Delete Your Account and Data

Last updated: October 28, 2026

In accordance with the Brazilian General Data Protection Law (LGPD) and Meta's platform requirements, you have the right to have your personal data deleted from ZapClaw. The owner of an account can delete it in the dashboard, and anyone can ask us by email. Both ways are described below.

What Data We Store

When you use ZapClaw, we may store the following data associated with your account:

• Account information (name, email, hashed password or Google account, company name for agency accounts)
• If you turn on two-factor authentication for your ZapClaw sign-in: the secret of your authenticator app (stored encrypted) and your single-use recovery codes (stored as hashed values)
• WhatsApp Business Account data (WABA ID, phone number ID, encrypted access token)
• Message history (inbound and outbound messages routed through ZapClaw)
• Chat history imported from the WhatsApp Business app, if you chose to share it
• Contacts synced from the WhatsApp Business app (name and phone number)
• Webhook configuration and delivery logs
• API keys (stored as hashed values, with their name and who created each one)
• Message template data synced from Meta
• The activity log of your organization: what was done in the account and when (for example, a webhook changed, an API key created or revoked, a number connected or disconnected, a plan changed, two-factor authentication turned on or off), who did it (the person's email address, when it was someone on your team) and the IP address with its last part removed. When a business connects or removes its number through an agency's connect or removal link, the entry records no IP address. The owners and administrators of your organization see the log in Settings, Activity. Each entry is kept for 365 days.
• For a number connected through an agency's connect link: the record of the link and of the consent (time, text version, language, IP address with its last part removed and, for 30 days after the link ends, the browser used)
• If an owner or an administrator of your organization accepts our data processing agreement: each acceptance (who accepted it, with their name and email address at that moment, the details of your organization entered for it, when, the version, language and hash of the text, and the IP address with its last part removed)

Delete Your Account in the Dashboard

The owner of a ZapClaw account can delete it without writing to us: sign in at app.zapclaw.app, open Settings and choose Delete account. Only the owner sees this option; an administrator or a member can ask the owner, or write to us.

• Confirm it is you: enter your password. An account that has a password always confirms with it, even when you usually sign in with Google; only an account without a password confirms with Google instead. If two-factor authentication is on, also enter a code from your authenticator app. Then type the account's email address.
• Agency accounts: deleting the account also disconnects the numbers of every client and deletes their data. If the agency has active clients or client numbers still connected, the dashboard shows how many and asks for an extra confirmation.
• At once: nobody can sign in to the account any more, and open sessions end. API keys stop working, events are no longer forwarded to your webhooks, and open connect links and payment links are cancelled. We cancel the subscription as soon as the deletion is requested, with no refund and no credit for the unused time. If Stripe, our payment provider, cannot confirm at once that the subscription and the payment links are cancelled, we keep trying every hour. Any prepaid balance left is not refunded automatically.
• Your numbers stay yours: each number is disconnected from ZapClaw only, and its events no longer reach your ZapClaw account. We ask Meta to remove our app's webhook subscription from the WhatsApp Business Account (WABA) of each number, unless another ZapClaw account still uses that WABA. We never deregister a number, and we do not touch your message templates or the WABA itself: the number stays on WhatsApp and, with Coexistence, keeps working in the WhatsApp Business app. To move it to another provider, also disconnect it in the WhatsApp Business app: Settings, then Account, then Business Platform, and tap Disconnect Account.
• 7 days later: the account and its data are erased from ZapClaw for good, except what is listed under What Happens After Deletion. If Stripe cannot confirm at that point that nothing is left to cancel, the erasure waits for that confirmation. Until the erasure, the same email address cannot be used to sign up again, and the account's numbers cannot be connected to another ZapClaw account.
• Emails: we email the owner when the request is made, with the date the erasure is planned for, and again when the erasure is done. If you receive the first email and did not ask for the deletion, write to contato@zapclaw.app at once.

