Can I export a customer's data for an access request?

Yes. Download everything you hold about them on an agent as one JSON file: chats with every message, leads, bookings, cases, calls and contacts. The export is recorded in the audit log.

How long are chat conversations kept?

Until you delete them, by default. Set 30 days, 90 days, 1 year or 2 years, and choose whether older conversations are deleted or have personal details removed. Retention runs every hour.

What is a legal hold?

A switch that stops anything being removed for an agent, for a dispute or an investigation. While it's on, retention deletes nothing and no customer's data can be erased.

Is HeyKiko GDPR compliant?

HeyKiko gives you the tools to answer access and erasure requests and to limit how long conversations are kept, but holds no privacy certification. Files are stored in Singapore and the search index in the United States.

Could erasing one customer remove someone else's data?

Phone numbers are matched digit for digit and emails exactly, never by part of a number, so only that person's records are found.

Which plans include privacy controls?

Privacy controls are in every agent's settings, on every plan, after a 14-day free trial with no card.

Privacy controls

Privacy controls for every conversation your agent has

Choose how long conversations are kept and whether they're deleted or stripped of personal details after that. When a customer asks what you hold about them, find them by phone or email, download everything as one file or erase it, and put a legal hold on an agent when nothing may be removed.

Start free for 14 days See the live demo

Updated 5 November 2026

Ask AI about this pageChatGPT Claude Perplexity Google AI

How it works

How a customer request works

Step 1Find the person
Type their phone number or email in Settings › Privacy.
Step 2See what you hold
How many chats, leads, bookings, cases, calls and contacts are theirs on that agent.
Step 3Download or erase
Download everything as one JSON file, or erase it all in one step.
Step 4It's on record
Each export and erasure is written to the audit log, without the person's details, and counted for the year.

On every plan, after a 14-day free trial. See pricing

A customer's data

Found

+65 9123 4567

Chats: 3
Leads: 1
Bookings: 2
Cases: 1

Kept after erasing

Their opt-outNever messaged again

Campaign send recordsUnsubscribe links keep working

What you control

How long chats are kept
30 days, 90 days, 1 year, 2 years or forever, checked every hour.
What happens after
Delete conversations completely, or remove personal details: the customer's details are cleared and message text is redacted.
A legal hold
For a dispute or an investigation: while it's on, retention removes nothing for that agent and nobody's data can be erased.
One customer's data
Found across chats, leads, bookings, cases, calls and contacts, on the website, WhatsApp and Telegram.

Built to erase the right person

Exact phone matches
Numbers are compared digit for digit, never by their last few digits, so an erasure never catches someone else.
Opt-outs survive
If they asked not to be messaged, that's kept after erasing, so they're never messaged again.
Old emails keep working
Campaign send records aren't erased, so unsubscribe links in emails already sent still work.
Held chats are safe
If any of their chats is on hold, nothing is erased and you're told why.
Owner only
Only the account owner can change privacy settings or act on a customer's data.

What you can set

In Settings › Privacy, for each agent.

Privacy controls settings
Setting	What it does
Keep conversations for	30 days, 90 days, 1 year, 2 years, or forever (the default).
After that	Delete completely, or remove personal details.
Legal hold	Hold all conversations: nothing is removed while it's on.
A customer's data	Find by phone or email, then download or erase everything.
Check new uploads	Flags new knowledge uploads that repeat something you already have, for every upload or tagged ones, at 85, 90 or 95% similarity.

Good to know

Per agent
Retention, legal hold and erasure apply to one agent at a time; a business with several agents sets each.
It helps with requests, it isn't a certificate
These tools help you answer access and erasure requests under laws such as the GDPR, the UK GDPR or Singapore's PDPA. HeyKiko holds no privacy certification.
Where data lives
Files are stored in Singapore and the search index in the United States; there's no choice of region yet.
Source: Security and data
Testing isn't kept
Playground chats are never saved, so there's nothing to erase from them.

FAQ

Questions about privacy controls

Straight answers before you set it up.

Still have a question?Ask Kiko. It's a HeyKiko agent trained on everything here.

Ask Kiko Book a demo

Yes. Find them by phone or email in Settings › Privacy and erase everything about them on that agent: chats and messages, leads, bookings, cases and calls. Their opt-out is kept so they're never messaged again.

Keep reading

Let Kiko take the next message

Train your agent on your website today, put it on WhatsApp, Telegram and your site, and watch the first conversations come in.

Start free for 14 days Talk to Kiko

No card needed
Set up without code
Cancel any time