eraseForCustomer(CustomerSubject $subject): ProviderErasureResult
-    {
-        CartAddress::whereIn('cart_id', Cart::where('customer_id', $subject->customerId)->pluck('id'))->delete();
-
-        return new ProviderErasureResult('carts', ErasureOutcome::Erased);
-    }
-
-    public function eraseForUser(UserSubject $subject): ProviderErasureResult
-    {
-        return new ProviderErasureResult('carts', ErasureOutcome::Skipped, 'Carts belong to Customer accounts, not individual users.');
-    }
-}

src/Privacy/Providers/OrderDataProvider.php

@@ -1,97 +0,0 @@
-<?php
-
-namespace Modules\Core\Privacy\Providers;
-
-use Lunar\Models\Order;
-use Lunar\Models\OrderAddress;
-use Modules\Core\Privacy\Contracts\PersonalDataProvider;
-use Modules\Core\Privacy\CustomerSubject;
-use Modules\Core\Privacy\ErasureOutcome;
-use Modules\Core\Privacy\ProviderErasureResult;
-use Modules\Core\Privacy\ProviderExportResult;
-use Modules\Core\Privacy\UserSubject;
-
-/**
- * Orders and order addresses (lunar_orders, lunar_order_addresses) belong to the
- * Customer (business account) via customer_id, not to an individual User, so this
- * is Customer-scope only. They're also subject to legal retention (tax/accounting
- * law generally requires invoices be kept for several years — GDPR Art. 17(3)(b)
- * explicitly allows this to override an erasure request). eraseForCustomer()
- * therefore pseudonymizes the PII-bearing free-text fields in place rather than
- * deleting the order: totals, line items, tax data, and the order itself all
- * remain intact and auditable.
- */
-class OrderDataProvider implements PersonalDataProvider
-{
-    public function name(): string
-    {
-        return 'orders';
-    }
-
-    public function exportForCustomer(CustomerSubject $subject): ProviderExportResult
-    {
-        $orders = Order::where('customer_id', $subject->customerId)->with('addresses')->get();
-
-        return new ProviderExportResult('orders', $orders->map(fn (Order $order) => [
-            'id' => $order->id,
-            'reference' => $order->reference,
-            'status' => $order->status,
-            'total' => $order->total?->decimal(),
-            'placed_at' => $order->placed_at?->toIso8601String(),
-            'addresses' => $order->addresses->map(fn (OrderAddress $address) => [
-                'type' => $address->type,
-                'first_name' => $address->first_name,
-                'last_name' => $address->last_name,
-                'line_one' => $address->line_one,
-                'city' => $address->city,
-                'postcode' => $address->postcode,
-                'contact_email' => $address->contact_email,
-                'contact_phone' => $address->contact_phone,
-            ])->all(),
-        ])->all());
-    }
-
-    public function exportForUser(UserSubject $subject): ProviderExportResult
-    {
-        return new ProviderExportResult('orders', []);
-    }
-
-    public function eraseForCustomer(CustomerSubject $subject): ProviderErasureResult
-    {
-        $orderIds = Order::where('customer_id', $subject->customerId)->pluck('id');
-
-        if ($orderIds->isEmpty()) {
-            return new ProviderErasureResult('orders', ErasureOutcome::Skipped, 'No orders for this customer.');
-        }
-
-        Order::whereIn('id', $orderIds)->update([
-            'customer_reference' => null,
-            'notes' => null,
-        ]);
-
-        OrderAddress::whereIn('order_id', $orderIds)->update([
-            'title' => null,
-            'first_name' => 'Erased',
-            'last_name' => 'Customer',
-            'company_name' => null,
-            'tax_identifier' => null,
-            'line_one' => null,
-            'line_two' => null,
-            'line_three' => null,
-            'delivery_instructions' => null,
-            'contact_email' => null,
-            'contact_phone' => null,
-        ]);
-
-        return new ProviderErasureResult(
-            'orders',
-            ErasureOutcome::Pseudonymized,
-            'Order and address free-text fields cleared; order records, totals, and line items retained for legal/tax record-keeping.'
-        );
-    }
-
-    public function eraseForUser(UserSubject $subject): ProviderErasureResult
-    {
-        return new ProviderErasureResult('orders', ErasureOutcome::Skipped, 'Orders belong to Customer accounts, not individual users.');
-    }
-}

src/Privacy/RelationManagers/ErasureRequestsRelationManager.php

@@ -2,16 +2,16 @@
 
 namespace Modules\Core\Privacy\RelationManagers;
 
