> ## Documentation Index > Fetch the complete documentation index at: https://docs.dmly.io/llms.txt > Use this file to discover all available pages before exploring further. # Privacy and data protection > How DMLY supports your GDPR obligations, who is responsible for what, and how the data rights work in the product. DMLY gives you the tools to handle personal data responsibly. This page explains DMLY's privacy posture and, just as importantly, where DMLY's responsibility ends and yours begins. This page describes how the platform supports your compliance. It is not legal advice. Your business remains responsible for its own lawful use of the data it collects. ## Who is responsible for what When you use DMLY to message and manage your own customers, **you are the data controller** for those contacts: you decide what to collect and why. **DMLY is the processor**, storing and handling that data on your behalf so the platform can work. That split matters: DMLY secures the platform and provides the controls, but decisions like what consent you have, how long you keep a record, and how you answer a customer's data request are yours to make. If you resell DMLY as an [agency](/agency/overview), your own clients are controllers for their contacts, and you sit in the processing chain between them and DMLY. ## GDPR DMLY is built to support your compliance with the GDPR and upholds its core principles: lawful processing, data minimisation, and a person's right to access and to have their data deleted. The platform gives you the mechanisms to act on those rights; you decide when a given request is valid and act on it. ## The data rights, in the product | Right | How it's done in DMLY | | -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Access / view** | A contact's full record is on their profile: profile fields, custom fields, channels, notes and the whole conversation. More is available through the [API](/api-reference/introduction). | | **Export** | [Contacts → Export](/contacts/data-and-privacy#exporting-a-contact-s-data) streams a CSV. | | **Erasure** | [Delete contact](/contacts/data-and-privacy#deleting-a-contact) permanently removes the person and their history. | | **Close your own account** | [Edit Profile → Delete account](/account/profile) removes your login and the workspaces you own. | Two honest limits worth knowing before you rely on these for a formal request: * The **CSV export is a round-trip file for the importer, not a subject-access export**: it leaves out the email, message history and more. Build a proper "everything you hold on me" response from the contact's profile or the API. * **Deletion is permanent and immediate**: there is no soft delete, no undo, and no retention policy you can configure to age data out for you. Capture anything you're legally required to keep *before* you delete. Both are covered in full on [Data, privacy and consent](/contacts/data-and-privacy). ## Consent and opt-out DMLY enforces opt-out across every automated send path and keeps a required **Unsubscribe** tag in step with it, so a contact who sends STOP is dropped from broadcasts, sequences, automations and reminders. Note that opt-out does **not** disable a manual reply from the inbox; for that, block the contact. The exact behaviour of each control is on [Data, privacy and consent](/contacts/data-and-privacy). ## Third parties and sub-processors DMLY relies on infrastructure providers to run the platform, and the **channels and payment providers you connect** (such as WhatsApp/Meta, Telegram, and your payment gateway) process the relevant data too when you send through them. Connecting a channel or a gateway means data flows to that provider under its own terms, which is inherent to using it. ## Data retention DMLY keeps the data in your workspace for as long as your account is active and you keep it there. Your CRM records (contacts, appointments, invoices, payments, and the messages in a conversation you have not archived) are not aged out on a schedule. They stay until you delete them, or until you close the account, after which they are removed in line with DMLY's operational and legal requirements. A few things do age out on their own, and you should plan around them: * **An archived conversation is permanently deleted 30 days after you archive it**, taking its messages and attachments with it, and the contact too if that was their only conversation. See [Conversation status](/inbox/conversation-status). * **Audit log** entries are kept for 180 days. See [Audit log](/account/audit-log). * The **Logs** activity feed keeps only the newest 300 entries per workspace, and trims daily. See [Logs](/troubleshooting/logs). * In-app alerts, and DMLY's own internal delivery bookkeeping, are cleared on their own short cycles. None of those windows can be changed from inside the app. ## Making a privacy request For a data request about your own account or business (a DPA, a data-residency question, or a formal privacy enquiry), contact DMLY. For a request from one of *your* customers about *their* data, you handle it yourself using the tools above, as the controller for that relationship. Where your data lives and how it's protected. Opt-out, blocking, export and deletion, precisely.