How verified, scoped erasure works across Vocalis and connected providers.

Account and workspace erasure

Authenticated customers can request account erasure from My Profile. Workspace owners can request workspace erasure from Workspace Settings. Each surface shows the expected effects and requires an exact typed confirmation before a request is recorded.

Requests are durable, asynchronous, idempotent, and tracked through per-step receipts. A request may be blocked until an active paid subscription or publishing job is closed, or until organization ownership is transferred.

What an approved erasure does

The worker removes customer content and derived records for the approved scope, including generation data, Brand Knowledge data, workspace settings and identity, notifications, publishing queues and configuration, invitations, memberships, and allowlisted workspace storage objects.

Account erasure processes owned workspaces first, removes the person’s memberships without deleting content owned by other workspaces, deletes the profile and authentication identity, and records only a hashed tombstone and minimized completion evidence.

Connected platforms

Disconnecting always destroys locally stored authorization secrets. Where a verified provider revocation or disconnect endpoint is supported, Vocalis attempts it first and records the outcome. A remote outage does not preserve a usable local credential.

Some providers expose no suitable programmatic user-token revocation route for the configured integration. In that case the product identifies local-only or manual-user-action behavior and directs the customer to the provider’s connected-app controls.

Content already published elsewhere

Deleting a Vocalis record or connection does not guarantee deletion of content already published to a third-party destination. That copy is controlled by the destination and may need to be removed using its own account or content controls.

Minimized retained evidence and retention decisions

Financial transaction facts, security evidence, audit integrity, legal acceptance evidence, and the anonymized workspace shell required by retained foreign-key relationships may remain when there is a legal, financial, security, dispute, or integrity reason. Direct identifiers are removed or pseudonymized where the implemented schema permits.

A server-owned retention registry records an owner-approved, category-level schedule effective 13 September 2026. Retention exceptions must be explicit, minimized, and reviewed; usable OAuth secrets, temporary files, exports, and customer-linked analytics identifiers cannot be kept through convenience exceptions. Production destructive purge remains disabled until a controlled 24-hour dry-run is reviewed as clean.

Backups and deletion tombstones

Live storage and database data are removed by the erasure worker. Historical database backups and deployment recovery copies expire under the applicable infrastructure provider’s configured recovery and retention behavior rather than through a claim of immediate physical deletion.

Hashed account, workspace, and provider-subject tombstones are reconciled after restore so a deleted profile is deleted again and an erased workspace shell is re-anonymized instead of silently returning to active use.

Meta data-deletion callback

The Meta callback validates the signed_request with HMAC-SHA256 and maps only matching Facebook or Instagram connected-account data. It does not delete the entire Vocalis account.

A valid callback returns an unguessable confirmation code and status URL. The public status response exposes only the request state and timestamps; it does not expose the Meta identifier, account email, workspace details, or deleted content.

Help with a deletion request

If self-service is unavailable or a request remains blocked, contact [email protected] with the account or workspace context and the safe request reference. Never send a password or provider access token.