User Data Deletion Instructions & Self-Service Erasure Portal

1. Self-Service Data Deletion Request & Confirmation Code Tracker

You may request immediate deletion of your conversation history, voice recordings, phone tokens, or account records using the form below, or check the status of a Meta Data Deletion Callback confirmation code.

2. How to Remove Kroyon & Delete Data via Facebook or Instagram Settings

If you connected a Facebook Page or Instagram Professional Account to Kroyon Converse (App ID: 1149409244430472), or interacted with a merchant using Kroyon, you can revoke access and trigger automatic data deletion directly from your Facebook or Instagram account settings:

2.1 From Facebook (Web or Mobile App)

1. Log into your Facebook account and click your profile picture in the top-right corner.
2. Select Settings & privacy → Settings.
3. In the left sidebar, click Apps and Websites (or Business Integrations for Page admins).
4. Locate Kroyon Converse (or Kroyon) in the list of active apps.
5. Click Remove next to Kroyon Converse.
6. Check the box labeled “Delete posts, videos or events Kroyon Converse posted on your timeline” and click Remove to confirm.
7. Facebook will automatically invoke Kroyon’s signed Data Deletion Callback endpoint and provide you with a Confirmation Code and a link back to this page to track deletion progress.

2.2 From Instagram (Professional / Creator Account)

1. Open the Instagram app and go to your profile → tap the menu icon (☰) → Settings and activity.
2. Navigate to Website permissions → Apps and websites.
3. Under Active, select Kroyon Converse and tap Remove.

3. How to Delete Data from WhatsApp, Self-Hosted WASender & Website Chat Widgets

• Website Chat Widget (“Delete from memory” One-Click Button): Every Kroyon Converse website chat widget includes a built-in Delete from memory control in the widget header. Clicking it immediately purges your active session transcript, voice notes, and AI memory from the store’s inbox.
• WhatsApp Cloud API & Self-Hosted WASender Channels: Send the message /delete-my-data or STOP in your WhatsApp thread with the merchant, or submit your WhatsApp phone number in the Self-Service Erasure form at the top of this page.
• Merchant Channel Disconnection: Workspace owners can disconnect any Messenger, Instagram, WhatsApp Cloud API, or Self-Hosted WASender session at any time under Dashboard → Converse → Channels → Disconnect & Purge.

4. Automated Meta Data Deletion Callback Endpoint (Technical Specification)

In addition to the instructions on this page, Kroyon implements Meta’s automated signed_request Data Deletion Callback protocol:

• Data Deletion Instructions URL: https://kroyon.app/data-deletion
• Automated Callback Endpoint: POST https://api.kroyon.app/v1/converse/hooks/meta/data-deletion
• Cryptographic Verification: Kroyon validates the HMAC-SHA256 signature of Meta’s signed_request payload using our META_APP_SECRET, redacts/deletes all conversation records associated with the user_id, and returns a JSON payload conforming to Meta’s specification:

{
  "url": "https://kroyon.app/data-deletion?code=KRY-DEL-2026-8F4C20",
  "confirmation_code": "KRY-DEL-2026-8F4C20"
}

5. What Gets Deleted, SLA Timeline & Statutory Retention Exceptions

Upon receiving a verified deletion request:

• Immediate Action (< 5 minutes): Connected OAuth tokens are revoked, active Redis session caches are invalidated, and automated AI follow-ups or broadcasts to the user are halted.
• Primary Database & Media Storage Purge (≤ 72 hours): Chat messages, voice recordings, customer profile fields, and raw identifiers in PostgreSQL and Hetzner Object Storage are permanently deleted or irreversibly anonymized.
• Encrypted Disaster-Recovery Backups (≤ 30 days): Residual encrypted backup snapshots in Falkenstein (fsn1), Germany roll off automatically within 30 days.
• Statutory Exceptions (GDPR Art. 17(3), CCPA § 1798.105(d) & Bangladesh Tax/Commerce Law): Where required by law, Kroyon or the Merchant may retain minimal immutable financial invoice records, tax/VAT ledger entries, or one-way cryptographic fraud-prevention hashes strictly necessary to comply with legal obligations or defend legal claims.