Data Deletion & Subject Request Procedure
Last updated: November 1, 2026
Processes for deleting or anonymizing customer and business account data.
Submit a request
Contact the salon controller for appointment/staff records, or info@cbbdigital.us for CBBDigital-controlled account, service-order or security records. State the relevant business and the records/request, without sending unnecessary sensitive information. The authenticated account deletion flow is also available.
Verification and timing
We use proportionate verification of your relationship with the relevant account or phone/email channel. GDPR and UK GDPR requests are handled without undue delay, normally within one calendar month; a lawful extension is explained within that month. Swiss FADP and applicable US rights are addressed as relevant. You may complain to the competent authority, including the UK ICO.
Deletion, return and exceptions
We delete, anonymise or return data according to controller instructions and applicable law. Necessary accounting, dispute, fraud-prevention and legal-hold records can be retained with a specific purpose and period; this is not an unlimited discretionary veto. Restricted backups are handled separately and are not claimed to offer instant record-level erasure.
Connected services
Disconnection revokes or removes stored integration access where supported. A Meta data-deletion callback is distinct from this human-readable request procedure. External provider records follow the provider’s role and applicable obligations. International transfers are governed by the relevant GDPR/UK GDPR safeguards and UK Addendum where required.
Managed backups and restoration
New managed daily backups follow a 30-day rotation policy, retaining the latest two valid recovery copies and any documented legal holds. Earlier named archives are excluded from this automatic rotation and are subject to a separate necessity and deletion review. Backup archives are protected by strict server-side access controls and SHA-256 integrity manifests. We do not promise immediate record-level erasure within an archive. Before restoration, current deletion and notification opt-out records must be reapplied and verified before processing resumes; raw SQL/ZIP restoration does not automatically perform that replay.
13 stop commands
The complete exact command list, matching the webhook: STOP, İPTAL, IPTAL, DURDUR, RET, UNSUBSCRIBE, ABMELDEN, STOPZETTEN, AFMELDEN, ARRET, ARRÊT, DESABONNER, DÉSABONNER. Case and surrounding whitespace are normalised. Only a complete command matches; incoming text is inspected transiently and is not retained in webhook logs.
Optional Meta business connection and Platform Data requests
The salon owner may connect authorized WhatsApp Business assets through Facebook Login for Business. Selecting “Prepare connection” loads Meta's JavaScript SDK; Meta then receives network/browser information under its own terms. The SDK is not loaded merely by opening the connection page. Connection requests process a short-lived authorization code, app-scoped or business-system-user identifiers supplied/validated by Meta, WABA and phone-number IDs, granted permissions and an encrypted access token. App secrets and access tokens are protected server-side and are never displayed to salon customers. Authorizing a connection does not enable payments, notifications, OTP or marketing automatically. Meta account/phone registration, templates and the platform's entitlement/quota checks remain separate.
Local disconnection clears our usable integration credentials and disables WhatsApp and OTP. It does not itself remove your authorization in Meta Business settings; you can also revoke the app there. Signed Meta deauthorization and deletion callbacks are authenticated before processing. A matching integration is disabled; an identifier that cannot be reliably matched is placed in the administrator review queue, not guessed or falsely marked deleted. Data-deletion callbacks return an unguessable confirmation code and status link showing only the request status and public response. The CBBDigital administration receives an email notification.
Remaining Meta-derived data, processor instructions, lawful retention and account-link mapping are reviewed before completion. Removing a WhatsApp integration does not automatically erase unrelated salon appointments, subscriptions or records subject to mandatory retention. Applicable statutory deadlines in this policy continue to apply; the internal 28-day target does not authorize an extension. OAuth state is session-bound, expires after ten minutes, and expired state rows are opportunistically pruned after one day when new flows start. Encrypted integration credentials remain only while the connection is retained; minimal pseudonymous request, review and audit evidence is retained under the disclosed rights/security and legal-claims schedule, not an automatic promise to erase every backup instantly.