Data Deletion

1. Who can request deletion

Individuals may request deletion of Personal Data that Zayloft controls directly where applicable law gives that right. Customers may also request deletion of account information or Customer Content according to the Agreement, product functionality and applicable law.

A deletion request does not automatically apply to data controlled by another organization. If Zayloft processes Personal Data only on behalf of a Customer, the Customer normally controls the request and Zayloft assists that Customer as required by the applicable agreement and law.

2. How to submit a request

Send a request to support@zayloft.com with “Data deletion request” in the subject line. Include enough information to identify the relevant relationship without sending passwords, API keys, access tokens, SMPP passwords, webhook secrets or other credentials.

Useful information can include your name, the email address associated with the account, the organization or Customer involved, the relevant service, account or project reference, and a description of the data you want deleted.

If the request concerns Customer Content controlled by a Zayloft Customer, identify that Customer so the request can be routed appropriately.

3. Identity and authority verification

Before deleting data, Zayloft may take reasonable steps to verify identity, account relationship and authority. The verification method will be proportionate to the sensitivity of the data and the risk of unauthorized deletion.

An authorized agent may submit a request where applicable law allows it, but Zayloft may require evidence of the agent’s authority and may separately verify the identity of the person whose data is involved.

Zayloft will not ask a requester to disclose account passwords or secret API credentials to verify a deletion request.

4. What happens after a request is received

Zayloft will determine whether it acts as controller, business, processor, service provider, contractor or another role for the relevant data and will route the request accordingly.

Where a deletion right applies, Zayloft will process the request within the period required by applicable law. Where an exception or limitation applies, Zayloft may retain the affected data and will provide the legally required explanation where appropriate.

If additional information is reasonably necessary to locate the data or verify the request, Zayloft may ask for that information before completing the request.

5. Website, contact and support information

A valid request can cover Personal Data collected through Zayloft websites, public contact forms, support interactions, account registration, marketing preferences or similar direct interactions where Zayloft controls the information and no retention exception applies.

Deletion of support correspondence may be limited where records are needed for security, dispute resolution, fraud prevention, legal compliance or protection of rights.

6. Account and organization information

Account deletion can include eligible profile information, user records, organization membership and account-level information that no longer needs to be retained.

Closing a user profile does not necessarily delete an organization, project, billing record or Customer Content belonging to an organization. Account owners and administrators may have separate authority over organization-level resources.

Before closing an account, Customers should export information they are entitled to retain and confirm that production integrations, senders, numbers, credentials, webhooks and dependent applications have been handled appropriately.

7. Customer Content

Customer Content can include recipient identifiers, phone numbers, email addresses, contact attributes, message content, templates, verification data, uploaded documents, prompts, outputs and other information a Customer submits to the Services.

Where Zayloft processes Customer Content as a processor or service provider, deletion is performed according to the Customer’s documented instructions, configured product controls, the Data Processing Terms and applicable law.

An individual whose data is contained in Customer Content should normally contact the Customer that collected or submitted the data. Zayloft will assist that Customer with deletion where required.

8. Communications, verification and event data

Deletion can apply to eligible message, email, voice, verification, delivery, inbound, webhook or event data, subject to product capabilities and retention requirements.

Some metadata can remain where needed to maintain suppression, prevent repeat contact, investigate abuse, reconcile billing, prevent fraud, preserve security logs, demonstrate compliance or satisfy legal obligations.

A suppression record retained solely to prevent future communications may contain limited information necessary to honor an opt-out and should not be reused for unrelated marketing.

9. AI and NLP data

If Customer enables AI or NLP functionality, deletion requests can apply to eligible prompts, documents, retrieved content, embeddings, outputs and related metadata according to the configured Service, Customer instructions and applicable law.

Deleting source content may not automatically remove information from every independently generated output or from a model that is not designed to retain Customer-specific content. Product-specific behavior and contractual settings govern the applicable deletion process.

Where an external model or infrastructure provider processes data as a subprocessor, Zayloft will pass through deletion instructions as required by the Data Processing Terms and applicable law.

10. Legal and operational exceptions

Deletion rights are not absolute. Zayloft may retain information where applicable law permits or requires retention, including for legal obligations, establishment or defense of legal claims, fraud prevention, security, accounting, taxation, regulatory requirements, contract enforcement, dispute resolution or protection of rights and safety.

Zayloft may also retain information where deletion would interfere with another person’s rights or where a specific legal exception to erasure or deletion applies.

11. Billing, tax and transaction records

Invoices, payment records, credits, usage records, tax records and transaction information may need to be retained for accounting, tax, audit, dispute, fraud-prevention or legal purposes even after an account is closed.

Retention of these records does not authorize their use for unrelated marketing or new purposes that are incompatible with the reason they were retained.

12. Security, abuse and audit records

Security logs, authentication events, request identifiers, abuse records, administrative actions and evidence related to fraud or policy violations may be retained for a reasonable period where necessary to protect the Services, investigate incidents, prevent repeat abuse or meet legal obligations.

