Data retention and deletion

This page describes what personal data the Humind platform stores server-side on behalf of merchants, for how long, and through which mechanisms it is deleted: automatically at the end of a retention period, in bulk at the end of the contract, or selectively for a given person.

It is the reference description of the platform's data lifecycle, kept up to date by Humind. The contractual commitments between Humind and a given merchant are set by the service agreement and the Data Processing Agreement (DPA), which prevail in case of conflict. For data stored in the visitor's browser, see Privacy and browser storage.

At a glance

• Humind processes end-user personal data as a processor; the merchant remains the controller and sets the applicable retention instructions in the DPA.
• Technical and security logs have fixed retention periods (2 days to 12 months) enforced automatically by database-level expiry.
• Visitor browsing logs are automatically deleted 14 days after collection.
• Conversation data is kept 13 months after the last interaction; contact records, bookings and support tickets 3 years after the person's last activity. A shorter period can be set in the DPA.
• At contract termination or app uninstall, the merchant's data is deleted within 30 days.
• Individual erasure is available per person (contact deletion and anonymization), in addition to the Shopify privacy webhooks.
• LLM inference runs in Zero Data Retention mode: the AI provider stores no prompts, completions, or embeddings.

Roles and hosting

Humind stores and processes end-user personal data strictly as a processor, on behalf of the merchant, who remains the controller. Data is stored in Europe (France). A United States point of presence processes requests for merchants who choose it; the stored data stays in Europe.

Categories of personal data stored server-side

Category	Content	Persons concerned
Conversations	Messages exchanged with the AI agent and human operators, conversation summaries, satisfaction ratings and comments, files attached by the visitor	Shop visitors
Contact records and bookings	Email, name, phone, and other details voluntarily provided by a visitor or added by an operator, with consent flags, and the person's appointment requests and confirmations (timezone, answers to booking questions)	Shop visitors
Support tickets	Ticket subject, description, message bodies, customer email and name	Shop visitors
Browsing logs	Pages visited on the merchant's site during a widget session, coarse location derived from the IP address, browser and device type; used to give the assistant context on the visitor's journey, never including sensitive data	Shop visitors
Merchant account data	Operator accounts (email, name), access logs, SSO audit events	Merchant staff
Technical logs	API audit logs, webhook payloads, error diagnostics	Mixed

Visitor IP addresses are not stored: they are used in memory to derive a coarse location (country, region, city) and for rate limiting, then discarded. The IP addresses that are retained (operator logins, API calls, webhook senders) concern merchant staff and third-party systems, and are covered by the fixed retention periods below.

Retention periods

Data	Default retention	Enforcement
Conversations, messages, satisfaction data, AI conversation analyses	13 months after the last interaction; a shorter rolling period can be set in the DPA	Purged at the end of the period; deleted with the merchant account at termination; earlier deletion on merchant instruction
Contact records and bookings	3 years after the person's last activity (message, quiz, booking), unless erased earlier	Purged at the end of the period; deleted with the merchant account; individual erasure available at any time (bookings are anonymized in place)
Support tickets	3 years after the last activity on the ticket	Purged at the end of the period; deleted with the merchant account
Visitor browsing logs	14 days from collection	Automatic database-level expiry
Anonymous visitor profiles (pseudonymous id, last visit, device, country; no conversation or contact attached)	180 days after the last visit	Automatic
Aggregated visitor statistics (no direct identifiers)	3 years	Automatic
AI conversation state (orchestration checkpoints)	3 days	Automatic
LLM provider (prompts, completions, embeddings)	Zero retention: nothing is stored by the provider	Contractual and technical (Zero Data Retention mode)
Incoming webhook payloads (may contain platform customer data)	2 days	Automatic
Operator access logs (IP, browser)	90 days	Automatic
Public API audit logs (IP)	90 days	Automatic
SSO audit events (IP)	12 months	Automatic
Technical error diagnostics (may contain the triggering message text)	30 days	Automatic

Automatic enforcement relies on database-level expiry indexes: expired documents are removed by the database engine itself, continuously, without depending on an application job. The rolling periods on conversations, contact records, bookings and tickets are applied by a scheduled purge. Database backups follow their own rolling window and cycle out deleted data as they expire.

Deletion at the end of the contract

When a merchant terminates its contract, deletes its workspace, or uninstalls the Shopify app, all data scoped to that merchant is deleted: catalog, knowledge base, conversations and messages, visitors and browsing logs, contacts, bookings, tickets, satisfaction data, analytics, API credentials, and uploaded files. Deletion is completed within 30 days of the effective termination. Operator accounts whose only workspace was the deleted one are removed with it.

Selective deletion for a given person

Independently of the periods above, personal data relating to a single person can be erased at any time, typically to honor a data subject's erasure request received by the merchant:

• Contact erasure. Deleting a contact from the dashboard removes the contact record and the internal notes attached to it, anonymizes the person's booking records in place (email, name, phone, and question answers are removed; the anonymized rows are kept for statistics only), and dissociates the person's conversations from any identifier.
• Conversation content. Individual messages can be deleted by operators. Full deletion of a person's conversation transcripts is performed on merchant instruction through dpo@thehumind.com, within 30 days of the request.
• Shopify privacy webhooks. Humind subscribes to the three mandatory Shopify privacy topics. shop/redact triggers the full merchant-data deletion described above after uninstall. customers/redact triggers the erasure of that customer's identifying records in Humind. customers/data_request is acknowledged and fulfilled with the merchant through support, as the data belongs to the merchant's controllership.

Access and portability

Merchants can access and export the data they control without Humind's intervention:

• conversation data through the dashboard and the public API conversations export;
• contact and booking data through the dashboard.

Data subjects exercise their rights (access, rectification, erasure, restriction, portability) with the merchant, their controller. Humind assists the merchant as provided by Article 28(3)(e) of the GDPR; requests reaching Humind directly are forwarded to the merchant concerned.

What the merchant should plan on its side

1. Set the retention periods applicable to conversation and contact data in the DPA if the defaults (13 months and 3 years after the last activity) do not match its own retention policy.
2. Map the Humind categories above into its record of processing activities.
3. Route data subject requests concerning chat data to its own DSR process, using contact erasure and the DPO channel for the Humind part.
4. Document separately the retention of data it collects through its own tools around the widget (GA4, GTM, CMP, booking tools).

Related pages

• Privacy and browser storage: what the widget stores on the visitor's device and for how long.
• Incident management and personal data breaches: how incidents affecting this data are handled.