Data Deletion Policy

This Policy applies to data processed by Asiyst in connection with:

• Asiyst accounts.
• Projects and workspaces.
• AI assistants and avatars.
• Conversations and interactions.
• Knowledge sources.
• Uploaded files.
• API and SDK usage.
• CLI usage.
• Account configuration.
• Support interactions.
• Other information processed through the Services.

The exact data that can be deleted depends on the type of information, how it was created, and applicable legal or contractual requirements.

Subject to applicable law and contractual obligations, you may request deletion of personal information associated with your Asiyst account.

Depending on the circumstances, deletion may include:

• Account information.
• Profile information.
• Project information.
• Configurations.
• Conversations.
• Uploaded content.
• Knowledge-source information.
• AI assistant or avatar configurations.
• API-related account information.
• Other information associated with your account.

Not all information can necessarily be deleted immediately or completely.

You may request deletion through an available account-management feature or by contacting Asiyst.

Deletion requests should provide enough information for Asiyst to identify the relevant account or information.

You may be asked to verify ownership or control of the account before a deletion request is processed.

If you request deletion of your Asiyst account, Asiyst may delete or de-identify information associated with the account, subject to the exceptions described in this Policy.

Account deletion may result in permanent loss of:

• Projects.
• Assistants.
• Avatars.
• Knowledge sources.
• Conversations.
• Configurations.
• API credentials.
• Other account-related information.

You should export any information you need before requesting account deletion where export functionality is available.

Depending on the applicable Service, you may be able to delete individual projects, workspaces, or other resources without deleting your entire account.

Deleting a project or workspace may result in deletion of associated:

• Configurations.
• Integrations.
• Knowledge sources.
• Assistants.
• Avatar settings.
• API-related project information.
• Project activity information.

The exact scope may depend on the Service and account configuration.

Where the Services allow users to delete conversations or interaction history, deletion may remove the corresponding information from active systems.

Deletion from an application interface does not necessarily mean that every copy is immediately removed from all systems.

Copies may temporarily remain in:

• Backups.
• Security logs.
• Disaster-recovery systems.
• Audit records.
• Other systems where immediate deletion is technically impractical.

Such information may be retained only for the applicable purpose and period.

Users may be able to delete files, documents, websites, or other knowledge sources connected to their Asiyst projects.

Deleting a knowledge source may prevent it from being used by the associated assistant, but it may not immediately remove every historical copy or technical record.

Where applicable, deletion may propagate through relevant processing systems according to their normal deletion processes.

If you use Asiyst APIs, SDKs, or CLI tools, deletion may affect information associated with:

• Projects.
• API keys.
• API configurations.
• Usage records.
• Request metadata.
• Developer settings.
• Integration settings.

Certain technical records may need to be retained for security, fraud prevention, billing, accounting, or legal purposes.

Deleting an account or project may result in associated API keys being revoked.

If you no longer want a particular API key to remain active, you should revoke it rather than waiting for account deletion.

Revoked credentials may remain in security or audit records for an appropriate period.

Deletion of an Asiyst account does not necessarily result in immediate deletion of payment or transaction records.

Asiyst may retain certain financial information where necessary to:

• Complete transactions.
• Process refunds.
• Resolve disputes.
• Maintain accounting records.
• Detect fraud.
• Comply with tax requirements.
• Comply with legal obligations.

Payment information may also be processed or retained by third-party payment providers according to their own policies and legal obligations.

Asiyst may retain information where necessary to:

• Comply with applicable law.
• Respond to lawful requests.
• Establish or defend legal claims.
• Prevent fraud.
• Investigate security incidents.
• Enforce contractual terms.
• Maintain required business records.

Where information is retained for one of these reasons, Asiyst may restrict its use to the relevant purpose.

Certain information may need to remain available after account deletion for security purposes.

Examples may include:

• Security logs.
• Authentication records.
• Abuse-prevention records.
• Fraud indicators.
• Incident records.
• Audit information.
• Records associated with policy violations.

Retention of such information does not mean the account remains active.

Deleted information may remain temporarily in encrypted or otherwise protected backups.

Backup copies may be retained for disaster recovery, security, operational continuity, or other legitimate purposes.

Backup information may be automatically overwritten or deleted according to applicable backup-retention procedures.

Backups are not ordinarily restored solely to recover deleted user information unless required for legitimate operational or legal reasons.