Where practical, retained records should be limited to information necessary for those purposes and access should remain restricted.

13. Backups and technical deletion cycles

Deletion from active production systems may occur before data is removed from backups, disaster-recovery systems, replicas or other protected copies.

Backup copies are normally isolated from ordinary production use and are removed or overwritten through scheduled retention and recovery cycles. Data retained only in backup copies will remain subject to applicable safeguards and will not be restored for unrelated use.

If a backup must be restored for legitimate recovery purposes, deletion controls should be reapplied as reasonably necessary.

14. Customer self-service deletion

Where Zayloft provides deletion controls in an account, API or product interface, Customers should use those controls for routine deletion because they can provide the most direct and auditable path.

Customer administrators are responsible for ensuring that users with deletion privileges are properly authorized and for understanding the effect of permanent deletion on applications, records and downstream systems.

15. Account closure

A request to close an account is not necessarily identical to a request to delete every item of Personal Data. Account closure can trigger service termination, credential revocation, project shutdown and lifecycle processes while certain data remains subject to legal or contractual retention.

Zayloft may require outstanding charges, active contractual commitments, disputed activity, security investigations or organization ownership issues to be resolved before final account closure where permitted by the Agreement and law.

16. Downstream systems and recipients

Deleting information from Zayloft does not automatically delete copies already lawfully transmitted to telecommunications networks, mailbox providers, message recipients, Customer systems, third-party integrations or other independent recipients.

Where Zayloft acts as processor and a subprocessor still holds Customer Personal Data, Zayloft will provide deletion instructions to that subprocessor as required by the Data Processing Terms.

Customers are responsible for deletion obligations in their own systems and in third-party systems they control independently.

17. EEA, United Kingdom and Switzerland

Where the GDPR, UK GDPR or applicable Swiss data-protection law applies, individuals may have a right to erasure in specified circumstances. That right is subject to statutory grounds and exceptions, including circumstances where processing remains necessary for legal obligations, certain public-interest purposes, legal claims or other grounds recognized by law.

Where Zayloft acts only as processor for a Customer, the Customer remains responsible for deciding the request and Zayloft provides the assistance required by its processor obligations.

18. California and other U.S. states

Where an applicable U.S. state privacy law provides a right to delete, a verified consumer can request deletion subject to statutory exceptions. Zayloft will also direct service providers, contractors or processors to delete or handle affected Personal Information as required by the applicable law and contractual relationship.

Where Zayloft acts solely as a service provider, contractor or processor for a Customer, the Customer generally receives and decides the consumer request, and Zayloft assists as required.

A consumer who uses a separate state-operated deletion mechanism for registered data brokers should follow that mechanism where it applies to a business that is legally classified and registered as a data broker.

19. Brazil

Where Brazil’s LGPD applies, individuals may have rights concerning deletion of Personal Data processed on the basis of consent and other rights provided by law. Legal retention exceptions can continue to apply after a deletion request.

Where Zayloft acts as operador for a Customer acting as controlador, Zayloft follows the controlador’s lawful deletion instructions and assists with applicable Data Subject rights.

20. Minors and authorized representatives

Requests involving a minor may require verification of parental responsibility, guardianship or other lawful authority depending on the jurisdiction and the relationship.

Where the data is controlled by a school, employer, platform, parent-facing service or another Zayloft Customer, the requester should normally contact that Customer first so the request can be assessed in the correct context.

21. Confirmation and limitations

Where appropriate and legally required, Zayloft will confirm completion of a deletion request or explain that some data could not be deleted because an exception, retention duty, identity-verification issue or other lawful limitation applies.

Zayloft may maintain a minimal record of the request and its disposition where reasonably necessary to demonstrate compliance, prevent repeated processing, resolve disputes or meet legal obligations.

22. Appeals and complaints

Where applicable law provides a right to appeal a denied privacy request, Zayloft will provide or identify the applicable appeal method. A requester may also have the right to complain to a competent privacy or data-protection authority.

If the request concerns Customer Content controlled by a Zayloft Customer, complaints about the Customer’s decision should generally be directed to that Customer or the authority that has jurisdiction over the Customer.

23. Security of deletion requests

Do not include passwords, one-time codes, API keys, SMPP passwords, access tokens, webhook secrets, private cryptographic material or unnecessary sensitive Personal Data in a deletion request.

Zayloft may refuse to act on instructions received through a compromised, unverifiable or unauthorized channel until appropriate verification is completed.

24. Contact and policy changes

Submit deletion requests to support@zayloft.com with “Data deletion request” in the subject line. Privacy questions can use “Privacy question”.

Zayloft may update this Policy when services, deletion tools, data flows or legal requirements change. Where applicable law requires additional notice of a material change, Zayloft will provide that notice through an appropriate channel.