*Borrador para revisión de abogado colombiano*
*Documento interno — no se publica*

**IALABS.APP · AGENTRIXLABS.COM.CO · S360.TECH — CORDOVA GROUP S.A.S.**

# Política de retención y supresión, y especificación técnica del borrado

Versión 1.0 · Vigente desde el 22 de octubre de 2026 · Cordova Group S.A.S., NIT 901578119-7 · Sitios: ialabs.app (sitio principal), agentrixlabs.com.co y s360.tech

Parte A (en español): cuánto tiempo guardamos cada dato y qué dispara su eliminación. Parte B (en inglés): cómo se automatiza el borrado en nuestra infraestructura, con pruebas de aceptación.

---

# Parte A. Política de retención y supresión

## A.1 Reglas generales

A.1.1 Conservamos cada dato solo el tiempo necesario para su finalidad. Gana siempre el plazo más corto entre: (a) el de este documento; (b) el que configure el Cliente para los datos que tratamos por su cuenta; y (c) el que resulte de una solicitud de supresión.

A.1.2 **Eliminar** es borrar de forma definitiva. **Anonimizar** solo cuenta como eliminar si ya no es posible identificar a la persona, ni siquiera combinando datos. Desactivar o esconder un registro no es eliminarlo.

A.1.3 Las copias de respaldo salen de rotación en máximo 35 días. Mientras tanto quedan cifradas, aisladas y sin uso. Si alguna vez restauramos una copia, volvemos a aplicar todas las eliminaciones posteriores antes de reabrir el servicio (Parte B, W6).

A.1.4 Todo se aloja y se trata solo en Colombia, Estados Unidos y Estados de la Unión Europea (Contexto Maestro v2, §5).

A.1.5 Este documento desarrolla la sección 16 de la Política de Privacidad (08), la página de Eliminación (07), la cláusula 8 del Contrato de Transmisión de Datos (02) y el Procedimiento de consultas y reclamos (17).

## A.2 Datos que tratamos como Responsable

| Dato | Dónde vive | Plazo | Qué dispara la eliminación | Cómo se elimina |
|---|---|---|---|---|
| Cuenta del Cliente y de sus Usuarios Autorizados | Base de datos de la Plataforma | Mientras la cuenta esté activa. Al terminar: 30 días para exportar y luego eliminación en máximo 15 días hábiles, con certificado | Terminación, cierre de cuenta o solicitud del titular | Flujo W1 o W2 |
| Usuarios individuales (consumidores B2C): identificación, cuenta, uso y configuración | Base de datos de la Plataforma | Igual que la fila anterior | Cancelación, retracto o solicitud | W1 o W2 |
| Facturas y soportes contables | Sistema de facturación electrónica | 10 años (art. 28 de la Ley 962 de 2005) | Vencimiento del plazo | Revisión anual |
| Datos de pago | Bold (la pasarela) | Según las normas financieras que aplican a Bold. No guardamos datos de tarjeta | — | Rol de Bold por definir con el abogado (09 §2 D; 21 R4) |
| Prospectos y comunicaciones comerciales | CRM propio (HubSpot) | 24 meses desde la última interacción, o hasta que la persona revoque su autorización | Vencimiento o revocatoria | W4 mensual; W7 (HubSpot) |
| Lista de exclusión (por ejemplo, un número en forma cifrada) | Base de datos de la Plataforma | Mientras el titular no pida lo contrario | Solicitud del titular | Borrado manual |
| Prueba de autorizaciones, cuando somos Responsables | Base de datos de la Plataforma | Mientras tratemos los datos y 3 años más (art. 52 de la Ley 1437 de 2011) | Vencimiento | W4 |
| Soporte y PQR: correos y chats con nuestro equipo | Correo y bandeja de soporte | 12 meses desde la última interacción | Vencimiento o solicitud | W4 o manual |
| Registro de solicitudes de datos y certificados de eliminación | Registro (documento 17) y tabla de auditoría | 2 años desde el cierre | Vencimiento | W4 |
| Modelo de voz de una persona real (voz clonada) | Proveedor de voz y base de datos de la Plataforma | Mientras esté vigente la autorización de esa persona; se suprime de inmediato al revocarla | Revocatoria | W2 y W7 (ElevenLabs) |
| Visitantes de los Sitios: cookies y analítica | Navegador y proveedores de analítica | Según la Política de Cookies (12) | Vencimiento o retiro del consentimiento | Configuración del proveedor |

