Data Retention

Zavu implements configurable data retention policies to help you manage storage and comply with data protection regulations like GDPR.

Default Retention Period

Data Type	Default Retention	Maximum Retention
Messages	90 days	180 days
Conversations	90 days	180 days
Webhook Deliveries	90 days	180 days
Agent Executions	90 days	180 days
Event log (activities)	90 days	180 days
Voice calls and transcripts	90 days	180 days

The minimum is 90 days on every plan. API logs are kept for 30 days, separately.

A conversation is deleted the configured number of days after its last message, so a thread in use is not deleted mid-conversation. Every other record is deleted that many days after it was created.

Expired data is removed by a cleanup that runs every hour and keeps going until everything expired is deleted; with a lot of volume it can take a few hours. Files a message points to (media, attachments, call recordings) are not yet deleted with the message.

Configuring Retention

You can configure the retention period for your project through the Dashboard.

Dashboard

Open Data & retention from the account menu (in the classic dashboard, under Compliance)
Choose the retention period (90 to 180 days)
Click Save changes and confirm

What's NOT Affected

The following data types are excluded from retention policies due to legal requirements:

Billing transactions - Required for financial records (7 years)
Usage and billing records - Required for billing reconciliation
API Keys - Not subject to automatic deletion
Contacts - Customer data managed separately

Exporting Your Data

Before data is deleted, you can export it for your records from the Zavu Dashboard. An export is one JSON file with all the history still kept for each type you pick (messages, conversations, webhook deliveries, agent runs, the event log, and calls with their transcripts), available for 24 hours. Contacts and templates are not included. For programmatic exports, contact our support team.

Zavu's data retention features help you comply with GDPR requirements:

Right to erasure: Data is automatically deleted after the retention period, and a contact can be deleted at any time with DELETE /v1/contacts/{contactId} (the contact and its channels go at once; its conversations and messages stay, without the contact, until their deletion date)
Data portability: Export your data from the Dashboard, or contact support for a machine-readable export
Storage limitation: Configure retention periods appropriate for your use case
Transparency: See, for each type of data, when your oldest record will be deleted

Best Practices

Export what you need: Export important data before it reaches its deletion date
Regular backups: Keep periodic backups of data you need to retain long-term
Right-size retention: Configure a retention window that matches your compliance and operational needs

Dashboard: Data Retention