Asiyst may rely on third-party service providers for functions such as:

• Hosting.
• Storage.
• Authentication.
• Payments.
• Email.
• Analytics.
• AI processing.
• Infrastructure.
• Security.

Where applicable, Asiyst may instruct service providers to delete or return information according to contractual and operational requirements.

Third-party providers may retain limited information where required by their own legal obligations or independent processing purposes.

Where an Asiyst feature uses a third-party AI provider, deletion of information from Asiyst systems does not necessarily mean that information is immediately deleted from the provider's systems.

The applicable provider's data-processing practices, contractual terms, retention periods, and technical architecture may affect deletion.

Where Asiyst controls the applicable processing relationship, Asiyst will take appropriate steps consistent with its agreements and applicable requirements.

If you provide your own third-party API credentials through Asiyst, deleting those credentials from Asiyst may not delete the corresponding credentials or usage records maintained by the third-party provider.

You may need to separately manage or delete information through the applicable third-party provider.

Information may be retained when reasonably necessary to:

• Respond to legal proceedings.
• Comply with court orders.
• Respond to government requests.
• Establish legal rights.
• Defend claims.
• Resolve disputes.
• Investigate suspected unlawful activity.

Retention for these purposes may continue after an account has been deleted.

To protect users against unauthorized deletion requests, Asiyst may require reasonable verification.

Verification may include information associated with the account or another reasonable authentication method.

Asiyst will not intentionally require unnecessary information solely for the purpose of processing a deletion request.

Deletion requests are generally processed within a reasonable period based on:

• The type of request.
• The amount of information involved.
• Technical requirements.
• Verification requirements.
• Applicable legal obligations.
• Third-party processing requirements.

Some information may be deleted immediately, while other information may require additional processing time.

When a deletion request is approved, Asiyst will take reasonable steps to delete or de-identify applicable information from active systems, subject to the exceptions in this Policy.

Deletion may occur through automated processes or manual procedures depending on the type of data.

In some circumstances, Asiyst may de-identify information instead of deleting it where permitted by applicable law.

De-identified information may no longer be reasonably associated with an identifiable individual.

Once information has been properly de-identified, it may be retained and used for legitimate purposes where permitted by applicable law.

Certain information may not be immediately deletable or may need to be retained.

Examples may include information required for:

• Legal compliance.
• Tax and accounting.
• Security.
• Fraud prevention.
• Payment disputes.
• Contract enforcement.
• Legal claims.
• Regulatory obligations.
• System integrity.

Where deletion is legally or technically restricted, Asiyst may retain the minimum information reasonably necessary for the applicable purpose.

If Asiyst becomes aware that it has collected personal information from a child in circumstances where collection is prohibited by applicable law, Asiyst may take appropriate steps to delete that information.

Requests involving children's information may require additional verification to protect the child and prevent unauthorized requests.

Where an Asiyst account is controlled by an organization, deletion rights may depend on the organization's agreement with Asiyst and applicable data-protection requirements.

Individual users may not be able to independently delete organizational data where the organization controls the relevant account or workspace.

In such cases, requests may need to be directed to the organization's administrator or other authorized representative.

Once applicable data has been deleted, it may not be recoverable.

Deleting an account or resource may permanently remove access to associated information.

Asiyst is not responsible for information that a user deletes and later wishes to recover, except where recovery is expressly supported by the applicable Service.

If export functionality is available, users should export required information before requesting deletion.

The availability and format of exported information may depend on the Service.

For additional information, see the Asiyst Export & Data Portability Policy.

Where technically and operationally possible, you may contact Asiyst promptly if you wish to withdraw a deletion request before deletion has been completed.

Once information has been permanently deleted or de-identified, the process may not be reversible.

This Policy should be read together with:

• Privacy Policy.
• Data Retention Policy.
• Export & Data Portability Policy.
• Terms of Service.
• Security Policy.
• Data Processing Agreement.
• Applicable product-specific terms.

Where a specific agreement provides additional deletion requirements, that agreement may control for the relevant data or Service.

Asiyst may update this Policy to reflect changes in:

• Services.
• Data-processing practices.
• Technical systems.
• Legal requirements.
• Retention procedures.
• Deletion mechanisms.

The updated Policy will be made available through the Asiyst Services.

For questions or requests concerning data deletion, contact:

Asiyst Website: https://asiyst.com Email: support@asiyst.com

When submitting a request, provide sufficient information to identify the relevant account or data and explain the deletion request clearly.