## A.3 Datos que tratamos como Encargado (Contactos de los Clientes)

| Dato | Dónde vive | Plazo por defecto | Qué dispara la eliminación | Cómo se elimina |
|---|---|---|---|---|
| Conversaciones de texto (WhatsApp, Instagram, Messenger) | Base de datos de la Plataforma | 12 meses desde la última interacción | Vencimiento, instrucción del Cliente o terminación | W4, W2 o W1 |
| Grabaciones de llamadas y audios | Almacenamiento de archivos (R2), Twilio y ElevenLabs | 90 días | Vencimiento, instrucción del Cliente o terminación | W4, W2, W7 |
| Transcripciones | Base de datos de la Plataforma y ElevenLabs | 12 meses | Ídem | W4, W2, W7 |
| Metadatos y estados de entrega | Base de datos de la Plataforma | 12 meses | Ídem | W4, W2 |
| Datos de citas creadas por el Agente | Base de datos de la Plataforma (y el calendario del Cliente, que es suyo) | 12 meses | Ídem | W4, W2 |
| Contenido del Cliente: bases de conocimiento, archivos e índices de búsqueda | Base de datos, almacenamiento de archivos e índice vectorial | Mientras la cuenta esté activa o el archivo siga elegido. Al retirarlo: eliminación en máximo 15 días hábiles | Retiro del archivo, desconexión o terminación | W3, W1 |
| Ejecuciones de automatizaciones (n8n) | n8n Cloud y n8n autoalojado | Máximo 30 días | Vencimiento | Depuración automática de n8n; W7 |

El Cliente puede fijar plazos menores. Nunca mayores, salvo que la ley lo exija.

## A.4 Datos de plataformas que conecta el Cliente

| Dato | Plazo | Qué dispara la eliminación |
|---|---|---|
| Datos de Plataforma de Meta: cuenta de WhatsApp Business, números, plantillas, páginas e identificadores de Instagram y Messenger, y tokens de acceso | Mientras la cuenta esté conectada. Al desconectar: revocación en 1 día hábil y eliminación en máximo 15 días hábiles | Desconexión, solicitud o terminación (W3) |
| Tokens de Google | Hasta la desconexión. Revocación en 1 día hábil | Desconexión (W3) |
| Registro de correos enviados con Gmail | 12 meses | Vencimiento o solicitud |
| Texto extraído de archivos de Google Drive e índice de búsqueda | Mientras el archivo siga elegido y la cuenta conectada. Después, eliminación en máximo 15 días hábiles | Retiro del archivo o desconexión (W3) |

Los eventos, correos y archivos que siguen en la cuenta de Google del Cliente son suyos. No los borramos.

## A.5 Registros y copias

| Dato | Plazo |
|---|---|
| Registros técnicos | 12 meses |
| Registros de seguridad | Hasta 24 meses |
| Registro de versiones de IA por Agente y eventos por conversación (documento 10, §9) | 12 meses; los de seguridad, hasta 24 |
| Copias de respaldo | Salen de rotación en máximo 35 días |
| Datos agregados y anonimizados | Sin plazo, porque ya no identifican a nadie |

