Export your data, and erase a customer on request
Both of these are buttons in the dashboard rather than a support request. That is deliberate: a DPDP or GDPR request comes with a deadline, and a deadline you can only meet by emailing your vendor is not met.
Exporting everything
Settings → Data → Export. You choose what and get a file.
| Export | Contains |
|---|---|
| Contacts | Every contact with custom fields, tags, source and consent state |
| Conversations | Message history per contact, with timestamps and who sent what |
| Orders | Orders, line items, totals and payment state |
| Leads | Pipeline stage, disposition, owner, activity timeline |
| Consent ledger | Who opted in, when, from where, and the wording they saw |
Standard formats, no fee, no ticket. If you leave, you take all of it — and the WhatsApp number and Business Account were always yours.
Answering a deletion request
When a customer asks to be erased:
- Find the contact.
- Contact → Actions → Erase.
- Confirm. The contact, their messages and their custom field values are removed.
Two things worth knowing before you press it:
- It cannot be undone. Export the contact first if you may need the record.
- Financial records are kept. Orders and payments are retained in the anonymised form your tax rules require, with the personal details removed. Deleting a paid invoice outright would break your books, and data protection law allows for that.
The consent ledger
Every opt-in is recorded with:
- Who — the contact.
- When — the timestamp.
- Where from — the web form, the WhatsApp opt-in, the imported list, the checkout.
- What they saw — the wording shown at the time, stored as it was then, not as it reads today.
That last one is the point. "They agreed to our terms" is not an answer if the terms have changed four times since. The ledger holds the version they actually saw.
Imported lists
When you import contacts, you are asked to record the source and the consent basis. Fill it in honestly — it is the record that answers a complaint, and an import marked "unknown source" is one to be careful with when you run a campaign.
Who in your team can do this
Export and erasure are restricted to Owner and Admin roles. Agents can work conversations without being able to take the contact list out of the building. See Invite your team.
Our side
Your data sits in the Asia Pacific (Mumbai) region on AWS, encrypted in transit and at rest, with sensitive custom fields encrypted individually on top. The security page has the detail, and questionnaires go to the address listed there.