Is Macha GDPR Compliant? Export, Deletion and Retention Explained (2026)

Yes: Macha gives you the GDPR controls a processor needs, including a self-serve JSON export, 30-day scheduled deletion with cascade cleanup, conversations that auto-delete after 45 days of inactivity, and primary hosting in Frankfurt, Germany. The export and the Privacy settings page shipped on March 30, 2026, and scheduled deletion arrived with the GDPR compliance release on April 9, 2026 (both on the Macha changelog). The rest of this page covers the parts EU buyers ask about and most vendor pages skip: sub-processors, cross-border transfers, and what GDPR Article 22 means for an automated agent.

Is Macha a controller or a processor?

Macha doesn't replace your help desk. It sits on top of Zendesk, Freshdesk, Gorgias, Front, HubSpot or Intercom and connects to the commerce and knowledge tools you already run (Shopify, Stripe, Notion, Google Workspace, and more). Your tickets still live in your helpdesk. Your orders still live in Shopify. Macha reads from those systems, builds agents that act on them, and stores the working artifacts of that automation: conversations its agents had, the agents and tools you configured, and the connector credentials needed to reach your other systems.

In GDPR terms, that makes you (the Macha customer) the data controller and Macha a processor acting on your documented instructions — the controller-vs-processor split the IAPP explains here. It matters in practice. the authoritative copy of customer data usually lives in your helpdesk, so a deletion or export request often has two legs — what your helpdesk holds, and what Macha holds. The controls below cover the Macha leg cleanly, which is the part teams worry about most when adding a new vendor.

A trust deep-dive, not legal advice. This describes Macha's product mechanics as of September 2026. For contractual specifics, see Macha's Data Processing Agreement and security policy; your DPO should map vendor capabilities to your own obligations.

Where do admins find the privacy controls?

Everything self-serve is in one place. Macha's Privacy settings page (shipped March 30) is a dedicated section under Settings to download your data, schedule account or organization deletion, and reach every policy document without hunting through a footer.

That consolidation is the point. A privacy program spread across support tickets and email threads doesn't scale; one an admin can operate from the dashboard does. Notice the in-product copy in that screenshot — "You have 30 days to change your mind," "removed after 30 days." Those windows aren't marketing; they're the literal mechanics, which we'll unpack below.

How do you export your data from Macha?

The right of access (GDPR Article 15) and data portability (Article 20) both reduce to one question: can the customer get their data out, in a usable format? Macha's answer is the Download my data button above — a complete copy of your organization's data as JSON: conversations, agents, connectors, and tools.

Two design choices reflect real privacy thinking rather than a checkbox:

• It's a portable, machine-readable format. JSON travels — you can diff it, grep it, load it into another system, or hand a structured copy to a customer or auditor. That's exactly the spirit of Article 20's "structured, commonly used and machine-readable" requirement.
• Secrets are stripped, not exported. Credentials, embeddings, and other sensitive internal fields are removed from the export. An export is, by definition, a copy that leaves Macha's security boundary, so baking your connector API keys into it would turn a convenience feature into a leak. You get your data; you don't get a downloadable bundle of live secrets.

Servicing a data subject access request for one customer? The practical workflow is: pull the export, search it for that customer's identifier, and combine it with the matching export from your helpdesk. Macha gives you the structured raw material; the scoping to a single subject happens at your end where the full context lives.

How does deletion work, and how long does it take?

This is the control most people are really asking about. When you delete a Macha account or organization from the Privacy page above, Macha doesn't flip a flag — it runs a 30-day scheduled deletion with cascade cleanup that reaches every store the data touched:

• Spaces files (uploaded attachments and generated documents),
• MongoDB collections (the records behind your agents, conversations, and config),
• organization memberships (who had access).

A few things make this a defensible erasure rather than a soft hide:

• It cascades. Right-to-erasure failures almost always come from orphaned copies — a file in object storage or a row in a secondary collection the "delete" button never reached. Cascade cleanup across files, database collections, and memberships is exactly the discipline GDPR Article 17 expects.
• The 30-day window is a feature, not a delay. It gives you a grace period to reverse an accidental or premature deletion before the data is gone for good — while landing comfortably inside the one-month response deadline Article 17 sets for controllers. You're not racing the clock, and a fat-finger can't nuke a production org with no undo. As the Delete-organization note in the screenshot spells out: "All conversations, agents, connectors, tools, and uploaded files will be removed after 30 days. This affects all team members."

The same philosophy, one level down: soft-delete for agents

The 30-day grace pattern isn't unique to accounts. Deleting an agent moves it to a Trash tab for 30 days, from which you can restore it — triggers, instructions, sub-agent links, and tool config all intact — before permanent removal. While trashed, the agent's triggers are deactivated (paused, not destroyed), so nothing keeps firing. Destructive actions are reversible for a window, then truly final. (More on organization-level controls in account & organization settings explained.)