## A.6 Qué dispara una eliminación

| Disparador | Plazo | Flujo |
|---|---|---|
| T1. Solicitud de un titular sobre datos de los que somos Responsables | Acuse 2 días hábiles; bases activas 15 días hábiles (+8) | W2 |
| T2. Instrucción del Cliente sobre un Contacto | 15 días hábiles desde la instrucción | W2 |
| T3. Desconexión de WhatsApp, Instagram, Messenger o Google | Revocación 1 día hábil; datos 15 días hábiles | W3 |
| T4. Terminación o cierre de cuenta | 30 días para exportar; luego 15 días hábiles y certificado | W1 |
| T5. Vencimiento de un plazo de este documento | Diario | W4 |
| T6. Solicitud de eliminación enviada por Meta a nuestra app | Igual que T1 | W5 |

## A.7 Lo que no depende de nosotros

Algunos proveedores guardan copias por su cuenta, con plazos propios. Por ejemplo: Meta conserva los mensajes de WhatsApp hasta 30 días; algunos proveedores de modelos guardan solicitudes hasta 30 días para detectar abusos; Resend guarda los correos 30 días. Esos plazos se publican en /legal/subencargados y se informan en el certificado de eliminación.

---

# Part B. Technical specification — automated deletion

*Language: English (internal technical spec). Status: target design. Table and service names are indicative; map them to the real schema before building. Doubts are marked [VERIFY].*

## B.1 Principles

1. **Hard delete** is the final state. Soft delete is allowed only as a transitional state, at most 24 hours.
2. **Idempotent** jobs: running a deletion twice must succeed and change nothing the second time.
3. **No raw identifiers in audit trails.** Use `contact_key = HMAC-SHA256(PEPPER, normalized_identifier)`.
4. **Tenant isolation first:** every delete statement filters by `tenant_id`, enforced by row-level security.
5. **Deadlines in Colombian business days**, computed by one shared function (`business_days_add(date, n)`) using the Colombian holiday calendar (e.g., Python `holidays` with country `CO`).
6. **Location rule:** storage only in Colombia, US or EU regions. Any new store must be added to the data map before going live.
7. **Content-free logs:** application logs never contain message text, transcripts or audio URLs.

## B.2 Data map

| # | Store | Location | Personal data | Tenant key | Contact key | Deletion method | Retention job |
|---|---|---|---|---|---|---|---|
| S1 | Supabase Postgres (core DB) | US or EU region [VERIFY project region] | Accounts, users, B2C users, contacts, conversations, messages, transcripts, appointments, channel connections (encrypted tokens), consent records, suppression list, AI trace log, deletion requests, audit | `tenant_id` | `contact_id` via `contact_key` | SQL hard delete in a transaction; cascades from `tenants` and `contacts` | W4 daily |
| S2 | Vector index (pgvector in S1) [VERIFY: confirm it is in Supabase and not an external service] | Same as S1 | Embeddings and chunks of knowledge-base files and Drive files | `tenant_id` | — (KB is client content) | Delete chunks by `file_id` / `tenant_id` | On file removal |
| S3 | Cloudflare R2 bucket `s360t-prod` | US or EU jurisdiction [VERIFY bucket location] | Call audio, uploaded files, exports, backups | Key prefix `tenants/{tenant_id}/` | Key prefix `tenants/{tenant_id}/contacts/{contact_key}/` | S3 API `DeleteObjects` by prefix listing | Lifecycle rules (B.6) |
| S4 | OVH VPS (Dokploy, Traefik, Cloudflare Tunnels) | US | Container volumes, temporary files, self-hosted n8n database, queues, Traefik access logs | — | — | Temp files purged on job end; volumes covered by W4 | Log rotation |
| S5 | n8n Cloud (EU) and n8n self-hosted | EU / US | Execution data (payloads may include messages) | Workflow per tenant (naming convention) | Execution tagged with `contact_key` [VERIFY feasibility] | Pruning settings; API delete of executions | Max 30 days |
| S6 | Backups (Supabase daily backups; VPS volume backups in R2 `backups/`) | Same as source | Everything in S1 and S4 | — | — | Rotation; deletion ledger replay on restore | ≤ 35 days |
| S7 | Twilio | US | Recordings, transcriptions, call records, SMS bodies | Subaccount or tag per tenant | Call SID / Message SID stored in S1 | REST DELETE (B.5, W7) | Recordings 90 days |
| S8 | ElevenLabs | US | Voice-agent conversations (audio and transcript); cloned voice models | Agent per tenant | `conversation_id` stored in S1 | REST DELETE; per-agent retention 90 days | Platform retention |
| S9 | OpenAI, Anthropic, Groq, OpenRouter | US | Prompts in flight only; nothing stored under our settings | — | — | Configuration evidence; delete stored objects if any | Provider |
| S10 | HubSpot (own CRM) | US [VERIFY account region] | Prospects (we are Responsable) | — | Contact ID / e-mail | GDPR delete API | 24 months inactive |
| S11 | Resend | US | Transactional e-mails | — | — | Provider retention (30 days); no per-message delete [VERIFY] | Provider |
| S12 | Meta and Google | — | Client-owned data under the client's own terms | — | — | Not deleted by us; we revoke access | — |
| S13 | Dapta (only for agents not yet migrated) | [VERIFY data location] | Conversations and calls of those agents | Workspace per client | Conversation ID | Panel or API [VERIFY] | Until migration ends |

