# Privacy controls for every conversation your agent has

> Set how long chats are kept, find one customer's data across chats, leads, bookings, cases and calls, download or erase it, and hold everything for a dispute.

Canonical: https://heykiko.io/features/privacy-controls
Last updated: 2026-11-05

Choose how long conversations are kept and whether they're deleted or stripped of personal details after that. When a customer asks what you hold about them, find them by phone or email, download everything as one file or erase it, and put a legal hold on an agent when nothing may be removed.

## How a customer request works

1. **Find the person**: Type their phone number or email in Settings › Privacy.
2. **See what you hold**: How many chats, leads, bookings, cases, calls and contacts are theirs on that agent.
3. **Download or erase**: Download everything as one JSON file, or erase it all in one step.
4. **It's on record**: Each export and erasure is written to the audit log, without the person's details, and counted for the year.

Included on every plan, after a 14-day free trial.

## What you control

- **How long chats are kept**: 30 days, 90 days, 1 year, 2 years or forever, checked every hour.
- **What happens after**: Delete conversations completely, or remove personal details: the customer's details are cleared and message text is redacted.
- **A legal hold**: For a dispute or an investigation: while it's on, retention removes nothing for that agent and nobody's data can be erased.
- **One customer's data**: Found across chats, leads, bookings, cases, calls and contacts, on the website, WhatsApp and Telegram.

## Built to erase the right person

- **Exact phone matches**: Numbers are compared digit for digit, never by their last few digits, so an erasure never catches someone else.
- **Opt-outs survive**: If they asked not to be messaged, that's kept after erasing, so they're never messaged again.
- **Old emails keep working**: Campaign send records aren't erased, so unsubscribe links in emails already sent still work.
- **Held chats are safe**: If any of their chats is on hold, nothing is erased and you're told why.
- **Owner only**: Only the account owner can change privacy settings or act on a customer's data.

## What you can set

In Settings › Privacy, for each agent.

| Setting | What it does |
| --- | --- |
| Keep conversations for | 30 days, 90 days, 1 year, 2 years, or forever (the default). |
| After that | Delete completely, or remove personal details. |
| Legal hold | Hold all conversations: nothing is removed while it's on. |
| A customer's data | Find by phone or email, then download or erase everything. |
| Check new uploads | Flags new knowledge uploads that repeat something you already have, for every upload or tagged ones, at 85, 90 or 95% similarity. |

## Good to know

- **Per agent**: Retention, legal hold and erasure apply to one agent at a time; a business with several agents sets each.
- **It helps with requests, it isn't a certificate**: These tools help you answer access and erasure requests under laws such as the GDPR, the UK GDPR or Singapore's PDPA. HeyKiko holds no privacy certification.
- **Where data lives**: Files are stored in Singapore and the search index in the United States; there's no choice of region yet. Source: [Security and data](/security)
- **Testing isn't kept**: Playground chats are never saved, so there's nothing to erase from them.

## Questions about privacy controls

### Can I delete a customer's chat data?

Yes. Find them by phone or email in Settings › Privacy and erase everything about them on that agent: chats and messages, leads, bookings, cases and calls. Their opt-out is kept so they're never messaged again.

### Can I export a customer's data for an access request?

Yes. Download everything you hold about them on an agent as one JSON file: chats with every message, leads, bookings, cases, calls and contacts. The export is recorded in the audit log.

### How long are chat conversations kept?

Until you delete them, by default. Set 30 days, 90 days, 1 year or 2 years, and choose whether older conversations are deleted or have personal details removed. Retention runs every hour.

### What is a legal hold?

A switch that stops anything being removed for an agent, for a dispute or an investigation. While it's on, retention deletes nothing and no customer's data can be erased.

### Is HeyKiko GDPR compliant?

HeyKiko gives you the tools to answer access and erasure requests and to limit how long conversations are kept, but holds no privacy certification. Files are stored in Singapore and the search index in the United States.

### Could erasing one customer remove someone else's data?

Phone numbers are matched digit for digit and emails exactly, never by part of a number, so only that person's records are found.

### Which plans include privacy controls?

Privacy controls are in every agent's settings, on every plan, after a 14-day free trial with no card.

## Related

- [Security and data](https://heykiko.io/security)
- [Knowledge access by role](https://heykiko.io/features/knowledge-access)
- [Lead capture](https://heykiko.io/features/lead-capture)
- [Privacy policy](https://heykiko.io/privacy)
- [Pricing](https://heykiko.io/pricing)
- [Human hand-off](https://heykiko.io/features/human-handoff)
- [Appointment booking](https://heykiko.io/features/appointment-booking)
- [Shared inbox](https://heykiko.io/features/shared-inbox)
- [Train on your website and files](https://heykiko.io/features/train-on-your-website)
- [Live answers from your database](https://heykiko.io/features/database-answers)
- [Product recommendations](https://heykiko.io/features/product-answers)
- [Cases and approvals](https://heykiko.io/features/cases-and-approvals)
- [Test and tune your agent](https://heykiko.io/features/test-your-agent)
- [Ask Kiko](https://heykiko.io/features/ask-kiko)