Delete your data

Contacts, leads, quotes, invoices, files, campaigns and the other records you create are yours to delete from the dashboard at any time. Deleting a record removes it from the live database immediately; copies remain in our backups until those backups expire under our rolling retention schedule.

Some records cannot be deleted by design because the law requires us to keep them: tax invoices you have issued to your own customers, and the tax invoices we issued to you, are retained for eight financial years (CGST Act s.36; Companies Act, 2013 s.128(5)), and the append-only audit ledger keeps a record of who did what in the workspace. Those records are still isolated to your workspace.

Write to support@ektasi.io from the email address of a workspace administrator with the subject “Delete workspace” and the workspace name. We confirm the request back to that address — this is the verification step; we will not erase a workspace on an unverified request — and then execute the Tenant Decommissioning Protocol.

Decommissioning runs in one database transaction — if any step fails, nothing is erased at all, so there is no partial erasure. It deletes every table that carries your workspace’s identifier from the live database — contacts, deals, quotes, your own invoices, campaigns, content, files, chat, forms and their submissions, HR documents, WhatsApp and SMS messages, sequences, orders, your consent and data-request records, your billing and tax profile, stored credentials and team profiles — and destroys the per-tenant key salt from which the workspace’s credential-encryption keys are derived. Copies of the workspace’s data in our backups are not altered by this step: they are deleted as those backups expire under our rolling retention schedule, and until then are used only to recover the service after an incident.

Two records survive an erasure, because a statute requires us to keep them, and we would rather name them than write “except where the law requires”. First, the GST tax invoices we issued to you: a registered supplier must keep them, and the GST rules require your legal name, address and GSTIN on the invoice itself, so they cannot be stripped out and leave a valid document. Second, the record of who accepted the Terms for each charge — the email address that accepted, which version was accepted, the date and time, the plan, the payment provider, the total shown, and the IP address and browser it was sent from — kept with the invoice it authorised, so that a chargeback, an RBI e-mandate dispute or a complaint about a past charge can still be answered. Both are kept for eight financial years: CGST Act s.36 (seventy-two months from the due date of that year’s annual return) and Companies Act, 2013 s.128(5). Section 8(7) of the DPDP Act, 2023 permits this, because the retention is necessary for compliance with law. Nothing else workspace-scoped is kept.

What remains is a tombstone — the workspace record marked decommissioned, with the timestamp, the reason and who requested it — and the append-only audit ledger of administrative actions taken in the workspace (who did what, when). Neither contains your business content. We keep them as proof the erasure occurred and so the forensic history stays intact.

Erasure is completed within 30 days of verification, and normally much sooner. The two statutory records above are the exception, and they do still identify you — an invoice must carry your name and GSTIN, and an acceptance that identifies nobody proves nothing — but they hold no workspace content.

If you cancel a paid plan or your workspace is locked for non-payment without asking for erasure, we keep the workspace intact for at least 90 days so you can export or resume. After that we may erase it under this procedure, with 14 days’ notice to the administrator by email — ask for erasure earlier if you want it gone sooner.

If you have an Ektasi login but are not the owner of a workspace — a team member, a client invited to a portal, a marketplace licence holder — write to support@ektasi.io from the address on the account. We delete your profile and its authentication records within 30 days. Records the workspace owner created about you (for example, your name on an invoice they issued) are theirs to delete under section 4.

If a business uses Ektasi and holds your details — because you gave them your number, filled in one of their forms, received a quote or invoice from them, or booked with them — that business controls your data, not us. Contact them: from their workspace they can look you up, export what they hold about you, erase it, or record that you have withdrawn consent so you drop out of their future messages.

If you cannot reach them, write to support@ektasi.io with the business name and the email address or phone number concerned. We pass the request to them and confirm to you that we have done so. We do not act on their data ourselves without their instruction, because we are their processor and not their controller.

Withdrawing consent for website analytics is a click, not a request. Use the control below (or “Cookie choices” in the footer) to decline; if you had previously accepted, we remove the Google Analytics cookies from your browser and reload the page.

Deleting a record in the dashboard and withdrawing analytics consent take effect immediately. Requests sent by email are verified and actioned within 30 days; we tell you when it is done.

If a request is not actioned in that time, or you are unhappy with how it was handled, our Grievance Officer, Rajan Singh (rajan@ektasi.io), acknowledges a grievance within 24 hours of receipt and resolves it within 15 days. You may also complain to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.