Skip to main content

Subscriber preferences

Honouring an opt-out is a legal requirement under the Nigeria Data Protection Act (NDPA 2023) and GDPR. In Nerve, subscriber preferences are stored in PostgreSQL and evaluated by delivery workers immediately before dispatch, ensuring suppressed channels are never contacted and never billed.

Workspace-scoped preferences​

Subscriber preferences are strictly isolated per tenant workspace (UNIQUE(workspace_id, subscriber_id)). Preferences configured in one workspace never collide with another workspace.

Setting preferences via API​

curl -X PUT https://api.nervly.io/v1/users/user_8f21c/preferences \
  -H "Authorization: Bearer $NERVE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "channels": {
      "sms": true,
      "email": true,
      "push": false,
      "whatsapp": false,
      "voice": false
    },
    "categories": {
      "marketing": { "email": false, "sms": false },
      "security":  { "email": true,  "sms": true }
    }
  }'
{
  "status": "UPDATED",
  "subscriberId": "user_8f21c",
  "updated_at": "2026-09-11T20:15:00.123Z"
}

Nigerian NCC 2442 DND compliance​

For SMS traffic terminating in Nigeria (+234), Nerve integrates mandatory Do-Not-Disturb (DND 2442) compliance directly into the Go worker router:

  1. MSISDN Normalization: Automatically standardizes Nigerian phone numbers (+234..., 080..., 090..., 070..., 081...) to international E.164 digits without + for provider lookup.
  2. DND Cache: DND lookups are cached for 1 hour, keyed by a non-reversible SHA-256 digest of the number — no plaintext phone number is ever stored in the cache.
  3. Asymmetric Failure Posture:
    • Marketing Traffic: Fails closed. If DND status check fails or indicates DND is active, the SMS is suppressed (SUPPRESSED).
    • Transactional / OTP Traffic: Fails open. Critical security and transactional OTPs route via high-priority transactional routes (corporate CLI) rather than failing.
  4. Audit Evidence: Every DND decision is recorded to an immutable, tamper-evident audit trail with a SHA-256 hashed MSISDN, intent, category, and outcome — preserving verifiable regulatory evidence without storing raw recipient numbers.

Subscriber erasure (NDPR Right to Erasure)​

To comply with NDPA 2023 data subject erasure mandates, Nerve provides synchronous/asynchronous erasure endpoints:

curl -X DELETE https://api.nervly.io/v1/subscribers/user_8f21c \
  -H "Authorization: Bearer $NERVE_API_KEY"
{
  "status": "ACCEPTED",
  "subscriber_id": "user_8f21c",
  "message": "Subscriber erasure initiated successfully"
}

What happens on erasure:

  1. The subscriber record is anonymised: email, phone, and push tokens are cleared and the profile is marked deleted.
  2. Stored channel preferences for the subscriber are removed.
  3. Contact fields on messages older than 30 days are nulled.
  4. If a message is currently enqueued for the erased subscriber, the worker detects the deletion and suppresses delivery with status SUPPRESSED.
  5. An immutable entry is written to the tamper-evident audit trail.

Subject access export​

To satisfy NDPA 2023 data access requests, administrators can export a subscriber's complete history as JSON:

curl https://console.nervly.io/console/subscribers/user_8f21c/export \
  -H "Cookie: nerve_session=$SESSION_COOKIE"

Next​