How to Request Data Deletion by Email

Write to us if you are not the owner of the account, if you cannot sign in, if you want only part of your data deleted, or for anything the dashboard does not cover. Send an email to contato@zapclaw.app with the subject line "Data Deletion Request" and include:

• The email address associated with your ZapClaw account
• Your company name
• Whether you want a full account deletion or partial data deletion (specify which data)

If an Agency Connected Your Number

If you connected your WhatsApp Business number through a connect link an agency sent you, you do not need a ZapClaw account to remove the access or to ask for deletion.

• Remove the access now: use the removal link shown at the end of the connection or sent in your receipt email. It disconnects the number from the agency's account at once.
• Remove it on Meta's side too: in the WhatsApp Business app on your phone, open Settings, then Account, then Business Platform, and tap Disconnect Account.
• Ask for deletion: send an email to contato@zapclaw.app with the subject line "Data Deletion Request" and give the phone number with its country code, or your WhatsApp Business Account ID (WABA ID). We confirm that the request comes from whoever controls the number before acting on it, and we let the agency know.

The record of your consent is kept for the period stated in section 7 of our Privacy Policy, so the authorization can be proven if it is ever disputed.

Processing Timeline

• In the dashboard: the effects described above start at once, and the erasure follows 7 days later, or later if Stripe cannot confirm at that point that nothing is left to cancel.
• By email: we acknowledge your request within 2 business days and complete the deletion within 15 business days of confirmation. You will receive an email confirmation once the deletion is complete.

What Happens After Deletion

• Your account and its data are erased from ZapClaw's database: messages, imported chat history, contacts, templates synced from Meta, webhook settings and delivery logs, API keys, the activity log and the access tokens we held. Encrypted database backups keep a copy for up to 30 days after that, and then it is gone.
• Your numbers are disconnected from ZapClaw and stay on WhatsApp: we never deregister them.
• Once the data is erased, it cannot be recovered.
• Records we must keep to meet legal obligations or to prove what was agreed are copied out of the account before it is erased and kept apart for 5 years, without names, email addresses, IP addresses or phone numbers, and then deleted: invoices (amount, currency, status and period), the history of the AI permission, the acceptances of the data processing agreement (the version and language of the text, the hash of the text accepted and of its English version, the customer's role and country, and the date) and, for numbers connected through an agency's connect link, the record of that consent (its dates and times, and the version and language of the text).
• Stripe, which processes our payments, keeps the customer record (name, email address, billing address, tax ID and payment method) and its invoices under its own retention rules: deleting the ZapClaw account does not delete them at Stripe.
• The Brazilian service invoices (NFS-e) of the account's payments, which name who paid (name and CPF, CNPJ or foreign tax ID) and the amount, stay in Brazil's national NFS-e system, with Focus NFe, which issues them, and with our accounting firm, for the periods Brazilian tax law sets: deleting the ZapClaw account does not delete them.
• PostHog, our product analytics provider, keeps the account's usage profile (account identifier, name and email address, with the usage events attached to it, which for an agency include the names it gave its clients) under its own retention rules.
• Your conversations with ZapClaw support are kept apart from the account, so deleting the account does not erase them. To have them deleted, write to contato@zapclaw.app.

Automatic Deletion

Message content is kept for the period your organization chooses: 90 days by default, configurable to 30, 7 or 0 (no content kept), and never longer than your plan allows. Messages, imported chat history and webhook delivery records are deleted automatically when that period ends. With 0, messages are stored without their text, captions and file names, the content of a webhook delivery is cleared once it is delivered and kept at most 7 days while it is not, the records are deleted after 7 days, and no chat history is imported. Each entry of the activity log is deleted 365 days after it is recorded. Cancelling a paid plan does not delete your account or its data: to delete them, use Delete account in Settings or send the request described above.

Contact

For questions about data deletion or your privacy rights:

• Email: contato@zapclaw.app