Cycling through all six. Tap any point to stop.

Measured on six things

DSAR management software for small teams.

Growth

Real, recurring problem with a specific segment (startups with no privacy officer) and a clear wedge: unlimited DSARs on Free vs. enterprise suites. Paid tiers not yet live limit near-term upside.

Screenshots

1 / 1

Privacy Requests

About this app

Privacy Requests is a DSAR management platform built for startups and growing teams without a dedicated privacy department. As request volume grows, shared inboxes break down — details scatter, ownership gets fuzzy, deadlines slip, and audit trails disappear. Privacy Requests centralizes the entire workflow in one calm, accountable workspace: hosted intake forms, identity verification, deadline tracking, task assignment, approval steps, and secure file delivery via expiring links — all built to support GDPR and CCPA/CPRA compliance. Free tier available with unlimited DSARs, 2 team members, and 1 portal.

Key features

1Hosted DSAR intake portal with unlimited requests on the free tier.
2Guided workflow: receive, verify identity, assign tasks, review, deliver, retain audit trail.
3Secure delivery via expiring, revocable links with passcodes and access logs.
4Deadline tracking, priority queues, saved views, and escalation reminders.
5Role-based access, two-factor authentication, and encrypted-at-rest storage.

Target customer profile

Drawn from the product itself, not from a survey.

Demographic

Startups without a dedicated privacy officer

Pain points

Lack of a structured process for handling data subject requests; risk of non-compliance with GDPR/CCPA; limited resources and budget.

Primary needs

Affordable, easy-to-implement DSAR solution with core workflow features and unlimited requests.

Demographic

Operations teams in growing companies

Pain points

Requests scattered across shared inboxes; unclear ownership and deadlines; inefficient collaboration on responses.

Primary needs

Centralized case management with clear assignment, deadline tracking, and audit trail.

Demographic

Compliance and legal teams in mid-sized businesses

Pain points

Complexity of managing multiple request types; need for secure delivery and evidence of compliance; coordination with other departments.

Primary needs

Robust workflow with role-based access, secure delivery, and detailed reporting for audits.

Scout Review

Written by AI from measured evidence, scored out of 100.

Privacy Requests is a DSAR management tool for teams that handle data subject requests without a privacy department. It centralizes intake, identity verification, deadline tracking, task assignment, approval, and secure delivery into one workspace, with an audit trail built as the work happens. The free tier is the headline: unlimited DSARs, two members, one portal, and the full core workflow, which is more than most competitors give away. The site is fast (Lighthouse 100/100 both platforms), the security posture is reasonable (HTTPS, HSTS, most headers, 2FA, encrypted at rest), and the guides section is genuinely useful. The weaknesses are commercial and evidentiary: Team and Business are planned but not purchasable, there is no SOC 2 or independent audit, no accessibility statement, and no CSP header. It is a well-built free tool with an unproven business model.

Measure by measure

Usability

Free tier ships the full workflow with unlimited DSARs, plus a product tour, guided practice request, and a free operations toolkit. Paid upgrades being unavailable caps the ceiling.

Design

Clean, modern marketing site with disciplined typography and clear workflow sections. Screenshots are labeled fictional data and show a tidy case-list UI. Solid but not distinctive.

Speed

Lighthouse mobile and desktop both score 100/100, with LCP 1.7s, CLS 0, and TBT 0ms. Genuinely fast, lightweight pages with no reported lag.

Security

HTTPS with HSTS, frame protection, and most hardening headers present (10/12, CSP missing). Claims encrypted at rest, RBAC, 2FA, and logged expiring links. No SOC 2 or audit published.

Accessibility

Lighthouse accessibility 100/100 and a responsive layout. No published WCAG statement or multi-language support, so the automated perfect score is the main signal.

Growth

Real, recurring problem with a specific segment (startups with no privacy officer) and a clear wedge: unlimited DSARs on Free vs. enterprise suites. Paid tiers not yet live limit near-term upside.

Improvement areas

Paid Team and Business tiers are planned but not purchasable, blocking upgrades.
No SOC 2, ISO, or published penetration test for compliance buyers.
Missing Content-Security-Policy header on a site handling identity documents.
No accessibility statement, WCAG claim, or multi-language support.

