GDPR-Compliant AI Customer Support: Export, Deletion & Retention in Macha

This post answers them concretely for Macha — no "we take privacy seriously" boilerplate, just the actual controls. A self-serve data export to JSON, 30-day scheduled deletion with cascade cleanup, automatic retention that ages conversations out after 45 days, field-level AES-256-GCM encryption, plus the things every EU buyer asks that most vendor pages skip: where data is hosted, who the sub-processors are, how cross-border transfers are handled, and what GDPR Article 22 means for an automated agent. The core mechanics landed in two changelog releases — Privacy & data management on March 30, 2026 and GDPR compliance on April 9, 2026 (read the primary entries on the Macha changelog).

First, the framing that makes the rest make sense.

Macha is a processor, not the system of record

Macha doesn't replace your helpdesk — it sits on top of Zendesk, Freshdesk, Gorgias, or Front and connects to the commerce and knowledge tools you already run (Shopify, Stripe, Notion, Google Workspace, and more). Your tickets still live in your helpdesk. Your orders still live in Shopify. Macha reads from those systems, builds agents that act on them, and stores the working artifacts of that automation: conversations its agents had, the agents and tools you configured, and the connector credentials needed to reach your other systems.

In GDPR terms, that makes you (the Macha customer) the data controller and Macha a processor acting on your documented instructions — the controller-vs-processor split the IAPP explains here. It matters in practice: the authoritative copy of customer data usually lives in your helpdesk, so a deletion or export request often has two legs — what your helpdesk holds, and what Macha holds. The controls below cover the Macha leg cleanly, which is the part teams worry about most when adding a new vendor.

A trust deep-dive, not legal advice. This describes Macha's product mechanics as of June 2026. For contractual specifics, see Macha's Data Processing Agreement and security policy; your DPO should map vendor capabilities to your own obligations.

Where the controls live: the Privacy settings page

Everything self-serve is in one place. Macha's Privacy settings page (shipped March 30) is a dedicated section under Settings to download your data, schedule account or organization deletion, and reach every policy document without hunting through a footer.

That consolidation is the point. A privacy program spread across support tickets and email threads doesn't scale; one an admin can operate from the dashboard does. Notice the in-product copy in that screenshot — "You have 30 days to change your mind," "removed after 30 days." Those windows aren't marketing; they're the literal mechanics, which we'll unpack below.

1. Data export: a complete copy, as JSON

The right of access (GDPR Article 15) and data portability (Article 20) both reduce to one question: can the customer get their data out, in a usable format? Macha's answer is the Download my data button above — a complete copy of your organization's data as JSON: conversations, agents, connectors, and tools.

Two design choices reflect real privacy thinking rather than a checkbox:

• It's a portable, machine-readable format. JSON travels — you can diff it, grep it, load it into another system, or hand a structured copy to a customer or auditor. That's exactly the spirit of Article 20's "structured, commonly used and machine-readable" requirement.
• Secrets are stripped, not exported. Credentials, embeddings, and other sensitive internal fields are removed from the export. An export is, by definition, a copy that leaves Macha's security boundary, so baking your connector API keys into it would turn a convenience feature into a leak. You get your data; you don't get a downloadable bundle of live secrets.

Servicing a data subject access request for one customer? The practical workflow is: pull the export, search it for that customer's identifier, and combine it with the matching export from your helpdesk. Macha gives you the structured raw material; the scoping to a single subject happens at your end where the full context lives.

2. Deletion: 30-day scheduled erasure with cascade cleanup

This is the control most people are really asking about. When you delete a Macha account or organization from the Privacy page above, Macha doesn't flip a flag — it runs a 30-day scheduled deletion with cascade cleanup that reaches every store the data touched:

• Spaces files (uploaded attachments and generated documents),
• MongoDB collections (the records behind your agents, conversations, and config),
• organization memberships (who had access).

A few things make this a defensible erasure rather than a soft hide:

• It cascades. Right-to-erasure failures almost always come from orphaned copies — a file in object storage or a row in a secondary collection the "delete" button never reached. Cascade cleanup across files, database collections, and memberships is exactly the discipline GDPR Article 17 expects.
• The 30-day window is a feature, not a delay. It gives you a grace period to reverse an accidental or premature deletion before the data is gone for good — while landing comfortably inside the one-month response deadline Article 17 sets for controllers. You're not racing the clock, and a fat-finger can't nuke a production org with no undo. As the Delete-organization note in the screenshot spells out: "All conversations, agents, connectors, tools, and uploaded files will be removed after 30 days. This affects all team members."