+use Filament\Actions\ViewAction;
+use Filament\Actions\Action;
 use Filament\Resources\RelationManagers\RelationManager;
-use Filament\Tables\Actions\Action;
-use Filament\Tables\Actions\ViewAction;
 use Filament\Tables\Columns\TextColumn;
 use Filament\Tables\Filters\SelectFilter;
 use Filament\Tables\Table;
-use Modules\Core\Privacy\ErasureRequestStatus;
+use Modules\Core\Privacy\Enums\ErasureRequestStatus;
 use Modules\Core\Privacy\Filament\Resources\DataErasureRequestResource;
 use Modules\Core\Privacy\Models\DataErasureRequest;
-use Modules\Core\Privacy\PrivacyService;
+use Modules\Core\Privacy\Services\PrivacyService;
 
 /**
  * Lists erasure requests where the record being viewed (Customer or User) is the
@@ -65,7 +65,7 @@ class ErasureRequestsRelationManager extends RelationManager
                     ]),
             ])
             ->headerActions([])
-            ->actions([
+            ->recordActions([
                 ViewAction::make()
                     ->url(fn (DataErasureRequest $record) => DataErasureRequestResource::getUrl('view', ['record' => $record])),
                 Action::make('cancel')

src/Privacy/RelationManagers/ExportRequestsRelationManager.php

@@ -2,13 +2,13 @@
 
 namespace Modules\Core\Privacy\RelationManagers;
 
+use Filament\Actions\ViewAction;
+use Filament\Actions\Action;
 use Filament\Resources\RelationManagers\RelationManager;
-use Filament\Tables\Actions\Action;
-use Filament\Tables\Actions\ViewAction;
 use Filament\Tables\Columns\TextColumn;
 use Filament\Tables\Filters\SelectFilter;
 use Filament\Tables\Table;
-use Modules\Core\Privacy\ExportRequestStatus;
+use Modules\Core\Privacy\Enums\ExportRequestStatus;
 use Modules\Core\Privacy\Filament\Resources\DataExportRequestResource;
 use Modules\Core\Privacy\Models\DataExportRequest;
 
@@ -56,7 +56,7 @@ class ExportRequestsRelationManager extends RelationManager
                     ]),
             ])
             ->headerActions([])
-            ->actions([
+            ->recordActions([
                 ViewAction::make()
                     ->url(fn (DataExportRequest $record) => DataExportRequestResource::getUrl('view', ['record' => $record])),
                 Action::make('download')

src/Privacy/RelationManagers/UserRelationManager.php

@@ -2,16 +2,16 @@
 
 namespace Modules\Core\Privacy\RelationManagers;
 
+use Filament\Actions\Action;
 use Filament\Forms\Components\Checkbox;
 use Filament\Infolists\Components\RepeatableEntry;
 use Filament\Infolists\Components\TextEntry;
 use Filament\Notifications\Notification;
-use Filament\Tables\Actions\Action;
 use Filament\Tables\Table;
 use Illuminate\Database\Eloquent\Model;
 use Modules\Core\Customer\RelationManagers\UserRelationManager as CoreUserRelationManager;
 use Modules\Core\Privacy\Models\DataErasureRequest;
-use Modules\Core\Privacy\PrivacyService;
+use Modules\Core\Privacy\Services\PrivacyService;
 
 /**
  * Extends core's own Customer -> User relation manager to add:
@@ -31,7 +31,7 @@ class UserRelationManager extends CoreUserRelationManager
     {
         $table = parent::getDefaultTable($table);
 
