Privacy requests and retention
Export or erase a customer's or supplier's personal data on request, and choose how long message content, ad-click data and the audit log are kept.
What it is
When a person asks what your business holds about them, or asks you to delete it, Cash Flow Inventory gives you two actions on their customer or supplier record: Export personal data and Erase personal data. They cover the usual data-subject rights in privacy laws such as the GDPR (access, portability, erasure), the CCPA ("know" and "delete"), India's DPDP Act and Saudi Arabia's PDPL.
On Settings › Access policy you choose how long message content, ad-click data and the audit log are kept. Old data is cleared every night.
Who it is for
- Business owners, who act as the privacy contact.
- Businesses that sell to consumers or send marketing messages.
- Anyone who needs to answer a data request within a legal deadline.
Before you start#
- Export and erasure are for the business owner only. Every export and erasure is written to the audit log.
- Erasure is refused while money is still open with the person; settle it first.
Step by step#
- Open the customer or supplier.
- Choose Export personal data to download one machine-readable file of everything held about them, and send it to the person.
- If they asked to be deleted, settle anything still open with them.
- Choose Erase personal data and confirm.
What the export contains#
One JSON file with: the contact and its people, loyalty history, the documents made out to them (headers), activities and notes, order attribution and marketing touches, their consent history per channel (e-mail, SMS, WhatsApp, Telegram), every message the messaging hub sent them, older SMS and e-mail logs, the assistant's chats with them on customer channels, their parcels with the couriers' tracking answers, cash-on-delivery reviews and settlement lines, and what your online stores sent about their orders.
Messages are found by the contact and by every phone number and e-mail address of the person and their contact people, however the number was written — so a message sent before they became a contact is included too.
What erasure does#
- The person is anonymised: name, addresses, phones, e-mails, notes and contact people are removed.
- The text, subject and address of every message to them are removed; a stub stays that a message was sent (kind, document, channel, date, outcome), without saying what or to whom. Anything still waiting to be sent to them is skipped.
- The assistant's chats with them are deleted.
- Their consent becomes a suppression entry — a one-way fingerprint of each address, marked opted out — so they are not sent marketing again if the address comes back in an import.
- Parcels and store orders keep only the record: personal details are replaced by "[erased]" and the label link is cleared; the parcel, tracking number, carrier, status, dates and amounts stay.
- Kept by law: invoices, payments and journals made out to them, with their code and totals, so the ledger still adds up.
How long things are kept#
| Setting on Access policy | Choices | Default |
|---|---|---|
| Keep message content | 30 days, 90 days, 6 months, 1 year, 13 months, 2 years | 13 months (recommended) |
| Keep ad-click data | 30 days, 90 days, 6 months, 1 year, 13 months, 2 years | 13 months (recommended) |
| Keep the audit log | Keep everything, 90 days, 180 days, 1 year, 2 years | — |
- There is no "keep for ever" for message content. Each night the text of older messages is cleared; who, when, channel, document and status stay as long as the audit log is kept. Messages still waiting to be sent are never touched. A private backup is written first and deleted after 30 days.
- Courier and store messages: personal details in what couriers and online stores sent are blanked after 13 months. The order, the parcel, its tracking number, status, dates and amounts always stay.
- The assistant's in-app chats with staff are kept 90 days; files the assistant received by e-mail, 7 days.
- The log of API and connected-AI requests follows the audit log (kept one year when the audit log is kept for ever).
Staff and AI data#
On Settings › Users › a person › Personal data you can export a staff member's data (they can export their own) or erase what AI kept about them: assistant runs and tool calls, files AI made and AI-app connections. The audit trail and request log stay as statutory records.
Limits and what is not there yet#
- Accounting records made out to a person are never erased; they are statutory records.
- Until a period is chosen, the recommended 13 months applies.
Questions#
Why can't I erase this customer?
Money is still open with them. Settle or close what they owe, or what you owe them, first.
Will an erased person get our newsletter again if they are re-imported?
No. Their address stays as a one-way suppression entry marked opted out.
Are invoices deleted on erasure?
No. Invoices, payments and journals are kept by law; the person's name and contact details on the contact are anonymised.
Where do people opt out of marketing?
Every promotional message carries an unsubscribe link; the opt-out is recorded and respected by every message the business sends.