Retention and deletion

How long conversations, enquiries, files and audit logs are kept is set under Legal and data, in the Retention periods section (https://app.xicbot.de/recht). The three periods for conversations can also be set under Conversations (https://app.xicbot.de/gespraeche). This page covers the fields and their limits, what the recurring clean-up runs delete and what they leave in place, deleting single conversations, and deleting the entire account.

Setting retention periods

Under Legal and data each type of data has a field for its period in days. Whole numbers from 1 to 3650 are permitted. An empty field means nothing is deleted. Zero days is not permitted, because “no period” and “delete at once” would be two different things. Below each field you see what currently applies: Deleted after {n} days with the effective number, or Nothing is deleted. If an empty field follows another type of data, it also shows Without its own number, the period of “All conversations” applies.

Appointments and Handed-over carts show their period as a number with days (day for a single day), or as no limit, instead of a field, followed by Follows the period for “Enquiries” and cannot be set separately here. For Login events the reference is “Audit logs”. An enquiry falls under its own period even while its conversation is still running: it is a case of its own, not part of the conversation history. See Appointments and cases for more.

Periods can be changed by users with the Administration or Owner role. For the Read and Edit roles the fields and Save are disabled, and the card shows Retention periods can be changed by users with the Administration or Owner role. Save sends only the fields that can be set; while it runs, the button reads Saving …. The fields accept whole numbers from 1 to 3650; the browser already rejects a number outside that range before anything is sent. The page also checks each value itself; if it is not a whole number from 1 to 3650, nothing is sent and the page shows Permitted values are 1 to 3650 days. Leave the field empty for "nothing is deleted". After saving, Saved. appears and the Audit log records Retention periods changed (retention.updated). The audit log entry is written before the change; if it cannot be written, the previous periods stay in place and you see Not saved: the entry in the audit log could not be written. Please try again. The server rejects more than five requests per minute and user, which shows Too many attempts. Please wait a moment. Roles are explained in Team and roles.

Conversation periods under Conversations

Under Conversations the Retention periods section holds the fields All conversations, Test conversations and Via the API, each 1 to 3650. Above them it says A new account starts with 90 days for all conversations. Leaving "All conversations" empty is a deliberate choice: conversations without a period of their own are then not deleted. Below them: Test and API conversations without their own number follow the period for all conversations. Save sends all three values to the server together. For the Read and Edit roles the three fields and Save are disabled, and above the fields it says Retention periods can be changed by users with the Administration or Owner role. The audit log entry is written before the change; if it cannot be written, the previous period stays in place and you see Not saved: the entry in the audit log could not be written. Please try again. See Conversations for the list itself.

When data is deleted

Data is not deleted at the moment a period runs out but in two recurring runs. Conversations are handled by a nightly run scheduled for 03:17 UTC, which is 04:17 in Germany and 05:17 during daylight saving time. It takes, per channel, the conversations that started longer ago than the period. Every other type of data is cleared by an hourly run scheduled nine minutes past each hour. It works in separate sections; if one fails, the others carry on.

What a run has deleted usually appears in the Audit log (https://app.xicbot.de/protokoll) as Retention period applied: one summary entry per run and type of data, not one entry per deleted record. A run that deleted nothing leaves no entry. If a large amount has expired at once, the runs delete in batches and write one entry per batch: the nightly run at most 200 conversations per batch, the hourly run at most 1000 records per table, together with whatever depends on them, such as the documents and sections of a knowledge source. The entry is written before the deletion and together with it. If it cannot be written, the run does not delete that batch and stops for your account: the nightly run for the remaining conversations, the hourly run for the remaining records of the same type of data. It carries on with other accounts and, in the hourly run, with other types of data. Whatever stays behind is picked up again by a later run. The table in the audit log shows Time, Action, Subject and Who. The number of deleted rows, not counting what depends on them, is in the entry's data field, which GET /api/v1/activity returns; for the nightly run it also holds the number per channel under channels and the number of files from visitors under attachments.

What goes with a conversation and what stays

• A conversation disappears in one of four ways: when its period runs out, when it is deleted in the app, when the visitor deletes it in the widget, and when its assistant is deleted.
• When the period runs out, the conversation's messages, tool calls, knowledge gaps and files from visitors are deleted along with it.
• Jobs that carry the conversation are dropped. A handover email that has not been sent yet is no longer delivered; its entry in the mail deliveries is then marked as failed with the reason Gespräch vor dem Versand gelöscht.
• Enquiries, appointments and handed-over carts stay. They only lose their link to the conversation and expire under the Enquiries period. Before the link is removed, the service notes the conversation’s channel on them, so that Analytics still leaves out results from test dialogs and acceptance runs afterwards. Pending lead.created and appointment.requested notifications belong to the case and are not discarded, see API keys and webhooks.

Files

Visitors can attach at most five files per conversation, each up to 5 MB. The Files from visitors period deletes the file records. The file itself then has no record left and is removed in the same hourly run, which only takes files without a record that are older than one hour. The run also removes file folders that belong to no existing account. The Uploaded files period counts from when the knowledge source was created.

Audit logs

The Audit logs period covers the audit log, login events, webhook deliveries and mail deliveries, counted from the entry. Without a number nothing is deleted there.

Fixed clean-up

Without any setting, the hourly run also clears the following. Background jobs are described in Background jobs.

Deleting a conversation by hand

1. 1

   Step 1

   Pick the conversation

   Open Conversations (https://app.xicbot.de/gespraeche) and choose Delete on the conversation in the list. Only the Administration and Owner roles see this button; for all other roles the list ends with Deleting conversations needs the Administration or Owner role.

2. 2

   Step 2

   Confirm

   The question Delete this conversation with all messages? appears. Delete confirms; Cancel keeps the conversation.

3. 3

   Step 3

   Result

   The conversation disappears from the list and an open detail view closes. The Audit log records Conversation deleted.

The audit log entry is written before the deletion, in the same transaction. If it cannot be written, the conversation stays and you see The conversation “…” was not deleted: with the conversation's reference and the reason Not saved: the entry in the audit log could not be written. Please try again.

Deleting an assistant deletes all of its conversations as well. Visitors can delete their own conversation in the widget; enquiries and appointments stay in that case too, and the audit log records that the visitor deleted it. The information a visitor retrieves in the widget states the period for All conversations. The Administration and Owner roles delete a single enquiry, appointment or basket under Cases, together with its conversation if they choose, see Appointments and cases. See Consent and visitor rights for details.

Deleting the account

Only the Owner can delete the whole account, in the Delete account section at the bottom of Legal and data and after typing the word LOESCHEN. Everything the data catalogue marks for deletion is removed, including all assistants, knowledge sources, conversations with their messages, enquiries, appointments, invitations and memberships. Users who belong to no other account remain in anonymised form, and the account itself remains under the name Gelöscht. Anyone who still belongs to another account keeps their access and continues working there. The step-by-step procedure, the messages and the API are covered in Privacy and legal; if you want to keep data, create a data export first.

Via the API

The app calls these endpoints with its session. The full reference is in Conversations and management via the API. The Legal and data overview and account deletion via the API are described in Privacy and legal.

Frequent questions