# Data Retention

> Understanding Zavu data retention policies. Default retention windows and GDPR-compliant deletion.

## Data Retention

Zavu implements configurable data retention policies to help you manage storage and comply with data protection regulations like GDPR.

## Default Retention Period

| Data Type | Default Retention | Maximum Retention |
|-----------|-------------------|-------------------|
| Messages | 90 days | 180 days |
| Conversations | 90 days | 180 days |
| Webhook Deliveries | 90 days | 180 days |
| Agent Executions | 90 days | 180 days |
| Event log (activities) | 90 days | 180 days |
| Voice calls and transcripts | 90 days | 180 days |

The minimum is 90 days on every plan. API logs are kept for 30 days, separately.

A conversation is deleted the configured number of days after its **last** message, so a thread in use is not deleted mid-conversation. Every other record is deleted that many days after it was created.

> **Warning:**
> A new retention period applies to data saved from that moment on. Records already stored keep the deletion date they were given when they were saved: lengthening the period does not extend them, and shortening it does not delete anything earlier.

Expired data is removed by a cleanup that runs every hour and keeps going until everything expired is deleted; with a lot of volume it can take a few hours. Files a message points to (media, attachments, call recordings) are not yet deleted with the message.

## Configuring Retention

You can configure the retention period for your project through the [Dashboard](https://dashboard.zavu.dev/data-retention).

### Dashboard

1. Open **Data & retention** from the account menu (in the classic dashboard, under **Compliance**)
2. Choose the retention period (90 to 180 days)
3. Click **Save changes** and confirm

### What's NOT Affected

The following data types are excluded from retention policies due to legal requirements:

- **Billing transactions** - Required for financial records (7 years)
- **Usage and billing records** - Required for billing reconciliation
- **API Keys** - Not subject to automatic deletion
- **Contacts** - Customer data managed separately

## Exporting Your Data

Before data is deleted, you can export it for your records from the Zavu [Dashboard](https://dashboard.zavu.dev/data-retention). An export is one JSON file with all the history still kept for each type you pick (messages, conversations, webhook deliveries, agent runs, the event log, and calls with their transcripts), available for 24 hours. Contacts and templates are not included. For programmatic exports, contact our support team.

## GDPR Compliance

Zavu's data retention features help you comply with GDPR requirements:

- **Right to erasure**: Data is automatically deleted after the retention period, and a contact can be deleted at any time with `DELETE /v1/contacts/{contactId}` (the contact and its channels go at once; its conversations and messages stay, without the contact, until their deletion date)
- **Data portability**: Export your data from the Dashboard, or contact support for a machine-readable export
- **Storage limitation**: Configure retention periods appropriate for your use case
- **Transparency**: See, for each type of data, when your oldest record will be deleted

> **Info:**
> To delete a specific person, delete their contact from the dashboard or with `DELETE /v1/contacts/{contactId}`: the contact and its channels are removed at once; their conversations and messages stay, no longer linked to the contact, until their deletion date. For anything else, contact our support team.

## Best Practices

1. **Export what you need**: Export important data before it reaches its deletion date
2. **Regular backups**: Keep periodic backups of data you need to retain long-term
3. **Right-size retention**: Configure a retention window that matches your compliance and operational needs

## Related

- [Dashboard: Data Retention](https://dashboard.zavu.dev/data-retention)