How long does Macha keep conversations and logs?

Good privacy isn't only about deleting on request — it's about not keeping data longer than you need it (the storage-limitation principle). Macha enforces this automatically, per its Privacy Policy:

A sharp reviewer will ask how this squares with "zero data retention." The Privacy Policy now words it carefully, and the two layers are different:

• Model layer: no training, zero retention where available. Content your agents send to the LLM providers (OpenAI, Anthropic, Groq) is processed only to generate a response and isn't used by them for model training. Macha holds zero-data-retention arrangements with those providers "where available," which is the exact phrase to put in your vendor file rather than an unqualified guarantee.
• Application layer: 45-day TTL. Macha's own database keeps a conversation record so your agents have working context and your team has history. Per the Security page, that record lives in MongoDB with field-level AES-256-GCM encryption, and a time-to-live index removes it 45 days after the last activity. Enterprise customers can ask for a custom period.

So the model providers don't train on your content, and the app-layer copy is encrypted and short-lived. The verbose internal logs agents generate while reasoning live even shorter, 7 days, because they're operational telemetry, not a record you'd ever need long-term. The net effect is a small standing data footprint, which is the single best way to shrink breach blast-radius: data you don't hold can't leak.

How are connector credentials and sensitive fields encrypted?

Because Macha's agents reach into your other systems, they hold connector credentials — and how those are stored is fair to interrogate:

• Field-level encryption for sensitive data. Sensitive ticket and agent fields are encrypted individually with AES-256-GCM (authenticated encryption), keys derived and managed with salted scrypt key derivation, per the Security page.
• Custom API tool credentials are encrypted at rest. When you connect a REST API, the key, bearer token, or basic-auth secret is encrypted before storage. In the editor you see only a masked hint — enough to confirm which key is configured without re-exposing the secret.
• Secrets in logs are encrypted too. Any API keys or tokens that surface inside internal agent log messages are encrypted with AES-256-GCM before storage, so short-lived debug logs can't become a plaintext credential dump.
• Transport is encrypted. Traffic between browser clients, your help desk, MongoDB, Supabase, and the model providers runs over TLS 1.2+.

Secrets are encrypted where they rest, masked where they're displayed, and absent where data travels.

Where is Macha data hosted, and who are the sub-processors?

The first question most EU buyers ask is the one most vendor pages dodge: where is the data physically stored, and who else touches it? Here's the map, drawn from Macha's Security page and DPA (both checked 24 September 2026).

Macha's application runs on DigitalOcean in Frankfurt, Germany, and a small set of sub-processors handle specific jobs:

On data residency: the DPA states "primary processing in Frankfurt, Germany," so the database, embeddings and file storage sit in the EU. The LLM calls and the Composio-proxied connectors are the parts that leave the EEA, which is why the transfer section below matters. Macha is pursuing SOC 2, with completion expected in Q1 2027 per the Security page. Composio already holds SOC 2 Type II and ISO 27001:2022. Macha also commits to telling customers about material changes to the sub-processor list at least 30 days in advance.

How are transfers outside the EU handled?

Because the model providers and Composio are US-based, some EU customer data is processed outside the EEA, which is the transfer question Schrems II made unavoidable. The two mechanisms that carry these transfers today:

• Standard Contractual Clauses (SCCs). The European Commission's modernised 2021 SCCs (Decision (EU) 2021/914) are the workhorse safeguard for controller-to-processor and onward transfers, paired with a transfer impact assessment.
• EU-US Data Privacy Framework. For onward transfers to US sub-processors that self-certify under the EU-US Data Privacy Framework (adequacy decision adopted July 2023), the DPF provides an additional lawful basis.

In practice you should map each sub-processor in the table above to its transfer mechanism and capture it in your record of processing. Macha's DPA is where these commitments are made contractually.

Does an AI agent trigger GDPR Article 22?

GDPR Article 22 gives data subjects the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. For an AI support agent, that's a real question, and the answer is mostly about how you configure it:

• Macha agents triage, route, draft, and resolve tickets and call tools — but they act as a processor on your instructions, not as an autonomous authority making binding decisions about a data subject.
• For consequential actions (issuing a refund, closing an account, changing entitlements), Macha supports human-in-the-loop confirmations on write actions — see why read/write tools ask for confirmation. Keeping a human in the loop on significant outcomes is exactly the meaningful-human-involvement Article 22 expects.
• Which model an agent reasons on is your choice (the default model selector in the screenshot above, and per-agent overrides — see choosing the right model for an agent), so you control the processing accordingly.

The practical posture: let agents automate the routine, gate the significant, and document where a human reviews.

Does Macha show a cookie consent banner?

A cookie consent banner with explicit accept/decline controls appears across all pages and layouts — including the docs and Zendesk-app sections, not just the marketing site. It's the visible, end-user-facing piece of the same compliance push, and it ships on by default.

