Keep what is needed. Delete what is not.

This Policy applies to account data, workspace content, operational records, credentials, billing records, backups, and metrics. A shorter signed customer period applies where feasible; a longer legal requirement controls only affected data. Deletion includes secure erasure, cryptographic erasure, irreversible anonymization, or controlled lifecycle expiry.

The table is the default. A signed order form or lawful hold may modify a specific row.

Enforcement status, October 2, 2026: our policy is to complete accepted erasure requests within 30 days, subject to lawful exceptions. What runs automatically today: the tenant audit log (the record of actions taken in a workspace) is removed after 30 days, and a few operational records (delivery queues, page-visit records, and duplicate-request markers) are removed on a schedule. Conversation logs are not deleted automatically at their 90-day period. For every other period in the table, the period is our commitment, but removal at the end of that period is not yet automatic. We fulfill those through a deletion request, and you can email privacy@armalo.ai to confirm what has been deleted for your account. Request logs have no automatic expiry yet. They are append-only and cannot yet be deleted on request; if a request covers them, we will tell you.

Users may delete eligible content. Owners and authorized administrators may delete workspaces. Account holders may request account deletion; Data Subjects may email privacy@armalo.ai. Valid erasure requests are fulfilled within 30 days unless law permits or requires an extension. Active records, indexes, caches, derived artifacts, controlled replicas, and applicable subprocessor copies are included.

Account deletion disables access and starts deletion. Personal workspaces owned only by that account are scheduled for deletion; organization workspaces remain under organization authority. Credentials are revoked, cloud workspaces and previews terminate, and active data is removed within 30 days. Legally required billing records remain for seven years. Database backup copies expire within the 7-day rotation after live deletion.

Indefinite aggregated metrics must be anonymous, not merely pseudonymous. Names, email, full IP, OAuth and account IDs, workspace IDs, repository URLs, identity-bearing paths, raw messages, credentials, prompts, source code, and customer file content are excluded or removed. Hashing alone is not anonymization where re-identification remains reasonably possible.

Encrypted database backups use a 7-day rotation and are restricted to resilience and recovery. They are not used for analytics or ordinary access. User-uploaded files are not currently backed up, so a restore cannot recover them; backup coverage for uploads is planned. Active deletion completes on an accepted request; affected database backup generations expire within the 7-day rotation after live deletion. Restore procedure requires reapplying deletion markers before normal operation.

Backups are encrypted and stored in the Hetzner environment in the United States (Hetzner us-west) with Cloudflare edge controls; cloud workspace snapshots follow the same residency.

Deletion can pause for a scoped legal hold, proportionate security or fraud investigation, tax or accounting duty, sanctions or regulatory requirement, legal claim, or minimal suppression record. Exception data is need-to-know, cannot be repurposed incompatibly, and is deleted when the exception ends.

Material retention changes receive at least 60 days’ notice unless law or urgent security needs require earlier effect. Armalo will not retroactively extend data already scheduled for deletion without a valid basis.