Data Deletion Instructions

At Graciax (operated by Keyakash Technologies Private Limited) we believe deletion should be as simple as sign-up. This page explains exactly who can request deletion, how to do it, what we delete, what we must retain by law, and how long it takes. Your rights under India's Digital Personal Data Protection Act, 2023 (DPDPA) and, where applicable, the EU GDPR are honoured here.

Who Can Request Deletion

Account Owner / Org Admin can delete the entire workspace, including all employees, candidates, and uploaded documents.
Individual Employee or User can request deletion of their personal profile data. If your employer is the data fiduciary, we will route the request to your org admin and notify you of the outcome.
Job Candidate can request removal of their candidate record at any time, including resume, contact details, and interview notes.
End User of an Integration (e.g., signed in via a third-party login) can request deletion even without logging in by emailing us from the address linked to the account.

How to Request Deletion

You have three options. Pick whichever is most convenient.

Option 1 — Self-serve in-app (fastest)

CRM: sign in at app.graciax.com → Profile → Settings → Account → Delete Account.
HRMS: sign in at people.graciax.com → Profile → Privacy → Request Data Deletion. Org admins will see an additional Delete Workspace option.
You will be asked to confirm via email and (for org admins) re-enter your password.

Option 2 — Email request

Send an email to support@graciax.com from the address registered on your account, with the subject line: "Data Deletion Request".
In the body include: your full name, organisation name (if applicable), registered email, and what you want deleted (account, specific records, candidate profile, etc.).
For security we may ask one verification question before processing.

Option 3 — Written request (Grievance Officer)

Address: Keyakash Technologies Private Limited, Attn: Grievance Officer, India.
Email: grievance@graciax.com.
Phone: +91 85480 50741.

Facebook, Instagram and WhatsApp Data

If you connected a Facebook Page, a Meta ad account or a WhatsApp Business Account to Graciax, the data we hold from Meta is deleted as follows.

Disconnect inside Graciax. Integrations → Meta Leads, Meta Campaigns or WhatsApp Business → Disconnect. This deletes the stored access tokens immediately and unlinks the Pages, ad accounts, WhatsApp accounts and phone numbers. Nothing further reaches Graciax from Meta.
Remove Graciax on Facebook. Go to Facebook → Settings → Business integrations, find Graciax and choose Remove. Meta then revokes every token issued to us for your account, so nothing further can be read or sent; the connection shows as needing attention in Graciax, and Disconnect removes the stored tokens and links.
Delete the leads and messages too. Leads from your forms and WhatsApp conversations are part of your workspace data. Delete individual records from the CRM, or request account or workspace deletion using any option above — the timelines and retention rules on this page apply.
Ask us. Email support@graciax.com with the subject "Meta data deletion" and we will confirm what was held and when it was removed.

Shopify Data

If you connected a Shopify store to Graciax, the data we hold from Shopify is deleted as follows.

Disconnect inside Graciax. Store → Setup → Disconnect the store. This removes our webhooks from your store and deletes the stored access and refresh tokens immediately. Nothing further reaches Graciax from Shopify. The mirrored orders stay in your workspace as history until you delete them or your workspace.
Uninstall in Shopify. Shopify admin → Apps → Graciax → Uninstall. The store is disconnected at once. Forty-eight hours later Shopify sends us a shop/redact notice and we delete the order mirror, abandoned checkouts and webhook records for that store.
One of your customers. When Shopify sends a customers/redact notice, their name, phone and email are removed from every order and checkout we hold within 48 hours. When it sends a customers/data_request, you can answer it from your own workspace, which holds everything we have about that customer; ask us if you need help.
Delete your workspace. The request process above covers Shopify data as well: the store connection, tokens, mirrored orders, checkouts, return requests and the agent activity log are all removed with the workspace.

What Gets Deleted

Once we confirm your request, the following will be permanently removed from our production systems:

Account credentials, profile, and contact information.
Uploaded files: profile photos, ID proofs, resumes, signed letters, receipts, and policy documents.
Employee records, leave history, payslips, attendance logs, and reimbursement claims for the deleted employees (HRMS).
Leads, contacts, deals, tasks, notes, and call logs (CRM).
Activity log entries that contain personal identifiers.
Third-party integration tokens (Google, biometric devices, SMTP credentials, etc.).

What We Are Required to Retain

Some records cannot be deleted on request because Indian law requires us (or your employer) to keep them. DPDPA 2023 §17(1)(c) recognises this carve-out. These records are retained in a restricted, audit-only archive for the legally required period, then deleted automatically.

Payroll, TDS, Form 16, Form 24Q retained for 8 years (Income-tax Act, 1961).
EPF / PF records retained for 5 years (EPF & MP Act, 1952).
ESI records retained for 5 years (ESI Act, 1948).
POSH / ICC complaint records and annual reports retained per Sexual Harassment of Women at Workplace Act, 2013.
Invoices and accounting records retained for 8 years (Companies Act, 2013 §128).
Anti-fraud and security logs IP, login, and audit trails kept for up to 12 months for abuse-prevention.

Encrypted Backups

Deleted data may persist in encrypted backups for up to 90 days after the deletion is confirmed. Backups are not used for any operational purpose; they exist solely for disaster recovery and are access-restricted. After 90 days, the data is overwritten and unrecoverable.

Timelines

Acknowledgement: within 2 business days.
Verification: 1–3 business days (we may ask one security question).
Production deletion: within 30 days of confirmed request, in line with DPDPA 2023.
Backup purge: within 90 days of production deletion.
Confirmation email: sent once production deletion is complete.

Children's Data

Graciax services are not directed to anyone under 18. If we learn that we have collected personal data of a minor without verifiable parental consent, we will delete it without requiring a formal request. Parents and guardians can write to grievance@graciax.com.

Sub-processors and Cross-Border Data

When you delete data from Graciax, we also instruct our sub-processors (e.g., cloud storage, email delivery, analytics) to delete the corresponding records. Most sub-processor deletions complete within the same 30-day window. A current list of sub-processors is published on our Security page.

Effect of Deletion

You will be signed out of all sessions immediately.
Active subscriptions are cancelled at the end of the current billing period (see Cancellation & Refund Policy).
You can reuse the same email to register a new Graciax account at any time, but the previous workspace cannot be restored.
Co-tenants and shared records (e.g., a CRM contact also held by another Graciax customer) will not be affected.

If You're Not Satisfied

If your request is denied or you believe we've handled it incorrectly, you can escalate to our Grievance Officer at grievance@graciax.com or, after exhausting our process, to the Data Protection Board of India under the DPDPA, 2023.

For the broader policy on what we collect and how we protect it, please see our Privacy Policy.

Chat with us

The support team is available 24/7

Email support@graciax.com

Email the privacy team

We acknowledge requests within 2 business days

support@graciax.com