Loading
Legal
Three different situations end up here, and the route differs by which one you are in. Start with the section that describes you.
Last updated 18 September 2026
The business that contacted you is the one that holds your data. We built and we run the agent, but the answers you gave, the transcript and anything written to a CRM belong to that business, and they decide how long it is kept. Asking them directly is both faster and the only way to have it removed from their own systems as well as ours.
If you do not know who called, or they will not respond, write to [email protected] with the phone number or WhatsApp number that was contacted and roughly when. We will identify the business, pass the request on, and delete our copy.
Email [email protected] from the address you used, or name it in the message. We delete the contact form submission and the email thread it started.
Disconnecting is self-service and takes effect immediately. In Shielva ARC, open the bot, go to Channels, and choose Disconnect on the WhatsApp card. That deletes the stored access credentials for your WhatsApp Business Account, and we stop sending and receiving on that number.
You can also revoke our access from your own side, in Meta Business Settings under the business portfolio that owns the WhatsApp Business Account. Revoking there stops our access whether or not you disconnect in ARC.
Disconnecting removes the connection, not the conversation history already stored in your workspace. To have that deleted too, say so in a request to [email protected] from an address with admin access to the workspace.
A request needs enough to identify the records: the email address, phone number or WhatsApp number concerned, and the business involved if you know it. We may ask one question back to confirm you are who you say you are. We would rather ask than delete the wrong person's data.
We acknowledge within 2 working days and complete within 30 days. If a request will take longer we say so, with a reason, before that deadline rather than after it.
Two things survive a deletion request, and both are deliberate. Records we are required to retain by law (invoices and tax records) are kept for the statutory period. Security audit logs recording that an action happened, by whom and when, are kept so that access to systems remains accountable; where those logs reference a person, the reference is removed and the event is retained.
Backups are not edited in place. Deleted data can persist in encrypted backups until they age out on their normal schedule, after which it is gone. It is not restored into live systems in the meantime.
Every request above goes to [email protected]. Our privacy page covers what we collect in the first place and why.