Data retention and deletion
This page describes what personal data the Humind platform stores server-side on behalf of merchants, for how long, and through which mechanisms it is deleted: automatically at the end of a retention period, in bulk at the end of the contract, or selectively for a given person.
It is the reference description of the platform's data lifecycle, kept up to date by Humind. The contractual commitments between Humind and a given merchant are set by the service agreement and the Data Processing Agreement (DPA), which prevail in case of conflict. For data stored in the visitor's browser, see Privacy and browser storage.
At a glance
- Humind processes end-user personal data as a processor; the merchant remains the controller and sets the applicable retention instructions in the DPA.
- Technical and security logs have fixed retention periods (2 days to 12 months) enforced automatically by database-level expiry.
- Visitor browsing logs are automatically deleted 12 months after collection.
- Conversation data is retained for the duration of the commercial relationship by default; a shorter period can be set in the DPA.
- At contract termination or app uninstall, the merchant's data is deleted within 30 days.
- Individual erasure is available per person (contact deletion and anonymization), in addition to the Shopify privacy webhooks.
- LLM inference runs in Zero Data Retention mode: the AI provider stores no prompts, completions, or embeddings.
Roles and hosting
Humind stores and processes end-user personal data strictly as a processor, on behalf of the merchant, who remains the controller. Data is hosted in the region chosen by the merchant (Europe or United States) and does not move across regions.
Categories of personal data stored server-side
| Category | Content | Persons concerned |
|---|---|---|
| Conversations | Messages exchanged with the AI agent and human operators, conversation summaries, satisfaction ratings and comments, files attached by the visitor | Shop visitors |
| Contact records | Email, name, phone, and other details voluntarily provided by a visitor or added by an operator, with consent flags | Shop visitors |
| Booking data | Appointment requests and confirmations: email, name, phone, timezone, answers to booking questions | Shop visitors |
| Support tickets | Ticket subject, description, message bodies, customer email and name | Shop visitors |
| Browsing logs | Pages visited on the merchant's site during a widget session, referrer, coarse location derived from the IP address, browser and device type | Shop visitors |
| Merchant account data | Operator accounts (email, name), access logs, SSO audit events | Merchant staff |
| Technical logs | API audit logs, webhook payloads, error diagnostics | Mixed |
Visitor IP addresses are not stored: they are used in memory to derive a coarse location (country, region, city) and for rate limiting, then discarded. The IP addresses that are retained (operator logins, API calls, webhook senders) concern merchant staff and third-party systems, and are covered by the fixed retention periods below.
Retention periods
| Data | Default retention | Enforcement |
|---|---|---|
| Conversations, messages, satisfaction data, AI conversation analyses | Duration of the commercial relationship with the merchant; a shorter rolling period can be set in the DPA | Deleted with the merchant account at termination; earlier deletion on merchant instruction |
| Contact records | Duration of the commercial relationship, unless erased earlier | Deleted with the merchant account; individual erasure available at any time |
| Booking data (appointments, leads) | Duration of the commercial relationship, unless erased earlier | Deleted with the merchant account; anonymized in place on individual erasure |
| Support tickets | Duration of the commercial relationship | Deleted with the merchant account |
| Visitor browsing logs | 12 months from collection | Automatic database-level expiry |
| Aggregated visitor statistics (no direct identifiers) | 12 months | Automatic |
| AI conversation state (orchestration checkpoints) | 7 days | Automatic |
| LLM provider (prompts, completions, embeddings) | Zero retention: nothing is stored by the provider | Contractual and technical (Zero Data Retention mode) |
| Incoming webhook payloads (may contain platform customer data) | 2 days | Automatic |
| Operator access logs (IP, browser) | 90 days | Automatic |
| Public API audit logs (IP) | 90 days | Automatic |
| SSO audit events (IP) | 12 months | Automatic |
| Technical error diagnostics (may contain the triggering message text) | 30 days | Automatic |
Automatic enforcement relies on database-level expiry indexes: expired documents are removed by the database engine itself, continuously, without depending on an application job. Database backups follow their own rolling window and cycle out deleted data as they expire.
Deletion at the end of the contract
When a merchant terminates its contract, deletes its workspace, or uninstalls the Shopify app, all data scoped to that merchant is deleted: catalog, knowledge base, conversations and messages, visitors and browsing logs, contacts, bookings, tickets, satisfaction data, analytics, API credentials, and uploaded files. Deletion is completed within 30 days of the effective termination. Operator accounts whose only workspace was the deleted one are removed with it.
Selective deletion for a given person
Independently of the periods above, personal data relating to a single person can be erased at any time, typically to honor a data subject's erasure request received by the merchant:
- Contact erasure. Deleting a contact from the dashboard removes the contact record and the internal notes attached to it, anonymizes the person's booking records in place (email, name, phone, and question answers are removed; the anonymized rows are kept for statistics only), and dissociates the person's conversations from any identifier.
- Conversation content. Individual messages can be deleted by operators. Full deletion of a person's conversation transcripts is performed on merchant instruction through dpo@thehumind.com, within 30 days of the request.
- Shopify privacy webhooks. Humind subscribes to the three mandatory Shopify privacy topics.
shop/redacttriggers the full merchant-data deletion described above after uninstall.customers/redacttriggers the erasure of that customer's identifying records in Humind.customers/data_requestis acknowledged and fulfilled with the merchant through support, as the data belongs to the merchant's controllership.
Access and portability
Merchants can access and export the data they control without Humind's intervention:
- conversation data through the dashboard and the public API conversations export;
- contact and booking data through the dashboard.
Data subjects exercise their rights (access, rectification, erasure, restriction, portability) with the merchant, their controller. Humind assists the merchant as provided by Article 28(3)(e) of the GDPR; requests reaching Humind directly are forwarded to the merchant concerned.
What the merchant should plan on its side
- Set the retention period applicable to conversation data in the DPA if the default (duration of the relationship) does not match its own retention policy.
- Map the Humind categories above into its record of processing activities.
- Route data subject requests concerning chat data to its own DSR process, using contact erasure and the DPO channel for the Humind part.
- Document separately the retention of data it collects through its own tools around the widget (GA4, GTM, CMP, booking tools).
Related pages
- Privacy and browser storage: what the widget stores on the visitor's device and for how long.
- Incident management and personal data breaches: how incidents affecting this data are handled.