-        return $table->actions([
+        return $table->recordActions([
             ...$table->getActions(),
             Action::make('privacyRequests')
                 ->label('Privacy Requests')
@@ -39,14 +39,14 @@ class UserRelationManager extends CoreUserRelationManager
                 ->modalHeading(fn (Model $record) => "Privacy requests for {$record->name}")
                 ->modalSubmitAction(false)
                 ->modalCancelActionLabel('Close')
-                ->infolist(fn (Model $record) => $this->requestsInfolist($record)),
+                ->schema(fn (Model $record) => $this->requestsInfolist($record)),
             Action::make('requestErasure')
                 ->label('Request Erasure')
                 ->icon('heroicon-o-shield-exclamation')
                 ->color('danger')
                 ->requiresConfirmation()
                 ->modalDescription('Opens a cancellable grace-period erasure request for this individual — deactivates their login and detaches them from every linked Customer account once it completes. No Customer account\'s own data is affected.')
-                ->form([
+                ->schema([
                     Checkbox::make('immediate')
                         ->label('Erase immediately (skip the 30-day grace period)')
                         ->helperText('Staff-only, for a formal legal request or regulator inquiry that genuinely requires urgency — not a routine deletion. Runs synchronously, cannot be cancelled once submitted.')

src/Privacy/Services/PrivacyManager.php

@@ -1,7 +1,8 @@
 <?php
 
-namespace Modules\Core\Privacy;
+namespace Modules\Core\Privacy\Services;
 
+use LogicException;
 use Illuminate\Contracts\Container\Container;
 use Modules\Core\Privacy\Contracts\PersonalDataProvider;
 
@@ -41,7 +42,7 @@ class PrivacyManager
         $duplicates = array_diff_assoc($names, array_unique($names));
 
         if ($duplicates !== []) {
-            throw new \LogicException(
+            throw new LogicException(
                 'Duplicate Modules\Core\Privacy provider name(s): '.implode(', ', array_unique($duplicates))
                 .'. Each provider registered in config(\'core.privacy.providers\') must return a unique name().'
             );

src/Privacy/Services/PrivacyService.php

@@ -1,17 +1,27 @@
 <?php
 
-namespace Modules\Core\Privacy;
+namespace Modules\Core\Privacy\Services;
 
 use Illuminate\Contracts\Auth\Authenticatable;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Log;
 use Lunar\Base\LunarUser;
 use Lunar\Models\Customer;
 use Modules\Core\Auth\Models\Staff;
+use Modules\Core\Privacy\Contracts\PersonalDataProvider;
+use Modules\Core\Privacy\DTOs\CustomerSubject;
+use Modules\Core\Privacy\DTOs\ErasureReport;
+use Modules\Core\Privacy\DTOs\ProviderErasureResult;
+use Modules\Core\Privacy\DTOs\UserSubject;
+use Modules\Core\Privacy\Enums\ErasureOutcome;
+use Modules\Core\Privacy\Enums\ErasureRequestStatus;
+use Modules\Core\Privacy\Enums\ExportRequestStatus;
 use Modules\Core\Privacy\Events\UserErasureRequested;
 use Modules\Core\Privacy\Jobs\ExportDataSubjectJob;
 use Modules\Core\Privacy\Models\DataErasureRequest;
 use Modules\Core\Privacy\Models\DataExportRequest;
+use Throwable;
 
