Suppression Notices

The short version

• Delivr sends your organization a Suppression Notice about once a week when people have opted out since your last notice. Each notice is a CSV of hashed emails you must stop using.
• Process each notice within 10 business days of receiving it.
• The same notice is emailed to your suppression contact (or your Owners and Admins). The API below lets you pull it instead of, or as well as, reading the email.
• Two endpoints: list your notices, then download one notice's file as CSV or JSON.
• Authenticate with your API key and secret, the same as every other data endpoint.

What you need to do

Privacy laws like the CCPA give people the right to opt out of the sale or sharing of their data, and businesses that pass data on have to carry that request downstream. Your agreement with Delivr applies it to every customer, every time, so a person who opts out is removed everywhere their data went, not just from Delivr. Every customer receives these notices; one arriving does not mean anything is wrong with your account.

For each notice, within 10 business days of receiving it:

1. Match the hashes against all Delivr data you hold or use, including audiences, CRM records, and downstream syncs.
2. Delete or suppress the matching records, and stop using their data.
3. Keep a record that you processed the notice. Delivr may ask for it.

If you pass Delivr data on to your own customers, forward each notice to every End Customer who received Delivr data, within the same 10 business days, so they delete or suppress the records too.

These obligations come from your agreement with Delivr and continue for as long as you hold any Delivr data.

Change who receives the email

By default, notices are emailed to your organization's Owners and Admins. To send them somewhere else, such as a privacy or data operations inbox:

1. In the dashboard, select your organization (not a project).
2. Open Settings > Organization > General.
3. In Suppression notice contact, type an email address and press Enter. Add up to 10 addresses.
4. Click Save changes.

Once a contact is set, notices go only to those addresses, not to your Owners and Admins. Only an Owner or Admin can change the contact. Clearing the list sends notices back to Owners and Admins.

Cadence

Notices go out on a weekly cadence. A week with no new opt-outs produces no notice. Each notice covers the opt-outs recorded since the previous one, so processing every notice in order keeps your suppression list complete.

List your notices

curl "https://api.delivr.ai/api/v1/suppression-notices?limit=25&offset=0" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "X-Api-Secret: YOUR_API_SECRET"

Returns notices that were sent to your organization, newest first:

{
  "notices": [
    {
      "id": "3f6c1e2a-9b7d-4c1e-8a52-0d4e6f7a8b90",
      "created_at": "2026-10-13T21:00:00Z",
      "watermark_from": "2026-10-06T20:56:29Z",
      "watermark_to": "2026-10-13T20:50:00Z",
      "row_count": 412,
      "file_sha256": "9b1c...e04a",
      "has_file": true
    }
  ],
  "total": 1,
  "limit": 25,
  "offset": 0
}

Page with limit (default 25, maximum 100) and offset. total is the number of sent notices.

Download a notice

curl "https://api.delivr.ai/api/v1/suppression-notices/NOTICE_ID/file" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "X-Api-Secret: YOUR_API_SECRET" \
  -o suppression-notice.csv

By default the response is the exact CSV that was emailed (text/csv), with a one-column header sha256_lc_hem and one SHA-256 of a trimmed, lowercased email per line.

For JSON, send Accept: application/json or add ?format=json:

{
  "notice_id": "3f6c1e2a-9b7d-4c1e-8a52-0d4e6f7a8b90",
  "row_count": 412,
  "file_sha256": "9b1c...e04a",
  "sha256_lc_hem": ["0a1b...", "0c2d..."]
}

Both formats come from the same stored file, and the service checks it against file_sha256 before returning it. You can check it too: the SHA-256 of the CSV bytes equals file_sha256.

Errors

In the dashboard, the same endpoints answer with your sign-in session and an organization_id query parameter.