Data deletion

Data Deletion Instructions

As of: 2026-10-10 · applies to TheY CRM (crm.the-y.at) and the Meta app “TheY CRM” · Deutsche Fassung

This page explains how personal data is deleted from our service “TheY CRM / Kunden-Support CRM”, and how you remove TheY CRM's access to Facebook, Instagram or WhatsApp. There are two ways:

1. Delete it yourself in the CRM (for businesses that use TheY CRM) – takes effect immediately:
delete a channel (section 2) · permanently delete an individual person (section 3a) · reset or delete the account (section 3b).
2. By email to datenschutz@the-y.at with the subject “Data deletion” – for everyone, including people without access to the CRM. We delete the data within 30 days and confirm the deletion by email.

Choose the case that applies to you:

You contacted a business that uses TheY CRM (via WhatsApp, Messenger, Instagram, a Facebook comment, email, SMS, web chat or phone)
You connected TheY CRM to Facebook, Instagram or WhatsApp and want to remove its access
Your business uses TheY CRM and wants to delete individual persons or the whole account
You run TheY CRM yourself (self-hosted installation)

1. You contacted a business that uses TheY CRM

The business you contacted is responsible for your data; The-Y e.U. stores it on that business's behalf.

Option 1: ask the business. Ask the business to delete your data. It can permanently delete you in TheY CRM itself (section 3a); the deletion then takes effect immediately.

Option 2: email us.

Send an email to datenschutz@the-y.at with the subject “Data deletion”.
Tell us how to find your data:
- for WhatsApp: your phone number,
- for Messenger, Instagram or comments: your name or username, and the Page or Instagram account you messaged or whose post you commented on,
- for email, SMS or phone: your email address or phone number,
- if known: the business you were in contact with.
We confirm receipt and coordinate the deletion with the responsible business. If necessary, we will ask a short question to verify your identity.
The deletion is carried out within 30 days, and you then receive a confirmation by email.

What is deleted: the data about you stored in the service, in particular:

your contact record with name or profile name, username, email addresses, phone numbers, address and custom fields, including if it was imported from the business's WhatsApp Business app,
your conversations from all channels with messages, comments, images, documents and other attachments,
identifiers such as your WhatsApp number, Page-scoped ID (PSID) and Instagram-scoped ID (IGSID),
calls and, where applicable, call recordings and voicemail,
notes, tasks and appointments about you, and metadata such as timestamps and delivery status.

What is not deleted:

invoices and other records that we or the business must keep by law; they are deleted when the retention period ends. Invoices and deals are unlinked from your contact record but not deleted.
the block entry for your email address if you unsubscribed from emails or emails could not be delivered, so that you receive no further emails.
data at Meta: messages in your WhatsApp, Messenger or Instagram app, and your comments on Facebook or Instagram. You delete those yourself in the respective app; Meta's Privacy Policy applies to them.

2. Facebook, Instagram or WhatsApp: remove TheY CRM's access

If you authorised TheY CRM via “Connect Facebook & Instagram” or “Connect WhatsApp”, TheY CRM stores encrypted access tokens, the IDs of your Page, Instagram account or WhatsApp Business Account, and the messages and comments received. We do not store your Facebook name or profile picture. Use one or more of these options to remove the access:

a) In TheY CRM: delete the channel (recommended)

Sign in to TheY CRM and open Settings → Channels.
On the WhatsApp, Messenger or Instagram card, click “Delete” in the row of the number or Page, then confirm.

The access tokens are deleted immediately, and new messages from that account are no longer stored. To also remove the authorisation at Meta itself, follow b) to e) as well. Conversations already received stay in your CRM until you permanently delete the persons concerned (section 3a), reset or delete the account (section 3b), or ask us by email to delete them.

b) In Facebook: remove the app

Open your Facebook settings and go to “Business integrations”. Remove “TheY CRM” there and confirm. TheY CRM then loses access to every Page and Instagram account you shared through your Facebook account. The then invalid access token remains stored in TheY CRM until you delete the channel as described in a).

c) In your Meta business portfolio: remove the app or partner

In the settings of your business portfolio (Meta Business Suite), you can remove the app “TheY CRM” from the connected apps. For WhatsApp, you can also remove the partner “The-Y e.U.” from your WhatsApp account.

d) In Instagram: turn off access to messages

In the message settings of the Instagram app, you can turn off connected apps' and tools' access to your messages.

e) WhatsApp Business app on your phone (coexistence)

If you used “Connect WhatsApp Business app (keep the app)” to connect a number that you keep using in the WhatsApp Business app, you can also disconnect it from the WhatsApp Business Platform in the app's settings. The chat history imported on connection (up to 180 days) and — only if you ticked “Import WhatsApp contacts (address book)” — the address book contacts stay in the CRM until you delete them as described in section 3 or ask us by email to delete them.

f) Delete stored data

You delete data already stored yourself by permanently deleting individual persons (section 3a) or by resetting or deleting the account (section 3b). Alternatively, email datenschutz@the-y.at with the subject “Data deletion Meta” and include the Page name, the Instagram username or the WhatsApp number. We delete the data within 30 days and confirm by email.