## B.3 Data model (sketch)

```sql
create table deletion_requests (
  id                text primary key,            -- 'DP-2026-001' (same ID as the registry in doc 17)
  confirmation_code text unique not null,        -- 8 alphanumeric chars
  scope             text not null check (scope in ('tenant','contact','user','channel','voice_model')),
  tenant_id         uuid,
  subject_key       text,                        -- HMAC of normalized identifier; never the raw value
  source            text not null check (source in ('email','whatsapp','phone','mail','panel','meta_callback','client_instruction','retention')),
  role              text not null check (role in ('responsable','encargado')),
  status            text not null default 'received',  -- received, verified, forwarded, in_progress, active_deleted, completed, rejected
  claim_flag        boolean default false,       -- 'reclamo en trámite'
  received_at       timestamptz not null default now(),
  verified_at       timestamptz,
  due_ack_at        timestamptz,                 -- +2 business days
  due_revoke_at     timestamptz,                 -- verified_at + 1 business day
  due_active_at     timestamptz,                 -- +15 business days (+8 with notice)
  active_deleted_at timestamptz,
  backups_clear_by  timestamptz,                 -- active_deleted_at + 35 days
  certificate_ref   text,
  retained          jsonb                        -- what is kept, legal basis, until when
);

create table deletion_audit (                    -- append-only
  id           bigserial primary key,
  request_id   text references deletion_requests(id),
  step         text not null,                    -- e.g. 'R2.delete_prefix', 'twilio.recording.delete'
  system       text not null,
  status       text not null,                    -- ok, error, skipped
  object_count integer,
  started_at   timestamptz not null,
  finished_at  timestamptz,
  operator     text not null,                    -- service name or person
  error        text,
  evidence_ref text
);
revoke update, delete on deletion_audit from app_role;

create table suppression_list (
  subject_key text primary key,                  -- HMAC only
  channel     text,
  added_at    timestamptz not null default now(),
  reason      text                               -- 'stop', 'deletion', 'revocation'
);
```

## B.4 Workflows

### W1 — Tenant deletion (termination or account closure)

1. Day T (termination): set `tenants.status = 'offboarding'`; disable all agents; run W3 for every connected channel (deadline: 1 business day); enable the export endpoint (JSON/CSV plus standard audio formats).
2. Day T + 30 calendar days: create `deletion_request(scope='tenant')`.
3. Third parties first (W7): Twilio recordings and call records; ElevenLabs conversations and agents; OpenAI stored objects, if any; n8n executions and the tenant's workflows; Dapta, if still in use.
4. R2: list and delete every object under `tenants/{tenant_id}/` (paginate `ListObjectsV2`, then `DeleteObjects` in batches of up to 1,000 keys).
5. Postgres: in one transaction, delete the tenant row and let `ON DELETE CASCADE` remove dependent rows (contacts, conversations, messages, transcripts, appointments, files, vector chunks, channel connections, AI trace log). Keep only: invoices (separate billing schema), consent proofs while their retention runs, and suppression hashes.
6. Verify: count rows for `tenant_id` in every table equals 0 (except the retained schemas); R2 prefix is empty.
7. Set `active_deleted_at`, compute `backups_clear_by`, generate the certificate (W8) and close the request.

