How to export your VZLyze data (GDPR right to portability)

Most Chrome extensions ask for an account, then treat your data as theirs. You can log in. You can log out. If you want to leave and take everything you've generated somewhere else, the answer is usually a support email and a wait of unknown length.

Vzlyze does it differently, because the law says we have to and because we agree with the law. There are two buttons in your account settings, and between them they satisfy the two most important rights the GDPR gives you: the right to take your data with you, and the right to be forgotten. This article walks through both, shows you exactly what the export contains, and answers the question we get every time we tell someone about it: why isn't it a PDF?

The right to portability, in one paragraph

GDPR Article 20 says that if you gave a service data, you can ask for it back in "a structured, commonly used and machine-readable format." The wording is deliberate. It's not about being able to see your data (that's Article 15, the right of access). Article 20 is about being able to move your data. Take it to a competitor, feed it into your own tool, keep an archive on your machine. That's why the format matters: the whole point is that another program should be able to read the file, not just you.

Where the button is

What's in the file

Open the download in any text editor (Notepad, VS Code, TextEdit, whatever you have) and you'll see three top-level sections: your account, every share link you've ever created, and every purchase you've ever made. Fields are named plainly so you don't need a schema doc to make sense of them:

// vzlyze-export-<your-id>.json (abridged)
{
  "exportedAt": "2026-07-02T14:31:07.482Z",
  "account": {
    "id":               "…",
    "username":         "amina.k",
    "email":            "[email protected]",
    "plan":             "pro",
    "quickCredits":     42,
    "deepCredits":      17,
    "emailVerified":    true,
    "googleLinked":     false,
    "paddleCustomerId": "ctm_…",
    "createdAt":        "2026-04-11T09:12:44.000Z"
  },
  "shares": [
    {
      "shareId":      "a1b2c3",
      "summary":      "Pricing page from acme.com…",
      "mode":         "deep",
      "viewCount":    3,
      "maxViews":     50,
      "expiresAt":    "2026-07-09T…",
      "imageDataUrl": "data:image/png;base64,…"
    }
  ],
  "orders": [
    {
      "paddleTransactionId": "txn_…",
      "packId":              "pro",
      "quickGranted":        0,
      "deepGranted":         99,
      "refunded":            false,
      "purchasedAt":         "2026-04-11T09:13:02.000Z"
    }
  ]
}

One small detail is worth pointing out. Each entry in shares includes an imageDataUrl: the base64-encoded PNG of the screenshot, embedded inline. A lot of services strip binaries out of their exports to save bandwidth. That arguably violates the spirit of Article 20, because the image is the personal data. We include it. If you ever want to walk away, you're walking away with the pictures too.

Why JSON, and not a PDF?

A PDF looks more official. It's the format most people expect for a "here's your document" moment. So it's a fair question: why does Vzlyze hand you a JSON file instead?

The short version is that a PDF wouldn't satisfy Article 20. The regulation asks specifically for "structured, commonly used and machine-readable format" and the European Data Protection Board's guidance calls out JSON, XML, and CSV as compliant. PDF is a presentation format. It's designed to describe how ink sits on a page, not to let another program parse and reuse the data. A PDF export would look nice, tick zero of the boxes that matter, and quietly break the promise the export is meant to keep.

The practical case reinforces the legal one. Each share carries an embedded screenshot. Bake those into a PDF and every export becomes tens of megabytes of pretty-printed images that can't be opened in anything except a PDF reader. As JSON, the same data is a text file you can grep, script, or feed into another tool.

The other button: delete everything

Portability's cousin is Article 17: the right to erasure, or as it's more commonly called, the right to be forgotten. The Data & account section has a Delete my account button right next to Export. Clicking it asks for your password (skipped for Google-only accounts), then runs a cascade deletion across four collections in a single database write:

• Your user record: profile, credits, plan, email hash, everything.
• Every share link you've ever created, including the underlying image data.
• Every order record for purchases made through Vzlyze.
• Any pending checkout tokens that hadn't yet resolved into an order.

No confirmation email. No 30-day grace period during which support could restore your account if you changed your mind. The moment the button returns success, the records are gone from our production database.

What we keep after deletion, and why

To be honest with you, deletion isn't total, and it can't be. Two things survive on purpose, and both exist to protect either you or the integrity of the payment system:

Webhook replay-defence table. Payment providers (in our case, Paddle) can deliver the same webhook more than once, which is normal behaviour when the network hiccups. We keep a small table of processed event IDs so that a re-delivered webhook doesn't accidentally re-grant credits or re-issue a refund. That table is keyed by the event ID, not by your user ID, and after your account is deleted it contains no data that identifies you. It's an integrity ledger, not a personal record.

Tax and payment records held by Paddle. Paddle is our merchant of record. When you buy a credit pack, they collect the money, remit the tax to the correct jurisdiction, and issue you an invoice. Under EU tax law they're required to keep those records for up to ten years. Vzlyze can delete you from our side entirely, but we can't reach into Paddle's ledgers and delete a legally-mandated invoice. If you want to exercise your rights against Paddle directly, their privacy contact is on paddle.com/legal/privacy.

Everything else is gone the moment you click the button.

How the two rights fit together

In practice, most people use them in sequence. Export first, so you have a copy of whatever you built up. Then delete, if that's what you want. Nothing about the export is contingent on staying. You can download your JSON file, hit delete thirty seconds later, and still have every share, every summary, and every screenshot on your own hard drive.

That's how it should work. Your data is yours. The extension is a tool you rent, not a vault we own.