A feature-by-feature pass across GDPR/CCPA compliance tooling used by Shopify,
WooCommerce, and dedicated consent-management platforms — sourced, not recalled
from memory — checked against master and the substantial,
unmerged Privacy branch ("Feature: Creating Privacy
Basics") already built in this repo. For deciding what to finish and merge
next, not a build order.
Privacy
branch (53 files, +3127/‑24 across two commits: 9f540cb,
59303cf) but not on master — treated as partial, not
have, until it merges. boboko:anonymize is the one privacy-adjacent
command that already lives on master today.
GDPR Art. 15 (access) and Art. 17 (erasure) — the two rights every DSAR tool is built around.
Privacy branch only: PrivacyService::requestExportForCustomer()/requestExportForUser() queue ExportDataSubjectJob, which gathers every registered provider's data and writes a CSV-per-provider zip via WriteExportToCsvListener. Not on master.Privacy branch only: PrivacyService::requestErasureForCustomer()/requestErasureForUser(), extensible via config('core.privacy.providers') — the same config-array-registration pattern as NotificationRegistry, keyed off Modules\Core\Privacy\Contracts\PersonalDataProvider.Privacy branch only: 30-day default (core.privacy.grace_period_days), reverted automatically on login via CancelErasureOnLoginListener — same pattern Shopify's own account-deletion flow uses. No native platform documents this as a first-party primitive; it's usually left to a third-party app.Privacy branch only: requestImmediateErasureForCustomer()/ForUser(), typed to accept only Staff $requestedBy so a self-service path cannot reach it even by accident.Privacy branch only, and a genuinely uncommon feature: PrivacyService splits every operation into Customer-scope vs. User-scope, plus a sole-owner cascade (CascadeCustomerErasureListener) when erasing the last linked User orphans a Customer. No researched competitor product handles B2B multi-seat erasure this explicitly.master: src/Command/AnonymizeCommand.php (boboko:anonymize) — scrubs users/lunar_customers, environment-guarded to local only. Distinct from GDPR erasure; the Privacy branch README diff explicitly flags this is not the compliance tool.Deletion isn't the only lawful outcome — these are three different operations, often confused with each other.
Privacy branch only: OrderDataProvider::eraseForCustomer() clears PII fields but keeps order rows/totals/tax data intact, citing GDPR Art. 17(3)(b)'s legal-obligation exception — reports ErasureOutcome::Pseudonymized, not Erased, distinctly.Privacy branch only: PersonalDataProvider deliberately has no central taxonomy — each provider (CustomerDataProvider, AddressDataProvider, OrderDataProvider, CartDataProvider, ReviewDataProvider) decides erase vs. pseudonymize vs. skip for its own table. docs/privacy.md flags ReviewDataProvider's scope choice as needing review before relying on it.Privacy branch is triggered by an explicit request, not a retention-policy timer (e.g. "delete guest carts after 2 years," "purge OTP logs after 90 days").Privacy branch only: DataErasureRequest.report stores the full per-provider outcome as a snapshot (not a live lookup), specifically so the audit record stays readable after the underlying data is gone.What a visitor is asked before tracking starts, and whether that choice is recorded anywhere.
Customer Privacy API recognizing four consent signals (analytics, marketing, preferences, sale-of-data); WooCommerce relies entirely on third-party plugins for this.Modules\Core — no consent flag found on the Customer/User models on either branch.Privacy branch's audit trail covers erasure/export requests only, not consent events.Terms of service and privacy policy as tracked, versioned documents — not just static pages.
Modules\Core. Researched as a standard requirement for surviving a legal dispute or regulatory inquiry.Whether cardholder data ever actually reaches boboko's own infrastructure.
docs/lunar.md "Stripe integration" — payment flows through Lunar's Stripe driver (Lunar\Stripe\Facades\Stripe, fetchOrCreateIntent()/PaymentIntents), so PAN never lands in a boboko/Lunar database. Researched: this pattern alone can cut PCI-DSS scope by roughly 90% per industry sources.docs/ documents or asserts SAQ-A eligibility for a consuming app's own compliance paperwork.Beyond GDPR — the other regimes a storefront selling outside the EU may need.
What happens when something goes wrong, or when a third party is handling data on the shop's behalf.
docs/lunar.md, but nothing formally tracks or discloses it as a subprocessor.