Delete your data.
If you use ComplyChat through an organisation – a school, charity or care provider – you can ask for the data held about you to be deleted. This page explains how to ask, what gets deleted and when, and – honestly – which copy belongs to your organisation rather than to us.
How to request deletion
Any of these three routes works. You do not need to give a reason.
- In the app. Open Settings → Your data → Request deletion of my data and confirm. Your organisation and ComplyChat are both notified at once, and the request is logged.
- By SMS. Text your request from the phone number you registered with to the ComplyChat number your organisation gave you. Because it comes from your registered number, we can match it to your account without asking for anything else.
- By email. Write to compliance@chat.org.uk, telling us the phone number you registered with and the organisation whose channels you use. That mailbox is monitored by the person responsible for data protection at CIaaS Limited.
Whichever route you use, we will respond within one month (extendable by two further months for complex requests, with notice to you). We will not charge a fee unless the request is manifestly unfounded or excessive.
What gets deleted, and when
There are two copies of governed conversation data, and they have different owners. Being straight about that is the point of this page.
The governed record belongs to the customer organisation. The permanent record of governed conversations rests in your organisation's own Microsoft 365 tenant, and your organisation – the school, charity or care provider running the channel – is the controller of that data. They decide who joins, what is discussed, how long it is kept, and who is told. Retention of the archive is determined and enforced by the customer in their own Microsoft 365 tenant, using Microsoft Purview retention policies. When you ask for deletion, your organisation reviews the request for that record – it may have legal or safeguarding duties to keep parts of it, and that decision is theirs, not ours.
The working copy is ours to delete. To operate the live room, our multi-tenant Azure SQL holds a working copy of message content; transient operational data on our systems is kept only as long as capture and relay require. When a deletion request is actioned, we erase your identity from that working copy – your name and phone number are overwritten, your account and sign-in records are removed, and staged media is hard-deleted – so nothing on our systems identifies you.
Deleted from ComplyChat's systems when your request is actioned
- Your account: the phone number, display name and profile picture held for you, and your sign-in credentials (including any passkeys).
- Your identity in the working copy of messages: identifying details are overwritten so the remaining operational data no longer names you.
- Staged media awaiting delivery, and push-notification registrations for your devices.
Kept, and by whom
- The governed record – kept by your organisation in its own Microsoft 365 tenant, under its own retention policies, for as long as its legal and safeguarding duties require. Requests about that record go to your organisation as controller; if you are unsure who the controller is, write to us and we will tell you.
- Our audit trail – a minimal, content-free log that a deletion request was received and actioned, kept so we can demonstrate we handled it properly.
- Billing and accounting records – where they concern you (rare for app users), as required by HMRC, currently six years.
Your rights
Deletion is one of several rights you have under the UK GDPR: the right to be informed, the right of access, the right to rectification, the right to erasure ("right to be forgotten"), the right to restrict processing, the right to data portability, and the right to object. Our privacy notice explains each, and which of us – ComplyChat or your organisation – answers for which data.
If you are unhappy with how a request has been handled, please write to compliance@chat.org.uk first and give us the chance to put it right. You also have the right to complain to the Information Commissioner's Office at any time: ico.org.uk, 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.