The same philosophy, one level down: soft-delete for agents

The 30-day grace pattern isn't unique to accounts. Deleting an agent moves it to a Trash tab for 30 days, from which you can restore it — triggers, instructions, sub-agent links, and tool config all intact — before permanent removal. While trashed, the agent's triggers are deactivated (paused, not destroyed), so nothing keeps firing. Destructive actions are reversible for a window, then truly final. (More on organization-level controls in account & organization settings explained.)

3. Retention: data that ages out on its own — and reconciling "zero retention"

Good privacy isn't only about deleting on request — it's about not keeping data longer than you need it (the storage-limitation principle). Macha enforces this automatically:

There's an apparent contradiction worth addressing head-on, because a sharp reviewer will spot it: Macha's Privacy Policy states a "zero data retention policy for customer conversation content processed through our AI agents," yet the table above lists a 45-day conversation TTL. These are two different layers, not a conflict:

• Model layer — zero data retention. The content your agents send to the underlying LLM providers (OpenAI, Anthropic, Groq) is processed under zero-data-retention terms: it is used to answer the request and is not retained or used for training by the model provider. That's what "zero data retention for conversation content processed through our AI agents" describes.
• Application layer — 45-day TTL. Macha's own database keeps a conversation record so your agents have working context and your team has history. Per the Security page, that record lives in MongoDB with field-level AES-256-GCM encryption, and it is removed by a time-to-live policy after 45 days of inactivity.

So nothing is retained at the model layer, and the app-layer copy is encrypted and short-lived. The verbose internal logs agents generate while reasoning are even shorter-lived — 7 days — because they're operational telemetry, not a record you'd ever need long-term. The net effect is a small standing data footprint, which is the single best way to shrink breach blast-radius: data you don't hold can't leak.

4. Encryption: credentials are protected, not plaintext

Because Macha's agents reach into your other systems, they hold connector credentials — and how those are stored is fair to interrogate:

• Field-level encryption for sensitive data. Sensitive ticket and agent fields are encrypted individually with AES-256-GCM (authenticated encryption), keys derived and managed with salted scrypt key derivation, per the Security page.
• Custom API tool credentials are encrypted at rest. When you connect a REST API, the key, bearer token, or basic-auth secret is encrypted before storage. In the editor you see only a masked hint — enough to confirm which key is configured without re-exposing the secret.
• Secrets in logs are encrypted too. Any API keys or tokens that surface inside internal agent log messages are encrypted with AES-256-GCM before storage, so short-lived debug logs can't become a plaintext credential dump.
• Transport is encrypted. Traffic between browser clients, your helpdesk, MongoDB, Supabase, and the model providers runs over TLS 1.2+.

Secrets are encrypted where they rest, masked where they're displayed, and absent where data travels.

5. Where data lives: hosting location and sub-processors

The first question most EU buyers ask is the one most vendor pages dodge: where is the data physically stored, and who else touches it? Here's the honest map, drawn from Macha's Security page.

Macha's application runs on Digital Ocean, and a small set of sub-processors handle specific jobs:

A few honest notes on data residency: hosting is on Digital Ocean's infrastructure, and Macha is pursuing SOC 2 (in progress per the Security page). If your policy requires a specific region or guaranteed EU data residency, that is a configuration and contractual question — confirm the available region and the residency commitment for your plan in the DPA before you sign, rather than assuming a default. We'd rather tell you to verify it than imply an EU-only guarantee we haven't documented on this page.

6. Cross-border transfers: Schrems II, SCCs and the DPF

Because the model providers and some infrastructure are US-based, EU customer data can be processed outside the EEA — the transfer question Schrems II made unavoidable. The two mechanisms that carry these transfers today:

• Standard Contractual Clauses (SCCs). The European Commission's modernised 2021 SCCs (Decision (EU) 2021/914) are the workhorse safeguard for controller-to-processor and onward transfers, paired with a transfer impact assessment.
• EU-US Data Privacy Framework. For onward transfers to US sub-processors that self-certify under the EU-US Data Privacy Framework (adequacy decision adopted July 2023), the DPF provides an additional lawful basis.

In practice you should map each sub-processor in the table above to its transfer mechanism and capture it in your record of processing. Macha's DPA is where these commitments are made contractually.

7. Article 22: automated decision-making

GDPR Article 22 gives data subjects the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. For an AI support agent, that's a real question, and the answer is mostly about how you configure it:

• Macha agents triage, route, draft, and resolve tickets and call tools — but they act as a processor on your instructions, not as an autonomous authority making binding decisions about a data subject.
• For consequential actions (issuing a refund, closing an account, changing entitlements), Macha supports human-in-the-loop confirmations on write actions — see why read/write tools ask for confirmation. Keeping a human in the loop on significant outcomes is exactly the meaningful-human-involvement Article 22 expects.
• Which model an agent reasons on is your choice (the default model selector in the screenshot above, and per-agent overrides — see choosing the right model for an agent), so you control the processing accordingly.

