> ## Documentation Index
> Fetch the complete documentation index at: https://docs.insito.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy and data requests

> What Insito stores about your app's users, how long it's kept, and how to export or erase it.

Your app decides who its users are and passes Insito a `userId`. This page
covers what Insito stores against that ID, how to honour access and erasure
requests (GDPR Articles 15 and 17, and similar laws), how consent works in the
SDKs, and what can't be recalled once it has left Insito. Subprocessors,
security measures and the DPA are on
[Data protection and subprocessors](https://docs.insito.app/concepts/data-protection.md).

> [!WARNING]
>
> Don't use an email address, phone number or name as the `userId`. Use an
> opaque ID from your own database, such as a UUID. Insito never needs to know
> who the person is, and an opaque ID keeps answers pseudonymous in your
> dashboard, exports, Slack messages and logs.

## What Insito stores about an end user

| Data | Where | Kept for |
| - | - | - |
| Profile: `userId`, platform, app version, device metadata (locale, timezone, OS version, session count, days since install, environment) and the custom properties you send | Database | Until the user hasn't been seen for the retention period |
| Responses: answers, locale, time to complete, platform and app version | Database | Retention period (from submission) |
| Impressions: which survey was shown, and when | Database | Retention period |
| Throttle stamps: when each survey was last shown to the user | Redis | Up to 366 days |
| Audience cache for targeting | Redis | 1 hour |
| IP address in rate-limit counters | Redis | 1 to 15 minutes |
| IP address and URL path in API request logs (never answers or request bodies) | Hosting provider logs | A limited period set by the hosting plan |
| A one-way hash of the `userId`, when you export or erase the user's data | Audit log | 2 years |

The SDK keeps undelivered responses on the device for up to 7 days; see
[Offline delivery](https://docs.insito.app/sdk/react-native/configure.md#offline-delivery).

## Retention

Every night Insito deletes responses and impressions older than the
organisation's retention period, and end users not seen for that long. The
default is **2 years**.

Change it in **Settings → Data & privacy → Data retention** (90 days to 10
years), or with
[`PATCH /v1/dashboard/organization`](https://docs.insito.app/api/dashboard-endpoints#patch-organization)
and `retentionDays` (30 to 3650). Shortening it deletes the older data on the
next nightly run, so the dashboard asks you to confirm.

## Access and erasure requests

When one of your users asks for their data or asks you to delete it:

1. Open **Settings → Data & privacy → End-user data requests**.
2. Choose the app and enter the `userId` your app passes to `identify()`.
3. Click **Export JSON** or **Export CSV** for an access request. The export
   contains the profile, every response with its questions, and every survey
   impression.
4. Click **Erase…** and type the `userId` to confirm for an erasure request.
   The profile, responses, impressions and throttle stamps are deleted
   immediately. The user's answers disappear from analytics, exports and
   shared reports.

Erasure only affects the chosen app. If the same person uses several of your
apps, repeat it for each one.

The same operations are available from the API with a dashboard session, but not
with API keys or AI tools:
[`GET`](https://docs.insito.app/api/dashboard-endpoints#get-projects-projectid-respondents-externaluserid)
and
[`DELETE /v1/dashboard/projects/:projectId/respondents/:externalUserId`](https://docs.insito.app/api/dashboard-endpoints#delete-projects-projectid-respondents-externaluserid).

If the user is still signed in to your app, also call `MicroSurvey.optOut()`
(see below). Otherwise the next `identify()` creates a new profile.

## Consent in the SDKs

Both SDKs can stop collection on a device:

* `MicroSurvey.optOut()`: nothing is sent until `optIn()`. Queued responses
  and the cached identity are deleted and any open survey closes. The decision
  is stored on the device and survives relaunches.
* `MicroSurvey.optIn()`: collection resumes. Call `identify()` afterwards.
* Deferred collection: with `deferCollection: true` in `init()` (React
  Native) or `InsitoConfig(deferCollection: true)` (Flutter), the SDK sends
  nothing until `optIn()` is called. Use this when you ask for consent first.
  Once given, consent is remembered.
* `MicroSurvey.reset()`: forgets the signed-in user, for example on logout.
  Queued answers are still delivered.

`MicroSurvey.consent` returns `granted`, `denied` or `pending`. These require
`@insito/react-native` 0.3.0 or `insito_flutter` 0.3.0.

## Deleting an organisation or account

**Settings → Data & privacy → Danger zone**:

* **Delete organisation** (type the organisation slug): cancels the
  subscription and permanently deletes every app, survey, response, end-user
  profile, shared report link, API key and member login.
* **Delete account** (type your email): deletes your login. If you are the
  organisation's only member, the organisation is deleted with it.

Stripe keeps the customer record and invoices, which are needed for
accounting.

## What can't be recalled

Erasure and deletion only reach data stored by Insito. Copies that have already
left Insito stay where they are:

* Messages already posted by the [Slack integration](https://docs.insito.app/dashboard/integrations/slack.md)
* Payloads already delivered to your [webhooks](https://docs.insito.app/dashboard/integrations/webhook.md)
* Data read by AI tools through the [MCP server](https://docs.insito.app/mcp/install.md), including
  anything kept in that tool's chat history
* CSV and PDF exports you downloaded, and copies made by people you shared a
  report link with

Delete these at the destination when you handle a request.

## Backups

Insito keeps encrypted database backups: daily copies for 30 days and monthly
copies for 12 months. Deleted data stays in those backups until they expire.
Backups are only restored for disaster recovery, and access is restricted.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.