Data & privacy controls

When it's time to leave, you should be able to take your data and go, without emailing support or waiting on a ticket. This page covers the controls you hold over your own data: deleting your account yourself, the Data Processing Agreement, and how AnyBot records your acceptance of each legal document, version by version.

Delete your account

Account deletion is self-service, no support ticket required. Confirming deletion sends a POST /me/delete request, which starts a deliberate, two-phase process. Nothing is destroyed on the spot.

Before anything is disabled, AnyBot runs three guards:

• Confirm you mean it. You type DELETE to confirm, and password users re-enter their password. Accounts that sign in only through Google or another provider (no password to check) must have signed in recently instead.
• Protect your team. If you're the sole owner of a space that still has other active members, the request is refused. Transfer ownership or remove the other members first, so no one else's team is left orphaned.
• Settle billing. Any active paid subscription is canceled first. If that cancellation can't be confirmed, the whole deletion safely aborts. You're never left disabled but still billed.

Once the guards pass, your account is disabled immediately: sign-in is blocked, and every session and long-lived token is revoked on the spot. Your data still exists, but no one can reach it.

The grace window

Disabling is reversible; destruction is not, so AnyBot keeps them separate. After you delete, your account enters a 30-day grace window. Throughout that window the account is fully dark but recoverable: if you deleted by mistake, contact support and an operator can restore it (which clears the deletion flags and re-enables sign-in). Once the window elapses, restoration is no longer possible.

After the grace window, a scheduled sweep performs the irreversible purge, tearing down your owned spaces and their content, hard-deleting your personal data, and anonymizing anything that must remain for another team's records (for example, an audit entry, or a referral your account is tied to). Your user record is never truly hard-deleted; instead its personal fields are cleared and the email replaced with a non-routable placeholder, so foreign keys and the tamper-evident audit chain stay intact.

Your Data Processing Agreement (DPA)

For teams that process personal data through AnyBot, a Data Processing Agreement is available on request. It sets out the controller and processor roles, the categories of data and data subjects, sub-processors, and the safeguards used for international transfers. See the Data Processing Agreement.

GDPR data-subject requests that go beyond self-deletion (a full data export, or an erasure that anonymizes your record in place while keeping foreign keys and the audit trail intact) are handled by an operator on request rather than a self-service button.

Per-version legal acceptance

AnyBot doesn't just ask you to "accept the terms" once and forget it. Each legal document (the Privacy Policy, Terms and Conditions, and others) is versioned, and your acceptance is recorded against the specific version you agreed to, with a timestamp.

When a document is republished as a new version, your earlier acceptance no longer matches the current version. The next time you're in the app, AnyBot surfaces a re-acceptance prompt so you can review the full text, translated to your language when a translation exists, before accepting again. You can check your standing at any time:

GET  /legal                  — active legal documents + their current versions
GET  /legal/acceptances      — your acceptance status per required document
POST /legal/{slug}/accept    — record acceptance of the current version

Each acceptance status tells you whether you've accepted, which version you accepted, and whether a newer version now needs re-acceptance.

What's recorded

Deletion and governance actions are written to the tamper-evident audit log: account.self_deleted when you request deletion, account.restored if an operator brings it back, and account.purged when the grace window elapses. Those entries carry counts and flags only, never the personal data itself.

Next

• Security & data handling
• Audit log
• Roles & permissions
• Spaces & isolation