 /**
  * Entry point for right-of-access and right-of-erasure requests, split into two
@@ -238,15 +248,30 @@ class PrivacyService
      * called directly for a request that hasn't passed its grace period, since
      * that defeats the point of the window; ProcessErasureRequestsCommand
      * enforces isDue() before calling this.
+     *
+     * Each provider call is caught individually — a provider throwing (a bug,
+     * an unexpected DB state) converts to ErasureOutcome::Failed rather than
+     * aborting the whole array_map, so one broken provider never discards
+     * every OTHER provider's already-completed erasure for this same request.
+     * Without this, the $request->update() below would never run at all on a
+     * throw, silently leaving providers that already succeeded unrecorded and
+     * the request stuck Pending forever. Logged via Log::error() so a thrown
+     * provider is still visible to staff, not just swallowed into "Failed."
      */
     public function completeErasure(DataErasureRequest $request): ErasureReport
     {
         if ($request->isForCustomer()) {
             $subject = new CustomerSubject(customerId: $request->subject_id);
-            $results = array_map(fn ($provider) => $provider->eraseForCustomer($subject), $this->manager->providers());
+            $results = array_map(
+                fn (PersonalDataProvider $provider) => $this->safeErase($provider, 'eraseForCustomer', $subject),
+                $this->manager->providers()
+            );
         } else {
             $subject = new UserSubject(userId: $request->subject_id, email: $request->email);
-            $results = array_map(fn ($provider) => $provider->eraseForUser($subject), $this->manager->providers());
+            $results = array_map(
+                fn (PersonalDataProvider $provider) => $this->safeErase($provider, 'eraseForUser', $subject),
+                $this->manager->providers()
+            );
         }
 
         $report = new ErasureReport($subject, $results);
@@ -276,4 +301,21 @@ class PrivacyService
             'deactivated_at' => $deactivated ? now() : null,
         ]);
     }
+
+    /**
+     * @param  'eraseForCustomer'|'eraseForUser'  $method
+     */
+    private function safeErase(PersonalDataProvider $provider, string $method, CustomerSubject|UserSubject $subject): ProviderErasureResult
+    {
+        try {
+            return $provider->{$method}($subject);
+        } catch (Throwable $e) {
+            Log::error("Privacy provider {$provider->name()}::{$method}() threw during erasure", [
+                'provider' => $provider->name(),
+                'exception' => $e,
+            ]);
+
+            return new ProviderErasureResult($provider->name(), ErasureOutcome::Failed, $e->getMessage());
+        }
+    }
 }

src/Review/Privacy/ReviewDataProvider.php

@@ -1,14 +1,14 @@
 <?php
 
-namespace Modules\Core\Privacy\Providers;
+namespace Modules\Core\Review\Privacy;
 
 use Illuminate\Database\Eloquent\Builder;
 use Modules\Core\Privacy\Contracts\PersonalDataProvider;
-use Modules\Core\Privacy\CustomerSubject;
+use Modules\Core\Privacy\DTOs\CustomerSubject;
-use Modules\Core\Privacy\ErasureOutcome;
+use Modules\Core\Privacy\Enums\ErasureOutcome;
-use Modules\Core\Privacy\ProviderErasureResult;
+use Modules\Core\Privacy\DTOs\ProviderErasureResult;
-use Modules\Core\Privacy\ProviderExportResult;
+use Modules\Core\Privacy\DTOs\ProviderExportResult;
-use Modules\Core\Privacy\UserSubject;
+use Modules\Core\Privacy\DTOs\UserSubject;
 use Modules\Core\Review\Models\ProductReview;
 
 /**

src/Shipping/Extensions/ShippingMethodResourceExtension.php

@@ -47,7 +47,7 @@ class ShippingMethodResourceExtension extends ResourceExtension
             }
 
             if (in_array(HasChildComponents::class, class_uses_recursive($component), true)) {
-                $component->schema($this->replaceNameField($component->getChildComponents()));
+                $component->schema($this->replaceNameField($component->getDefaultChildComponents()));
             }
 
             return $component;
@@ -158,7 +158,7 @@ class ShippingMethodResourceExtension extends ResourceExtension
 
             if (in_array(HasChildComponents::class, class_uses_recursive($component), true)) {
                 $component->schema(
-                    $this->replaceChargeByField($component->getChildComponents())
+                    $this->replaceChargeByField($component->getDefaultChildComponents())
                 );
             }
 
@@ -269,7 +269,7 @@ class ShippingMethodResourceExtension extends ResourceExtension
 
             if (in_array(HasChildComponents::class, class_uses_recursive($component), true)) {
                 $component->schema(
-                    $this->replaceDriverField($component->getChildComponents())
+                    $this->replaceDriverField($component->getDefaultChildComponents())
                 );
             }