The practical posture: let agents automate the routine, gate the significant, and document where a human reviews.

8. Cookie consent, on every page

A cookie consent banner with explicit accept/decline controls appears across all pages and layouts — including the docs and Zendesk-app sections, not just the marketing site. It's the visible, end-user-facing piece of the same compliance push, and it ships on by default.

9. Breach notification

If the worst happens, GDPR Articles 33–34 set the clock. Macha's incident process commits to notifying EU data protection authorities within 72 hours where GDPR applies (per the Security page), alongside isolating compromised components. As the processor, Macha's job is to inform you (the controller) without undue delay so you can meet your own notification duties.

Watch-outs: where you still own the work

A trust post that only lists strengths isn't trustworthy. The honest boundary:

• You still handle the helpdesk leg. Macha's export and deletion cover Macha's copy. The system-of-record tickets live in Zendesk/Freshdesk/Gorgias/Front, and erasing them there is a separate action. A complete DSAR or erasure spans both. (See how Macha layers on your helpdesk in Macha on Zendesk.)
• Deletion is org/account-scoped, not per-end-user out of the box. Scheduled deletion erases an account or organization. To service a single subject today, the path is export-and-search plus your helpdesk's per-user controls — not a one-button "delete customer X from Macha." Macha's internal tooling can query and act by ticket ID, agent ID, or email to support this, but scope the request accordingly.
• Retention windows are policy defaults. The 45-day and 7-day TTLs are sensible defaults; if your sector mandates a shorter retention or a specific legal hold, confirm the specifics for your plan rather than assuming.
• Data residency and SOC 2 are still maturing. Hosting is on Digital Ocean and SOC 2 is in progress — verify region and certification status against your requirements via the DPA before relying on them.
• Connected sub-processors have their own posture. Stripe, Shopify, and your LLM provider process data under their own terms. Vendor due diligence doesn't stop at Macha's edge.

None of these are gaps so much as the normal shape of a layered architecture — but knowing exactly where Macha's responsibility ends and yours begins is the whole point of a trust review.

Where this fits for a buyer

Against a security checklist, the short version: self-serve JSON export with secrets stripped, 30-day scheduled deletion with cascade cleanup, model-layer zero retention plus a 45-day app-layer conversation TTL, field-level AES-256-GCM encryption, a named sub-processor list with SCC/DPF transfer mechanisms, Article 22 human-in-the-loop on significant actions, 72-hour breach notification, and one consolidated Privacy settings page to operate the self-serve parts. For plan-level details and limits, the pricing page and the docs go deeper.

FAQ

Is Macha GDPR compliant? Macha ships the core mechanics GDPR requires of a processor: self-serve data export (Articles 15/20), scheduled deletion with cascade cleanup for the right to erasure (Article 17), enforced retention limits (storage limitation), field-level AES-256-GCM encryption, SCC/DPF cross-border safeguards, human-in-the-loop for Article 22, and 72-hour breach notification. Your DPO should map these to your specific obligations and review the DPA.

Where does Macha store my data? The application runs on Digital Ocean. MongoDB stores config and field-encrypted email/chat transcripts; Supabase stores vector embeddings; Stripe handles payments; OpenAI/Anthropic/Groq process agent requests under zero-data-retention terms. For a specific region or EU residency commitment, confirm availability in the DPA.

Does Macha store my conversations or not? Both statements in our policies are true at different layers. The LLM providers process conversation content under zero data retention (not retained, not trained on). Macha's own database keeps a field-encrypted conversation record that auto-deletes after 45 days of inactivity via a TTL policy.

How do I export my data from Macha? From the Privacy settings page under Settings, use Download my data to get a complete JSON copy of conversations, agents, connectors, and tools. Credentials, embeddings, and sensitive internal fields are stripped.

What happens when I delete my Macha account? Account and organization deletion runs as a 30-day scheduled deletion with cascade cleanup across Spaces files, MongoDB collections, and org memberships. The 30-day window lets you reverse an accidental deletion before data is permanently erased.

Does Macha make automated decisions about my customers (Article 22)? Macha agents triage, route, draft, and resolve as a processor on your instructions. For significant actions you can require human-in-the-loop confirmation, which keeps meaningful human involvement in the loop as Article 22 expects.

Try it

The fastest way to satisfy a privacy review is to see the controls yourself. Start a 7-day free trial, no credit card required, open Settings → Privacy, and run an export — or read the docs for the full account and data-management walkthrough.

Written by Abbas (Customer Support & AI, Macha) · Reviewed by Ankeet Guha (Co-founder & CTO) · Published 2026-06-24 · Last updated 2026-06-24.