Data Deletion Policy

1. Three ways to delete your data

All three options have the same effect — pick whichever is most convenient.

1.1 In Telegram (recommended — instant)

1. Open the Yameen bot in Telegram.
2. Send /delete_account.
3. The bot will explain what is about to happen and ask for confirmation.
4. Send /delete_account CONFIRM.

Deletion is processed immediately. You will receive a final confirmation message; the bot then stops responding to your chat ID.

1.2 Web dashboard

When the dashboard is active for your account, sign in and use theDelete account control under Account settings. The same cascade is executed.

1.3 By email

Email contact@yameen.app from the address on your account, asking us to delete your data. We respond within 30 days; in practice we act on these within 3 working days. You may be asked to verify your Telegram chat ID so we can match the request to your account.

2. What gets deleted

On a deletion request we cascade across the database and remove:

• Your user record (Telegram chat ID, username, first name, timezone, account metadata).
• All encrypted OAuth tokens (Google / Microsoft / Slack) — and we revoke them on the provider side where the provider supports it (see §4 below).
• Your full conversation history with the bot.
• Pending confirmations and queued actions that have not yet executed.
• Briefing preferences (template, time, last-sent record).
• Tool-call audit logs associated with your account.
• Feedback signals you sent (👍 / 👎 / written feedback).
• Subscription metadata under our control (the underlying payment record at the processor follows §3).

The cascade is enforced at the database level (foreign keys with ON DELETE CASCADE) so a single deletion of your user row removes all associated data atomically.

3. What we may retain (and why)

A small set of records is retained where Saudi or applicable law requires it, even after a deletion request:

• Payment / billing records — VAT-relevant invoices and transaction records are retained for the period required by Saudi tax law (typically 5 years), held in pseudonymised form where possible. The matching payment record at the payment processor (Moyasar / Stripe) is governed by their retention policy.
• Compliance log — we keep a minimal record of your deletion request itself (timestamp, request method, completion timestamp, no payload) for our own audit and to demonstrate compliance with PDPL / GDPR rights requests.
• Encrypted backups — backups are rotated every 14 days. Personal data deleted today disappears from backup media within that cycle. We do not restore deleted data from backup except where necessary to recover from a disaster, and even then we re-apply outstanding deletion requests immediately on restore.

4. Provider-side data (Google / Microsoft / Slack / Telegram)

The data inside Google, Microsoft, and Slack stays in your own accounts on those platforms — we never owned a copy of it. What we held was the OAuth access permission. On deletion:

• We revoke the OAuth tokens on the provider side for Google and Microsoft (which removes Yameen from your Connected apps list there).
• For Slack, we discard the workspace token; you can also remove the app from Manage apps in your Slack workspace.
• You can partially achieve this without deleting your Yameen account by sending /disconnect google, /disconnect microsoft, or /disconnect slack.
• Telegram itself retains the chat history on your device and on Telegram’s servers per Telegram’s own policy. To delete that copy, use Telegram’s Clear history action and consider blocking the bot.

5. Timeline

6. After deletion

You can sign up again at any time with /start. A new account is created from scratch — there is no link between your old, deleted account and the new one.

7. Questions

Email contact@yameen.app. We’re also happy to confirm in writing that a deletion has been completed, on request.