Design & Usability

The marketing site is competent and calm: consistent type, restrained palette, and a homepage that walks the reader from 'shared inboxes break' to a six-step workflow without shouting. The product screenshots are honest enough to label themselves fictional data, and the case table reads clearly. Usability is where the story gets more interesting. The Free tier is unusually generous — unlimited DSARs, two members, one portal, and the entire core workflow including identity review, tasks, secure delivery, and audit trail. Onboarding is supported by a product tour, a guided practice request, and a genuinely useful guides section with a free DSAR operations toolkit. The catch is commercial: Team and Business are labeled 'planned' and paid upgrades are explicitly unavailable, so a growing team that outgrows two seats has nowhere to go. As a free tool it is easy to adopt; as a business it is a waiting room.

Speed & Security

Speed is the standout. Lighthouse returns 100/100 on both mobile and desktop, with LCP 1.7s, CLS 0, TBT 0ms, and FCP 1.1s — the kind of numbers that usually mean a static marketing site with almost nothing on it, and here that is a compliment. Security is solid but not certified. The probe found HTTPS enforced with HSTS, frame protection, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, plus SPF and DMARC — 10 of 12 checklist points, with Content-Security-Policy the notable gap. The site claims encryption at rest, role-based access, two-factor authentication, and expiring, revocable delivery links with passcodes and access logs, which is exactly the right feature set for handling personal data. What is missing is third-party proof: no SOC 2, no ISO, no published penetration test. For a startup-stage tool that is normal, but buyers in compliance roles will ask.

Accessibility & Growth

Accessibility scores a clean 100/100 on the Lighthouse audit, and the site is responsive, including a pricing table that adapts to small screens. Beyond the automated checks, the evidence is thin: no accessibility statement, no WCAG conformance claim, and no multi-language support, so keyboard and screen-reader behavior on the app itself is unverified. Growth is a judgement on the idea, and the idea is sound. Privacy Requests targets startups and growing teams without a dedicated privacy officer — a real, specific segment that the listed alternatives (OneTrust, Transcend, DataGrail) largely serve at enterprise scale and enterprise prices. The wedge is clear: unlimited DSARs on a free tier with a guided workflow, versus a sales call and a six-figure contract. GDPR and CCPA deadlines create recurring, non-optional work, which is a durable tailwind. The limit is monetization: with paid tiers not yet purchasable, the product currently converts goodwill, not revenue.

Conclusion

If you are a small team drowning in privacy requests and you cannot justify an enterprise privacy suite, Privacy Requests is worth an afternoon. The free tier does not feel like a demo — it ships the workflow you actually need, and the guides help you build the process around it. The question is what happens when you outgrow two seats and one portal. Right now the answer is 'wait,' because the paid tiers are planned and unavailable. That is a fine position for a young product, but it means you should treat this as a tool you adopt today and a vendor relationship you revisit later. Check back when Team and Business actually ship, and ask for a security questionnaire response before you route real identity documents through it.

Suggestions for improvement

Ship the Team and Business tiers so growing teams have an upgrade path instead of a waiting list.
Add a Content-Security-Policy header, especially on intake and identity-verification pages.
Publish a security page with SOC 2 status or a completed penetration test summary.
Add an accessibility statement and confirm keyboard/screen-reader support in the app itself.

How we score

Alternatives comparison

Named competitors, point by point. Nobody paid to appear here or to be left out.

	Privacy Requests	OneTrust	Transcend	DataGrail
Free tier availability	Yes — unlimited DSARs, 2 members, 1 portal, full workflow	No free tier; enterprise pricing	No free tier; enterprise-focused pricing	No free tier; mid-market/enterprise pricing
Target customer	Startups and growing teams without a privacy department	Large enterprises with dedicated privacy/legal teams	Larger enterprises needing privacy infrastructure	Mid-market and enterprise companies
DSAR workflow automation	Guided intake, identity review, tasks, approval, secure delivery, audit trail	Full DSAR automation within a broad privacy platform	DSAR automation plus data mapping and consent infrastructure	DSAR handling with integrations across data systems
Secure response delivery	Expiring, revocable links with passcodes and access logs	Secure delivery as part of enterprise DSAR module	Secure delivery within enterprise privacy platform	Secure delivery within DSAR handling product
Published security certifications	None found — HTTPS, HSTS, 2FA, encrypted at rest claimed	Enterprise-grade certifications commonly published	Enterprise-grade certifications commonly published	Enterprise-grade certifications commonly published
Pricing model	Free now; Team $29/mo and Business $99/mo planned but unavailable	Custom enterprise quotes, typically high annual contracts	Custom enterprise pricing	Custom mid-market/enterprise pricing