I led UX design for Lever’s first self-serve GDPR compliance portal—helping customers manage privacy at scale. This work reduced legal risk, cut support burden, and drove $1–2M in retention revenue by making complex data policies actionable and transparent.
GDPR (General Data Protection Regulation) transformed the expectations global companies had around data privacy — requiring products to give users more control over their personal data, and organizations to demonstrate compliance in real time. For enterprise clients, data governance wasn’t just a nice-to-have, it was a legal and operational requirement tied directly to renewals, security reviews, and platform trust.
To meet that need, I led the design of Lever’s first self-serve GDPR portal, a centralized experience that transformed compliance from a support-driven burden into a trusted, built-in product capability. The work gave customers full control over their data retention policies and privacy workflows, while reducing risk for both users and the business.
Before this work, GDPR and regional compliance workflows at Lever were largely manual and reactive, creating operational risk, increasing legal overhead, and delaying critical customer requests. Without a way to self-manage data retention, customers faced uncertainty around platform safety and legal exposure.
I led the end-to-end design of our GDPR portal, translating legal, technical, and user needs into a scalable, productized experience. The solution needed to meet strict compliance requirements while remaining intuitive and self-serve for non-technical users.
Through customer interviews, compliance audits, and shadowing support workflows, I identified three key themes that shaped the solution:
Customers needed to set retention policies once — and trust they’d scale across multiple offices, user roles, and regions. I designed configurable, account-level controls that propagated settings predictably and transparently.
Different countries and customers required different rules. I built in logic and UI affordances to localize retention and deletion policies by country or compliance region, supporting a wider range of global clients.
Across all research, three core capabilities emerged as must-haves:
We launched a self-serve GDPR compliance portal built directly into the Lever platform, giving customers full control over how personal data is retained, deleted, and governed across their candidate lifecycle. The experience was designed to balance legal rigor with usability — supporting compliance without slowing teams down. Key functionality included:
Together, these features gave our customers what they’d been asking for: a scalable, trustworthy way to meet compliance standards — without submitting a single support ticket.
This project helped me bridge legal risk and user experience through systems-level thinking. Rather than bolting on compliance, I embedded privacy into the product experience — not just to check a box, but to build trust at the system level. The work deepened my understanding of designing for edge cases, legal ambiguity, and the invisible forces shaping enterprise decision-making.
See how I helped design the first anomaly detection and forecasting feature at Amplitude, balancing clarity, trust, and actionable insights. This tool helps users spot meaningful changes in product metrics without manual guesswork, leading to reduced time-to-insight, improved trust in data, and empowered teams across 800+ customer accounts to act faster with confidence.