3. For business customers: delete persons or the account

a) Permanently delete an individual person

Users with admin rights can permanently delete a person including all their conversations themselves, e.g. at that person's request under Art. 17 GDPR:

on the contact page: card “Delete permanently (GDPR)” → “Delete permanently…”, then type the name to confirm;
in the trash: Contacts → 🗑 Trash → “Delete permanently…” next to the person, then type the name to confirm. The trash also lists contacts already deleted and merged duplicates.

The regular “Delete” button on the contact page only moves the person to the trash. Only “Delete permanently” removes them immediately and for good, together with their conversations (including unlinked conversations with the same email address, phone number or social ID), messages, attachments and files, calls including recordings, notes, tasks and appointments. Deals and invoices are kept without a link to the person (statutory retention). If deleting a file fails because of a file storage fault, the deletion is retried automatically.

Note on WhatsApp: after the WhatsApp Business app has been connected, Meta may still deliver chat history during the first few days. This can re-create a deleted person; if so, repeat deletions made during that time.

b) Reset or delete the account

The owner account manages the account under Settings → 🔑 Account → Danger zone:

“Reset account (factory new)” → “Reset …”: deletes all data, settings, channels including access tokens, invited users and all files. Only the owner account, an existing subscription and the records from registration (accepted terms, sign-up source) remain.
“Delete account” → “Delete account permanently …” (free version): permanently deletes the entire account with all its users and files. To confirm, you type the company name.
Paid subscription: resetting is available here as well. You manage and cancel the subscription under “Manage & cancel subscription”. To have the account itself deleted, email datenschutz@the-y.at; we delete it within 30 days.

The account's entire data set is deleted, including contacts, companies and deals; all conversations and messages (including WhatsApp, Messenger, Instagram and comments); chat history and contacts imported from the WhatsApp Business app; connected channels including access tokens; scheduled and published posts in the CRM; call logs, recordings and voicemail; invoices and quotes; tasks and appointments; templates; marketing data; workforce records; user accounts with the related security and log data; and all files in file storage (attachments, media, recordings). If deleting files fails because of a file storage fault, the deletion is retried automatically.

💡 Back up first: export important data beforehand under Settings → Data backup (a snapshot of the whole account or a CSV per area). Please back up invoices that you must keep by law before resetting or deleting. Data cannot be restored afterwards.

c) What we do not delete

Data stored at Meta: WhatsApp message templates in your WhatsApp Business Account, and posts and comment replies on your Facebook Page or Instagram account. Delete them in WhatsApp Manager or directly on Facebook or Instagram.

4. Self-hosted installations

If you run TheY CRM on your own server, all content stays with you (contacts, messages, data from Meta platforms), and deletion happens entirely in your infrastructure, with the same functions as above. The-Y e.U. stores only the licence check data from your installation: licence key, installation identifier, program version, and the IP address and time of the last check. We delete it automatically 12 months after the licence ends or 12 months after the installation last reported. If you no longer run the installation, we delete the check data earlier on request: datenschutz@the-y.at.

Response time and confirmation

We answer deletion requests by email within 30 days and confirm the deletion by email. If we cannot clearly match a request, we will ask. Data that must be kept by law is deleted when the retention period ends.

Backups and logs

After a deletion, data may remain in backups for a limited time: up to 14 days locally on the production server and up to 30 days in the copy at a separate location in Austria (transferred over an encrypted connection). Data remains in technical logs for up to 14 days. After that, it is overwritten or deleted in the regular rotation. Backups are not processed in regular operation.

Important note on roles

If you are a customer of a business that uses TheY CRM, that business is the controller under the GDPR, and The-Y e.U. is its processor. We carry out your deletion request on the business's behalf or forward it to the business. Meta Platforms Ireland Ltd. is itself responsible for the data on WhatsApp, Facebook and Instagram. For details, see our Privacy Policy.

Contact for data deletion: datenschutz@the-y.at · general: office@the-y.at · The-Y e.U., Senefeldergasse 25, 1100 Vienna, Austria.

Note: This English text is a courtesy translation; in case of doubt the German version prevails.

To the Privacy Policy →