Data Deletion

Who can request what

How to submit a request

Send the request through the contact channel at the end of this page from an e-mail address registered as an owner or administrator of the workspace, and include:

• the legal name of your organisation and the workspace name as shown in the application;
• your name and your role in the workspace;
• the scope: the whole workspace, or the records concerned (for example a contact's phone number);
• the WhatsApp Business Account or phone number connected to the workspace, if any;
• whether you need a data export before deletion.

Requests go to [email protected].

Identity and authorisation verification

Deletion is irreversible, so we verify every request before acting. We confirm that the requester is a current owner or administrator of the workspace, by one of these means: a reply from the registered account e-mail, a confirmation performed while signed in to the application with multi-factor authentication, or, for a request about a whole workspace, a signed instruction from an authorised representative of the organisation. We may ask for further information where the request is unclear.

Requests from people who are not members of the workspace are forwarded to the business concerned, which decides on them as the controller of its customers' data.

Scope of deletion

Erasure of one contact, run in the application after approval by a second member of the business's staff, removes or anonymises in a single irreversible operation: the contact's name, phone, e-mail, address and notes; its identities and custom attributes; the text of its messages and conversation previews; ticket subjects, descriptions and comments; attachments linked to the contact, its tickets and its messages; order notes and draft delivery addresses; the customer number and notes of finished calls; and education records linked to the contact. Records the business must keep (placed orders with their frozen amounts, aggregated statistics, audit entries) stay, pointing at the anonymised contact.

Deletion of a whole workspace is not an automated or self-service function of the platform, and no tested procedure for it exists yet. Closing a workspace ends its users' access, revokes its sessions and pending invitations and is recorded in the platform's audit trail. Closure does not by itself delete Customer Data, which remains stored, and it does not stop every form of ingestion: a WhatsApp channel left connected continues to receive notifications until it is disconnected. The automated retention job no longer runs on a closed workspace. A verified request for the deletion of a whole workspace (users, contacts, conversations, messages, tickets, orders, automations, knowledge bases, attachments, exports and settings) can be submitted to the Operator through the channel below. The Operator assesses each request individually and handles it according to the applicable legal obligations and its actual technical capabilities at the time; it tells the requester which records it can remove and by what means, which it must keep and why, and confirms the outcome as described below. The rights of the people whose data is stored in the workspace are not affected: per-contact erasure remains available to the business in the application, and requests the Operator receives directly are forwarded to the business concerned or, where that is no longer possible, handled by the Operator to the extent the law requires of it.

Attachments deleted or anonymised in the application are removed from storage by the platform's file-retention job, and export files when their retention period ends; encrypted backups that contain earlier copies are deleted when they rotate out of the configured schedule.

Effect on a connected WhatsApp account

Disconnecting a WhatsApp Business Account from the workspace in the application changes the channel's status: the platform stops sending messages through it and stops accepting new webhook notifications for its number, and the change is written to the audit log. Notifications that were already accepted before the disconnection may still be processed by the platform's background worker. The encrypted access token the platform holds is not deleted by disconnection alone; it is deleted when the business removes the channel's secrets or deletes the channel in the application. The platform does not revoke the token at Meta, does not unsubscribe the WhatsApp Business Account from the EngageOps AI app at Meta, and changes nothing at Meta: the WhatsApp Business Account, the phone number and the message templates registered at Meta remain the business's and stay under its control in Meta's tools.

Messages already delivered to the business's customers remain on their devices and with Meta under Meta's terms. Notifications that Meta sends for a disconnected number are rejected by the platform and are not stored; Meta may keep attempting delivery until the business revokes the platform's access to the account in Meta's tools.

The business may therefore need to remove the EngageOps AI app or revoke its access in its own Meta Business settings: that step, which the platform does not perform, is what ends the platform's access at Meta and stops Meta from sending notifications for the account.

Retention exceptions

The following are not deleted on request, or not immediately:

• the workspace audit log, kept for seven years and never shortened, so that the deletion itself and earlier actions remain accountable; it records who did what and when, and pseudonymises personal values;
• financial and billing records that the law requires the Operator to keep;
• edge request logs, whose files are kept for at most 14 days and then deleted automatically, with a console copy rotated by size;
• encrypted backups, which are not edited; they are deleted when they rotate out of the configured schedule, which keeps the newest backup of each of the last 7 days, 5 weeks and 12 months, so a copy can remain for up to about twelve months; a copy held off the server to verify restoration is not covered by the automatic rotation;
• data the Operator must keep to comply with a legal obligation or a lawful order.

Production payments and electronic billing are not enabled at present, so the Service creates no billing records today. Financial records that are legitimately created in future are retained where the law requires it, for the period the law prescribes.

How completion is communicated

For an erasure run in the application, the request's state (requested, approved, processing, completed) is visible to the business's staff in the governance area, with the counts of records affected, and the completion is written to the audit log.

For a request handled by the Operator, we confirm the outcome to the verified requester through the same channel the request came from, stating what was deleted, what could not be deleted and why, and which exceptions applied. We do not promise a fixed response time; requests are handled in the order received, and verification time depends on the requester's reply.

Contact

Operator: شركة افاق الاتمتة لحلول البرمجية / ذات مسؤولية محدودة, Al Thuraya Complex, 3rd Floor, Abu Nseir, Amman, Jordan. Registration number 80575, national establishment number 200211022.

Deletion requests: [email protected].