Data Deletion

1. Who Can Request Deletion

End Users (Customers of Businesses Using Cyrus)

If you interacted with a business through their Cyrus-powered chatbot on WhatsApp, Telegram, a website widget, or any other channel, you have the right to request deletion of your personal data. This includes your conversation history, any contact information you shared (name, phone, email), profile data extracted from your conversations, and any leads or bookings associated with your identity.

Business Owners (Cyrus Customers)

If you are a business that uses the Cyrus platform, you can delete your own data at any time through the dashboard, or request full account deletion which removes all data associated with your workspace.

Meta / Facebook Platform Requirements

If you connected to a business via WhatsApp and want your data deleted, this page serves as the data deletion callback URL required by Meta's platform policies. You may submit a deletion request using the process described below, and we will confirm deletion within the timeframes specified.

2. What Data We Store

When you interact with a Cyrus-powered agent, the following data may be collected and stored:

• Conversation messages — the text content of messages you sent and received, including any media transcriptions (voice messages transcribed to text, image descriptions)
• Contact identifiers — your phone number (WhatsApp), Telegram user ID, or widget session identifier
• User profile — information extracted from your conversations such as your name, company, location, preferences, and interests
• Contact record — a unified identity record that links your interactions across different channels (e.g., WhatsApp and web widget)
• Conversation summaries — AI-generated summaries of your conversation history used to maintain context
• Lead information — if you provided contact details during a sales conversation (name, phone, email, company)
• Booking information — if you made an appointment (date, time, service, contact details)
• Message feedback — thumbs up/down ratings you gave on bot responses
• Delivery status — whether messages were sent, delivered, read, or failed
• Session memory — temporary conversation context stored in Redis (automatically expires after 7 days)

3. How to Request Deletion

Option A: Contact the Business Directly

The business you interacted with is the data controller for your personal data. They can delete your data directly from their Cyrus dashboard. We recommend contacting them first, as they can process your request immediately.

Option B: Email Us

Send a deletion request to [email protected] with the following information:

• Your name
• The phone number, email address, or Telegram username you used in the conversation
• The name of the business you interacted with (if known)
• Whether you want a profile wipe (remove your personal details but keep anonymised conversation records) or full erasure (delete everything)

We will acknowledge your request within 48 hours and process it within 90 calendar days, in accordance with GDPR Article 17 and Malaysia's PDPA requirements.

Option C: Business Owner Self-Service

If you are a Cyrus customer (business owner), you can delete data directly:

• Delete individual conversations — from the Conversations page in your dashboard
• Delete all conversations — from Settings → General → Danger Zone
• Delete a contact and all their data — from the Contacts page, click the contact and select Delete
• Delete your entire workspace — from Settings → General → Danger Zone → Delete Workspace
• Delete knowledge base documents — from the Knowledge Base page for each bot

4. What Gets Deleted

Profile Wipe (Partial Deletion)

A profile wipe removes personally identifiable information while preserving anonymised records for the business's analytics. The following is cleared:

• User profile data (name, company, location, budget, preferences, interests)
• Conversation summary text
• Contact record (display name, email, phone)

The conversation messages themselves are retained in anonymised form (the business can still see that a conversation occurred, but cannot identify you from it).

Full Erasure (Complete Deletion)

A full erasure permanently and irreversibly deletes all data associated with your identity:

• All conversation messages (both your messages and bot responses)
• All conversation summaries and extracted profiles
• All contact records and channel identities
• All lead records captured from your conversations
• All booking records made through your conversations
• All action event logs (lead capture, escalation, tool calls)
• All message feedback (thumbs up/down)
• Session memory in Redis (if still within the 7-day TTL)

Workspace Deletion (Business Owners)

When a business owner deletes their workspace, all tenant-scoped data is permanently removed:

• All conversations, messages, and summaries
• All contacts and contact identities
• All knowledge base documents and chunks
• All catalog items and schemas
• All leads, bookings, and action events
• All analytics data, feedback, and unanswered queries
• All LLM usage logs
• All API keys and channel configurations
• All bot configurations and persona prompts

Workspace deletion is irreversible. We recommend exporting your data before proceeding.

5. What We Cannot Delete

Certain data cannot be deleted or may be retained after a deletion request:

• Data sent to LLM providers — Message content sent to OpenAI, Anthropic, Google (Gemini), or xAI (Grok) for response generation is subject to each provider's data retention policy. We do not have the ability to retroactively delete data from third-party provider systems. However, all commercial LLM API providers we use commit to not training on API inputs and typically retain data for a limited period (usually 30 days) for abuse monitoring before automatic deletion.
• Data sent to WhatsApp/Meta — Messages delivered through WhatsApp are stored on Meta's servers according to Meta's data retention policies. Deletion from Cyrus does not delete messages from the recipient's WhatsApp app or Meta's infrastructure.
• Data sent to Telegram — Messages delivered through Telegram are stored on Telegram's servers. Deletion from Cyrus does not delete messages from Telegram's infrastructure.
• Database backups — Automated backups are retained for 90 days. Data deleted from the live database will persist in backups until the backup containing that data is automatically purged.
• Aggregated, anonymised analytics — We may retain aggregated, non-personally-identifiable statistics (e.g., total conversation count, average response time) that cannot be linked back to any individual.
• Legal obligations — We may retain data where required by law, regulation, legal proceedings, or legitimate business interests (e.g., fraud prevention, dispute resolution). We will inform you if legal retention applies to your request.

6. Deletion Timelines

7. Confirmation of Deletion

After processing a deletion request, we will send a confirmation email to the address provided in your request. The confirmation will include:

• The date deletion was completed
• A summary of what was deleted
• Any data that could not be deleted and why
• The expected date for backup purge completion

8. For Developers and Platform Integrators

If you are integrating with the Cyrus API and need to implement data deletion programmatically, the following endpoints are available:

• DELETE /v1/admin/profiles/{external_user_id} with full_erasure=true — deletes all data for a specific end user (conversations, messages, leads, bookings, feedback, action events)
• DELETE /v1/admin/conversations/bulk — deletes all conversations for a tenant or bot
• DELETE /v1/admin/contacts/{id} — deletes a contact and unlinks all associated records
• DELETE /v1/admin/tenants/{id}/data — hard-deletes all tenant data while preserving the account

All deletion endpoints require authentication via the admin API bearer token. See the API documentation for details.

9. Facebook / Meta Data Deletion Callback

This page serves as the data deletion callback URL for Meta's platform requirements. If you connected to a business via their WhatsApp Business account powered by Cyrus and wish to have your data deleted:

1. Email [email protected] with the phone number you used on WhatsApp
2. We will identify and delete all conversation data associated with your phone number across all businesses using our platform
3. You will receive a confirmation email within 90 days

Alternatively, you may contact the specific business you interacted with directly. As the data controller, they can process your request through their Cyrus dashboard immediately.

10. Contact

For any questions about data deletion or to submit a deletion request:

• Email: [email protected]
• Response time: within 48 hours
• Processing time: within 90 calendar days

See also: Privacy Policy · WhatsApp Data Handling · Data Processing Agreement