For AI agents: llms.txt is a short guide that sends you to the rules your problem needs, and rules.json holds every rule of this playbook as JSON.

Risk if broken

A law broken

Applies when

The project it uses AI models.

How to do it

Add each AI store to the map from Map every store that holds personal data. Store the owner's account ID on every chunk, cached answer, memory item and trace row, so one query finds them. Providers keep data too. The OpenAI Responses API stores each response for at least 30 days unless the request sets store to false. Uploaded files, vector stores and conversations stay with a provider until you delete them through its API. Turn off provider storage a feature does not need, and record the provider's IDs for what it keeps. Call these deletes from the one delete function in let people see and delete their data.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

TypeScript example

export async function eraseFromAiStores(accountId: string) {
  await db.query('DELETE FROM chunks WHERE owner_id = $1', [accountId]);
  await db.query('DELETE FROM ai_call_text WHERE account_id = $1', [accountId]);
  await db.query('DELETE FROM agent_memory WHERE account_id = $1', [accountId]);
  await answerCache.deleteByTag(`account:${accountId}`);
  const { rows } = await db.query('SELECT provider_file_id FROM provider_files WHERE account_id = $1', [accountId]);
  for (const { provider_file_id } of rows) await openai.files.delete(provider_file_id);
  await db.query('DELETE FROM provider_files WHERE account_id = $1', [accountId]);
}

Python example

def erase_from_ai_stores(account_id: str) -> None:
    for table, column in [("chunks", "owner_id"), ("ai_call_text", "account_id"), ("agent_memory", "account_id")]:
        db.execute(f"DELETE FROM {table} WHERE {column} = %s", (account_id,))
    answer_cache.delete_by_tag(f"account:{account_id}")
    for (file_id,) in db.execute("SELECT provider_file_id FROM provider_files WHERE account_id = %s", (account_id,)):
        openai_client.files.delete(file_id)
    db.execute("DELETE FROM provider_files WHERE account_id = %s", (account_id,))

How to check

Create a test person, use every AI feature as them, then delete them. A search of each AI store and a list call to each provider store find no row or file with their ID. A search of the code finds no Responses API call without an explicit store value.

Sources

• GDPR Article 17 on the right to erasure

Related rules

• Map every store that holds personal data in Compliance
• Let people see and delete their data in Website