Documentation

Erase Visitor Data

Permanently delete a visitor and all their associated chats, messages, and media — the GDPR right to erasure.

Overview

When a visitor requests to have their data deleted under GDPR (right to erasure / right to be forgotten), you can permanently erase all of their data from Yaplet with a single action.

Erasing visitor data is restricted to organization owners. If you are not the owner, the button is not shown at all — ask an owner to run the erasure.

What Gets Deleted

Erasing a visitor permanently removes:

  • The visitor profile and all personal information
  • All conversations (chats) associated with the visitor, and everything attached to them — chat ratings, AI session records and the conversation's event history
  • All messages within those conversations, along with their ratings
  • All uploaded media files (images, attachments) from storage — including the screenshots attached to any tickets this visitor reported
  • The visitor's outreach history (queued, failed and completed campaign sends) and their product clicks
This action is irreversible. Once erased, the data cannot be recovered.

What survives

Tickets are not deleted. A ticket the visitor reported stays on its board with its title, description and comments intact — it is simply detached from the person, so it no longer points at any visitor. Its screenshot, however, is removed with the rest of the visitor's media, so expect the ticket to lose that image.

How to Erase a Visitor

  1. Open the Inbox and select a conversation with the visitor
  2. In the right sidebar, scroll to the visitor details
  3. Click the Delete visitor data button
  4. Confirm the action in the first confirmation dialog
  5. Confirm again in the second confirmation dialog

The double confirmation is intentional — this ensures you don't accidentally delete data.

Audit Trail

Every erasure is automatically logged in the Audit Log, recording:

  • Who performed the erasure
  • Which visitor was erased
  • When it happened
  • The IP address and country of the requester

Not the same as the automatic cleanup

This is a deliberate, immediate action you take on one named person. It is separate from the nightly data-retention cleanup described on the GDPR & Data Privacy overview, which only removes records that have gone inactive for long enough — and which deliberately never touches a visitor who identified themselves.