1. What can be deleted
The following categories of data can be deleted from the Kuluara platform upon valid request:
- Account data: User accounts, profiles, login credentials, and authentication records.
- CRM data: Contacts, companies, deals, pipeline records, notes, tags, custom fields, and all associated metadata.
- Message data: All messages, conversation history, read receipts, and delivery statuses from WhatsApp, Telegram, Instagram, and email channels.
- Files and attachments: All documents, images, audio, and other files uploaded to or exchanged through the platform.
- Integration records: Connected channel configurations, OAuth tokens, and webhook settings.
- Workspace-level data: Entire workspace data including all of the above, subject to identity verification and legal exceptions.
2. How to request deletion
Email-based request
To request deletion of account or workspace data, send an email to info@kuluara.com with the subject line "Data Deletion Request". Include the following information:
- Your full name.
- Your account email address.
- Your organization or workspace name.
- A clear description of what data you want deleted (specific records, entire account, or full workspace).
- If applicable, the connected integration or channel involved (e.g., WhatsApp, Telegram, Instagram).
- If you are acting on behalf of a company, confirmation that you are authorized to make the request (e.g., workspace owner or administrator role).
In-product deletion
Authorized users can delete certain records directly within the Kuluara platform, including contacts, deals, comments, tags, pipeline elements, and team member records, subject to permissions and workspace business rules.
Deleting a parent record (such as a contact or deal) may permanently remove associated child records including messages, notes, and linked attachments. This action is irreversible.
3. Meta Data Deletion Callback
In compliance with Meta Platform requirements, Kuluara implements a Data Deletion Callback endpoint. This is a server-to-server mechanism that allows Meta to programmatically request deletion of user data when a user removes the Kuluara app from their Facebook or Instagram settings.
When Meta triggers a data deletion callback, the following process occurs:
- Meta sends a signed deletion request to the Kuluara server callback URL, containing the user's Meta platform user ID.
- Kuluara verifies the request signature using the app secret to confirm it originated from Meta.
- Kuluara identifies all data associated with the Meta user ID, including Instagram and Facebook Messenger message data, lead form submissions, and integration tokens.
- The identified data is queued for deletion and a unique confirmation code is generated.
- Kuluara returns a JSON response to Meta containing the confirmation code and a status check URL where the deletion progress can be verified.
- The data is deleted from primary systems within 30 days and purged from backups within 90 days.
This callback mechanism operates automatically and does not require manual action from the Kuluara customer. However, customers should be aware that if an end user removes the app from their Meta account, the corresponding Meta-sourced data in the customer's workspace may be deleted.
4. User account deletion
If a workspace administrator requests deletion of a user account within their workspace, Kuluara will:
- Reassign or unassign records (deals, contacts, conversations) owned by the departing user, as directed by the administrator.
- Remove the user profile and authentication record from the workspace.
- Revoke all active sessions and tokens associated with the deleted user account.
Administrative verification (workspace owner or admin role) is required before this process is executed.
5. Integration-related deletion
If data originates from connected services such as Meta (WhatsApp, Instagram, Lead Ads), Telegram, or email providers, the deletion process includes:
- Disconnection and revocation of the integration (OAuth tokens, webhook registrations).
- Deletion of all message data, contact data, and metadata received through that integration.
- Removal of channel configuration and connection records.
For Meta-specific integrations, if you connected a WhatsApp Business account, Instagram Professional account, or Facebook Page and want all associated platform data removed, send a request to info@kuluara.com with the subject line "Kuluara Data Deletion Request". Include the workspace name, connected channel type, approximate connection date, and any relevant page, account, or business identifiers.
6. Scope of deletion
What is deleted
- All personal data associated with the account, workspace, or specified records.
- All CRM records (contacts, deals, companies, notes, tags, custom fields).
- All message data from connected channels (WhatsApp, Telegram, Instagram, email).
- All files and attachments uploaded to or received through the platform.
- Integration tokens, webhook configurations, and channel settings.
- User profiles, preferences, and authentication records.
What is NOT deleted
- Anonymized analytics data: Aggregated, de-identified data that can no longer be linked to an individual or workspace. This data is used to improve the service and does not constitute personal data.
- Legal-hold data: Data that Kuluara is legally required to retain, such as billing records required by Indonesian tax law (retained for 5 years), records subject to ongoing legal proceedings, or data preserved pursuant to valid legal process.
- Security and fraud prevention logs: Minimal records necessary for abuse prevention and security investigations, retained for up to 12 months.
7. Deletion timeline
| Stage | Timeline | Description |
|---|---|---|
| Acknowledgment | 72 hours | We acknowledge receipt of the deletion request and confirm scope. |
| Primary deletion | 30 days | Data is deleted from all primary (active) database systems, file storage, and application caches. |
| Backup purge | 90 days | Data is purged from backup and disaster recovery systems as backup rotation cycles complete. |
During the period between primary deletion and backup purge, data may exist in encrypted backup systems but is not accessible through the Kuluara application or APIs.
8. Confirmation process
After a deletion request is processed, you will receive:
- An email confirmation acknowledging the request within 72 hours of receipt.
- A follow-up email confirming that primary deletion has been completed, including a summary of the data categories deleted and any exceptions applied.
- For Meta Data Deletion Callback requests: a unique confirmation code and status check URL are returned to Meta automatically. The end user can verify deletion status through Meta's platform.
If we require additional information to verify your identity or authority before processing the request, we will contact you at the email address provided.
9. Data subject rights
This data deletion process supports the exercise of data subject rights under applicable data protection laws, including:
- GDPR Article 17(Right to erasure / "right to be forgotten") for EU/EEA data subjects.
- Indonesia PDP Law (Right to request deletion or destruction of personal data) for Indonesian data subjects, with a 72-hour acknowledgment SLA.
For detailed information about your full data protection rights, please refer to our Privacy Policy.
10. Contact
All deletion requests, follow-up questions, and inquiries about the deletion process can be directed to:
General requests: info@kuluara.com
Data Protection Contact: info@kuluara.com