How fast does Macha report a breach?

If the worst happens, GDPR Articles 33–34 set the clock. Macha's incident process commits to notifying EU data protection authorities within 72 hours where GDPR applies (per the Security page), alongside isolating compromised components, and the DPA commits to notifying customers within 72 hours of a confirmed breach. As the processor, Macha's job is to inform you (the controller) without undue delay so you can meet your own notification duties.

What privacy work stays with you?

A trust post that only lists strengths isn't trustworthy. The honest boundary:

• You still handle the helpdesk leg. Macha's export and deletion cover Macha's copy. The system-of-record tickets live in your help desk (Zendesk, Freshdesk, Gorgias, Front, HubSpot or Intercom), and erasing them there is a separate action. A complete DSAR or erasure spans both. (See how Macha layers on your helpdesk in Macha on Zendesk.)
• Deletion is org/account-scoped, not per-end-user out of the box. Scheduled deletion erases an account or organization. To service a single subject today, the path is export-and-search plus your helpdesk's per-user controls — not a one-button "delete customer X from Macha." Macha's internal tooling can query and act by ticket ID, agent ID, or email to support this, but scope the request accordingly.
• Retention windows are policy defaults. The 45-day and 7-day TTLs are defaults. Enterprise customers can request a custom period; if your sector mandates a shorter retention or a legal hold, agree it in writing.
• SOC 2 isn't finished. Primary hosting is in Frankfurt, but SOC 2 completion is expected in Q1 2027, and model calls still leave the EU. If your policy needs a certificate today or EU-only processing end to end, raise it against the DPA before you sign.
• Connected sub-processors have their own posture. Stripe, Shopify, and your LLM provider process data under their own terms. Vendor due diligence doesn't stop at Macha's edge.

None of these are gaps so much as the normal shape of a layered architecture — but knowing exactly where Macha's responsibility ends and yours begins is the whole point of a trust review.

How does Macha score against a security checklist?

Against a security checklist, the short version: self-serve JSON export with secrets stripped, 30-day scheduled deletion with cascade cleanup, no model training on your content plus a 45-day app-layer conversation TTL, Frankfurt hosting, field-level AES-256-GCM encryption, a named sub-processor list with SCC/DPF transfer mechanisms, Article 22 human-in-the-loop on significant actions, 72-hour breach notification, and one consolidated Privacy settings page to operate the self-serve parts. For plan-level details and limits, the pricing page and the docs go deeper.

FAQ

Is Macha GDPR compliant? Macha ships the core mechanics GDPR requires of a processor: self-serve data export (Articles 15/20), scheduled deletion with cascade cleanup for the right to erasure (Article 17), enforced retention limits (storage limitation), field-level AES-256-GCM encryption, SCC/DPF cross-border safeguards, human-in-the-loop for Article 22, and 72-hour breach notification. Your DPO should map these to your specific obligations and review the DPA.

Where does Macha store my data? Primary processing is in Frankfurt, Germany: the application runs on DigitalOcean, MongoDB stores config and field-encrypted email/chat transcripts, and Supabase stores vector embeddings, all in Frankfurt. OpenAI, Anthropic and Groq process agent requests without training on them, and Composio (US) holds OAuth tokens for some connectors. The full list is in the DPA.

Does Macha store my conversations or not? Yes, for a limited time, and at two different layers. The LLM providers process conversation content only to generate a response, don't train on it, and run under zero-data-retention arrangements where available. Macha's own database keeps a field-encrypted conversation record that auto-deletes after 45 days of inactivity via a TTL policy.

Is Macha SOC 2 certified? Not yet. Macha is in the process of obtaining SOC 2, with completion expected in Q1 2027 per the Security page.

How do I export my data from Macha? From the Privacy settings page under Settings, use Download my data to get a complete JSON copy of conversations, agents, connectors, and tools. Credentials, embeddings, and sensitive internal fields are stripped.

What happens when I delete my Macha account? Account and organization deletion runs as a 30-day scheduled deletion with cascade cleanup across Spaces files, MongoDB collections, and org memberships. The 30-day window lets you reverse an accidental deletion before data is permanently erased.

Does Macha make automated decisions about my customers (Article 22)? Macha agents triage, route, draft, and resolve as a processor on your instructions. For significant actions you can require human-in-the-loop confirmation, which keeps meaningful human involvement in the loop as Article 22 expects.

How do you check these controls yourself?

The fastest way to satisfy a privacy review is to see the controls yourself. Start a free trial ($50 of usage, no credit card, no time limit), open Settings → Privacy, and run an export — or read the docs for the full account and data-management walkthrough.

Written by Abbas (Customer Support & AI, Macha) · Reviewed by Ankeet Guha (Co-founder & CTO) · Published 2026-06-24 · Last updated 2026-09-24.