Privacy: what Quilzo keeps about people
What is kept about people, for how long, and how it goes.
| What | Kept | How it goes |
|---|---|---|
| Questions to a chatbot | Not stored | Nothing to erase |
| A conversation handed to a person | 30 days after it last moves by default, 90 at most | quilzo inbox close; deleted on expiry |
| Form submissions | As long as the form declares | quilzo form expire, quilzo form erase VALUE |
| Analytics | Counts, with no cookie | Nothing identifies a visitor |
| What agents remember | As declared, 90 days at most; held memories two weeks | Memory: edit, delete, forget, with a receipt |
| Prompts to models | Never recorded | Personal data is masked before it leaves (see the privacy guard) |
| Member accounts | Until removed | quilzo member remove ID erases the record, passkeys, recovery codes and sessions |
| People notified about a breach | As the notice needs | quilzo notify erase ISSUER:VALUE, and suppressed on re-import |
| Identifiers in the audit log | Pseudonymised | The log cannot forget, so it records counts and ids, never what was said |
When the identity provider deletes somebody through SCIM, what agents remember about them goes too. The published site is checked for personal data before it publishes (quilzo compliance site).