Deadline: step 7 within 15 business days of T + 30 days. Target: same day.

### W2 — Contact or individual-user deletion

Input: `tenant_id` (for Contactos) and one or more identifiers (E.164 phone, `wa_id`, Instagram-scoped ID, Page-scoped ID, e-mail).

1. Normalize identifiers and compute `contact_key` values. Resolve `contact_id`s **within the tenant only**.
2. If it is a claim, set `claim_flag = true` and show «reclamo en trámite» in the inbox within 2 business days of the complete claim. Clear the flag when resolved.
3. Collect third-party references from S1 (call SIDs, message SIDs, ElevenLabs `conversation_id`s) before deleting rows.
4. W7 deletes at Twilio and ElevenLabs.
5. R2: delete prefix `tenants/{tenant_id}/contacts/{contact_key}/`.
6. Postgres: delete the contact and cascade (conversations, messages, transcripts, appointments, AI traces referencing the contact).
7. If the person asked to stop being contacted, insert the `contact_key` into `suppression_list`.
8. Audit, certificate if requested, close.

For a cloned voice (scope `voice_model`): delete the voice at ElevenLabs (`DELETE /v1/voices/{voice_id}`), disable every agent that uses it, and delete stored samples in R2.

### W3 — Channel disconnection (deadline: 1 business day from verification)

| Channel | Call | Then |
|---|---|---|
| WhatsApp | `DELETE https://graph.facebook.com/{META_GRAPH_VERSION}/{WABA_ID}/subscribed_apps` (Bearer token of our app for that WABA) | Delete stored tokens; disable agents. Deregister the number (`POST /{PHONE_NUMBER_ID}/deregister` [VERIFY]) **only if the client asks**. Hand over or disable the two-step PIN within 5 business days (07 §2.3). |
| Messenger | `DELETE https://graph.facebook.com/{META_GRAPH_VERSION}/{PAGE_ID}/subscribed_apps` (Page access token) | Delete the Page token. |
| Instagram (via Facebook Login, Page-linked account) | Same Page unsubscription as Messenger [VERIFY that Instagram messaging webhooks stop] | Delete the Instagram tokens. |
| Instagram (via Instagram Login) | `DELETE https://graph.instagram.com/{VERSION}/me/subscribed_apps` [VERIFY] | Delete the Instagram user token. |
| Google | `POST https://oauth2.googleapis.com/revoke` with `token={refresh_token}` and `Content-Type: application/x-www-form-urlencoded`; expect HTTP 200 | Delete tokens; stop sync; queue deletion of Drive text and indexes within 15 business days. |

Also implement Meta's **deauthorize callback** so that removing the app from Meta triggers W3 automatically [VERIFY availability for business integrations]. `META_GRAPH_VERSION` is a configuration value (v26.0 in Meta's docs at the time of writing).

### W4 — Retention sweeper (daily, 03:00 Colombia time)

Runs as a scheduled job (Dokploy cron or self-hosted n8n). Each rule deletes in batches and writes one audit row with counts only.

