Data Deletion Instructions

This page explains how to request deletion of data processed by BotSync, including account data, workspace data, lead data, conversation data, mobile app data, and data received from connected Meta services such as Instagram, Facebook, Messenger, and WhatsApp.

This page also serves as BotSync's Data Deletion Instructions URL for Meta app settings, App Review, and Indian DPDPA data-erasure requests.

Two groups can request deletion: the workspace owner (or an authorized admin), and the individual whose personal data appears inside a workspace.

• Workspace Owner or authorized admin: can request deletion of the workspace, an individual lead, a conversation, a connected channel, integration records, mobile app sessions, or the full account.
• Contact, lead, student, customer, Instagram sender, Facebook sender, or WhatsApp recipient whose details appear inside a BotSync workspace: can request deletion of personal data that BotSync holds about them. In many cases we will need to verify the request with the business or workspace owner that originally collected the data.
• Authorized representative or legal heir under DPDPA section 9 or applicable GDPR provisions: can request on behalf of a data principal, after providing reasonable evidence of authority.

Choose one of the following channels. Self-service options are fastest; email is available for cases that need verification or are outside the dashboard's scope.

• From the dashboard (workspace owners): use the lead, conversation, knowledge base, or integration deletion controls available in the workspace UI to delete specific records immediately.
• Disconnect a Meta channel: from BotSync, disconnect Instagram, Facebook, or WhatsApp under the connected-channel settings. From Meta, revoke the BotSync app from your Facebook Business Integrations or Instagram-linked apps settings.
• Mobile app: sign out from the BotSync mobile app and disable call-log sync to stop further mobile data collection. To delete previously synced call activity, raise an email request as below.
• Email request: write to support@botsync.in from the email address connected to your BotSync account or the email address related to your deletion request.

To help us identify and verify your request quickly, please include the following details.

• Your full name and contact email address.
• The workspace or business name in BotSync, if known.
• The phone number, Instagram or Facebook username, or app-scoped sender ID related to the request, where applicable.
• A short description of the data you want deleted (for example: 'delete my lead record', 'delete my WhatsApp conversation', 'delete the whole workspace', 'delete all Meta tokens').
• Whether you are the workspace owner, an admin, a data principal, or an authorized representative.
• For Meta-related requests: the connected Instagram professional account, Facebook Page, or WhatsApp number. If you do not know these identifiers, describe the account or conversation as clearly as possible.

If you connected a Meta account to BotSync, you have several ways to revoke access.

• From BotSync: go to the connected-channel settings inside your workspace and use the disconnect action for Instagram, Facebook, or WhatsApp.
• From Facebook: open Settings & Privacy → Settings → Business Integrations and remove BotSync.
• From Instagram: open Settings → Apps and Websites and remove BotSync.
• From WhatsApp Business Manager: remove BotSync's system user or revoke the access token used by your workspace.
• By email: write to support@botsync.in and ask us to remove stored Meta access tokens, connection records, webhook subscription records, and related identifiers.
• After access is revoked, BotSync will no longer receive messages, send replies, run automations, or show analytics for that connected account.

We distinguish between two kinds of requests so we can act correctly on each.

• Account deletion: closes the BotSync workspace, removes all team users, terminates connected integrations, and queues the workspace's data for deletion or de-identification within 30 days, subject to required retention.
• Data deletion: removes a specific record (a lead, a conversation, a Meta token, a knowledge base document) while keeping the workspace itself active. This is the right option when you want to remove a single contact without ending your subscription.
• If you are unsure which to request, choose data deletion first; we will follow up if account deletion is more appropriate.

Depending on the verified request, we may delete or de-identify the following.

• Account and workspace records: user profile, login credentials, workspace settings, plan and billing configuration (subject to retention required by tax law).
• Lead and conversation records: lead profile, custom CRM fields, conversation history, messages, attachments, notes, tags, activity logs, lead intelligence, lead scores, and follow-up state.
• Mobile app data: device push tokens, mobile session records, and previously synced call-log activity matched to your leads.
• Connected-channel data: WhatsApp Business phone-number ID records, Instagram account identifiers, Facebook Page IDs, app-scoped sender IDs, access tokens, webhook subscription records, template mappings, and connection status records.
• Integration records: Google Sheets connections and tokens, knowledge base documents and embeddings, broadcast campaigns and recipient state, scheduled messages, forms, flows, and bookings.
• AI artifacts: prompts, knowledge base content, and AI-generated outputs associated with the workspace.

Some information may be retained for a limited period after deletion if required for legal, security, fraud-prevention, billing, dispute-resolution, audit, backup, or platform-compliance reasons.

• Billing records, invoices, and payment evidence: retained for up to 8 years to meet Indian tax and accounting requirements (GST, Income Tax).
• Audit logs of administrator and impersonation actions: retained for up to 12 months for security and compliance review.
• Operational logs and webhook payloads: retained for up to 90 days for incident investigation.
• Encrypted backups: rolling backups retained for up to 35 days. Deleted data continues to exist inside backups during this window and is overwritten on rotation. We do not restore deleted records from backups except to recover from an incident.
• De-identified or aggregated analytics that cannot reasonably be linked to a person may be retained indefinitely.

We aim to act on verified deletion requests on the following timelines. If we cannot meet a timeline because of a legal hold, an ongoing investigation, or a platform compliance issue, we will explain the reason where we are operationally and legally able to do so.

• Acknowledgement of a verified request: within 7 business days.
• Single-record deletion (a lead, a conversation, a Meta token): typically within 24 hours of verification.
• Workspace or account deletion: deletion or de-identification within 30 days of verification, except for retained categories listed above.
• Backups overwrite: deleted data is removed from rolling backups within 35 days.
• Meta automated deletion callbacks: processed within 30 days, in line with Meta's data-deletion-callback requirements.

If Meta sends BotSync an automated user-data deletion callback for a connected app, we use the identifiers in the callback (such as app-scoped user ID) to locate related records and delete or de-identify applicable data according to this policy.

Meta or any party requiring a callback endpoint may use the BotSync data-deletion confirmation endpoint exposed by the platform. If the callback does not contain enough information to identify the relevant workspace or account data, we may require additional verification before completing deletion.

For status checks, contact support@botsync.in and reference the confirmation code returned by the callback.

Where Indian DPDPA, EU/UK GDPR, or another data-protection law applies, you may also have rights to access, correct, restrict, or port your personal data. These rights, and how to exercise them, are described in our Privacy Policy.

If you are unhappy with how BotSync handles a deletion request, you can escalate to the Data Protection Board of India under DPDPA, or to your local supervisory authority under GDPR.

For data deletion requests, Meta data requests, privacy questions, or account removal requests, email support@botsync.in. We aim to acknowledge requests within 7 business days.

You can also review our Privacy Policy at https://botsync.in/privacy and our Terms of Service at https://botsync.in/terms.