Data Retention and Deletion Schedule

In this document

Heyou retains Personal Data only as long as needed for the applicable service purpose or as required by law. Default retention periods may vary by customer configuration, legal requirements, or contract terms.

Data Category	Default Retention	Deletion Trigger
Customer Data — organizational tier in production	Subscription Term	Termination plus export period
Customer Data — organizational tier in backups	Rolling backup period	Age-based purge
User Data — personal tier in production	Until the User disconnects the personal resource or leaves the Customer’s tenant, whichever is earlier	Deleted within 30 days of disconnection, or on tenant offboarding
User Data — personal tier in backups	Rolling backup period after revocation	Age-based purge
Messaging-channel queries, request context, and responses (Slack, WhatsApp, Claude) — the question a User sends Heyou, any context sent with it (such as the User’s goal or the state of a deal), and Heyou’s answer	Only as long as needed to answer; Heyou assistant conversations up to 14 days	Answer returned; conversation age; not archived or indexed
Messaging-channel routing identifiers — the Slack user and workspace identifiers, the User’s WhatsApp phone number, or the Claude connector account identifier, used to authenticate the User to their Heyou account	Life of the channel connection	Deleted on channel disconnection, app or connector uninstall, User request, or account deletion
Relationship corrections a User asks Heyou to record, with the User’s reason	Until removed	Removal by the User or a manager; tenant offboarding
Connected-CRM projections (Salesforce, HubSpot) — the narrowed account, opportunity, opportunity-contact-role, contact, lead, user, activity, and contract records Heyou reads to improve recommendation relevance and measure outcomes	While the CRM connection is active	Deleted as part of the disconnect operation when a Customer admin disconnects the CRM, and on tenant offboarding
Heyou records mirrored into a Customer’s CRM	Configurable retention window once the record reaches a terminal status	Purged from the Customer’s CRM on that window; removed entirely if the Customer uninstalls the Heyou package
Security logs	13 months	Age-based purge
Product telemetry with PII	90 days hot / 13 months cold	Age-based purge
Support conversations	3 years	Ticket-age purge
Financial records	7 years	Tax/accounting law
Prospect marketing data	Until opt-out or 3 years of inactivity	Periodic hygiene
Suppression list / opt-out identifiers	As long as needed to prevent re-introduction	On verified withdrawal of objection or when no longer required
Consent and acknowledgment logs	Life of account plus retention period	Account offboarding plus retention period
Evaluation briefs created on heyou.io (the optional shareable AI Brief, including a work email if the visitor submitted one for co-branding)	1 day from creation	Auto-deletion on schedule; earlier deletion on request

Customer admins can request earlier deletion for specific records within Customer Data through the product or by contacting privacy@heyou.io. Individual Users can trigger deletion of their User Data at any time from their own settings or by contacting privacy@heyou.io. Because User Data is User-controlled, Customer admins cannot trigger deletion of another User’s personal-tier data unless that data has been shared with the organization or as otherwise required by applicable law and product configuration.

Visitors who created an Evaluation brief on heyou.io can request immediate deletion at any time by emailing privacy@heyou.io with the evaluation URL or brief ID. In the absence of an earlier request, briefs are automatically deleted one day after creation.

Users of the Slack, WhatsApp, or Claude query channels can request deletion of their routing identifiers at any time by emailing privacy@heyou.io, or on Slack and WhatsApp by replying to the conversation with a deletion request. Disconnecting the channel in Heyou, or uninstalling the Slack app or Claude connector, also deletes them. Questions, request context and answers are deleted as set out above.