| Rule | Condition |
|---|---|
| Messages and conversations | `last_interaction_at < now() - least(12 months, tenant_setting)` |
| Audio objects (R2) | Age > 90 days (also enforced by an R2 lifecycle rule) |
| Twilio recordings | `DateCreated` > 90 days → delete via API |
| Transcripts and metadata | > 12 months |
| Appointments | > 12 months |
| Technical logs / security logs | > 12 months / > 24 months |
| AI trace log | > 12 months (security-relevant entries 24) |
| n8n executions | > 30 days (self-hosted: `EXECUTIONS_DATA_PRUNE=true`, `EXECUTIONS_DATA_MAX_AGE=720` hours; n8n Cloud: plan setting [VERIFY]) |
| Exports | > 30 days |
| Prospects (HubSpot) | Last activity > 24 months → GDPR delete (monthly run) |
| Consent proofs | End of processing + 3 years |
| Deletion requests and certificates | Closed > 2 years → delete personal fields; keep counts |

### W5 — Meta data deletion callback (optional)

Today the Meta app uses the data deletion **instructions URL** (07). Build this callback only if the app switches to the callback option; Meta asks for one of the two [VERIFY].

1. Endpoint: `POST https://ialabs.app/api/meta/data-deletion` (API path, not a legal page; set it in the Meta app dashboard).
2. Read the form field `signed_request`. Split on the first `.` into `encoded_sig` and `payload`. Base64url-decode both.
3. Compute `HMAC-SHA256(payload, APP_SECRET)` and compare with the decoded signature in constant time. If it does not match, return HTTP 400 and create nothing.
4. Parse the JSON payload (`algorithm`, `expires`, `issued_at`, `user_id`). Reject if `algorithm` is not `HMAC-SHA256`.
5. `user_id` is the app-scoped ID of the person who used our app (for example, during Embedded Signup). Look it up and create `deletion_request(source='meta_callback', scope='user')`. If the same `user_id` already has an open request, reuse its code (idempotent).
6. Respond HTTP 200, `Content-Type: application/json`:

```json
{ "url": "https://ialabs.app/legal/eliminacion?codigo=AB12CD34", "confirmation_code": "AB12CD34" }
```

7. `/legal/eliminacion?codigo=…` shows only the stage and the dates. It shows no personal data, returns a generic message for unknown codes and is rate-limited.
8. Deleting this person's data does not delete the client's WhatsApp Business Account data, which belongs to the client. Notify the client's admin.

### W6 — Backups

- Supabase daily backups (Pro plan: 7 days [VERIFY plan and whether PITR is enabled]).
- VPS volume backups to R2 under `backups/`, with a lifecycle rule that expires objects at 35 days. Any OVH snapshot must also rotate in ≤ 35 days.
- Backups are encrypted, and access is limited to the operator.
- **Deletion ledger:** after any restore (production or staging), run `replay_deletions --since <backup_timestamp>` before reopening the service. It re-applies every request completed after the backup was taken.

### W7 — Third-party deletion

| Provider | Action |
|---|---|
| Twilio | `DELETE https://api.twilio.com/2010-04-01/Accounts/{AccountSid}/Recordings/{RecordingSid}.json`; also `…/Transcriptions/{Sid}.json`, `…/Calls/{CallSid}.json` and `…/Messages/{MessageSid}.json` when the scope requires it. |
| ElevenLabs | `DELETE https://api.elevenlabs.io/v1/convai/conversations/{conversation_id}` (header `xi-api-key`); set `retention_days = 90` on every agent; training opt-out enabled (blocking pending in 10). Cloned voices: `DELETE /v1/voices/{voice_id}`. |
| OpenAI | Send `store=false`. If any object was stored: `DELETE /v1/responses/{id}`, `DELETE /v1/files/{id}` and vector stores, if used. Abuse-monitoring copies (up to 30 days) are the provider's. |
| Anthropic, Groq, OpenRouter | Groq and OpenRouter: nothing stored under our settings (zero retention, logging off). Anthropic: up to 30 days unless zero retention is granted. Keep dated screenshots of the settings as evidence. |
| n8n | Pruning settings (W4). Contact-level deletion of executions through the n8n public API (`DELETE /api/v1/executions/{id}`) [VERIFY]. |
| HubSpot | `POST https://api.hubapi.com/crm/v3/objects/contacts/gdpr-delete` [VERIFY payload]. |
| Resend | Provider retention (30 days); record it in the certificate. |
| Dapta | Delete per conversation or workspace through its panel or API [VERIFY]; record evidence. |

### W8 — Deletion certificate

Generated from `deletion_requests` and `deletion_audit` (template F of doc 17): ID and code, subject (partial identifier), scope, dates, systems and providers with timestamps, accesses revoked, `backups_clear_by`, data retained with legal basis and end date. Stored 2 years. Sent when requested.

### W9 — Audit log

`deletion_audit` is append-only for the application role. Only a separate maintenance role can purge entries older than 2 years. Every workflow step writes one row: system, action, status, object count, timestamps and operator. No raw identifiers.

## B.5 Configuration checklist

- `PEPPER` and `APP_SECRET` stored as Dokploy secrets, never in code.
- Row-level security on every tenant table; deletion functions run as `security definer` with an explicit `tenant_id` argument.
- R2 lifecycle rules: `audio/` 90 days; `exports/` 30 days; `backups/` 35 days.
- ElevenLabs `retention_days = 90` per agent; Twilio recordings deleted by W4.
- Log redaction middleware: phone numbers masked and no message bodies.
- Colombian holidays loaded for the current and the next year.

## B.6 Acceptance tests

| ID | Given | When | Then |
|---|---|---|---|
| AT-01 | Tenant A with data in every store | W1 runs | 0 rows for A outside the retained schemas; R2 prefix empty; certificate created; audit rows for every step |
| AT-02 | Tenant A with contacts X and Y | W2 for X | All of X's data is gone; Y untouched; other tenants untouched |
| AT-03 | Same phone number is a contact in tenants A and B | W2 for A | Only A's copy is deleted |
| AT-04 | Twilio recordings older and newer than 90 days | W4 runs | No recording older than 90 days remains; newer ones remain |
| AT-05 | ElevenLabs agents | Read agent settings | Every agent has `retention_days = 90`; W2 delete returns 200 |
| AT-06 | Connected WhatsApp Business Account | W3 WhatsApp | `GET /{WABA_ID}/subscribed_apps` no longer lists our app; tokens deleted; agents disabled; within 1 business day |
| AT-07 | Connected Messenger Page and Instagram account | W3 | No more webhooks arrive in a 10-minute test window; tokens deleted |
| AT-08 | Connected Google account | W3 Google | Revoke returns 200; refreshing with the old token fails with `invalid_grant`; tokens deleted |
| AT-09 | Valid `signed_request` | POST to the Meta callback | 200 with `url` and `confirmation_code`; a repeated call returns the same code |
| AT-10 | Tampered `signed_request` | POST | 400; nothing created |
| AT-11 | Status page | Valid, unknown and many rapid codes | Stage shown without personal data; generic message for unknown codes; rate limit triggers |
| AT-12 | Request received on 23 Dec 2026 | Deadlines computed | 25 Dec, 1 Jan, 11 Jan 2027 (Epiphany moved to Monday, Ley 51 de 1983) and weekends are skipped, per the Colombian calendar |
| AT-13 | Complete claim | Flag set | «Reclamo en trámite» visible in the inbox within 2 business days; removed on resolution |
| AT-14 | Contact on the suppression list | Outbound message attempt | Blocked and logged |
| AT-15 | Backup taken before a completed deletion | Restore to staging and run `replay_deletions` | The subject is absent before the environment opens |
| AT-16 | Seeded data around each threshold | W4 runs | Older data deleted, newer kept; audit shows counts |
| AT-17 | Application logs after a test conversation | Search for the message text | No matches |
| AT-18 | Application role | `UPDATE` or `DELETE` on `deletion_audit` | Denied |
| AT-19 | n8n executions older than 30 days | Pruning runs | None remain |
| AT-20 | Cloned voice with revoked authorization | W2 `voice_model` | Voice deleted at ElevenLabs; dependent agents disabled |
| AT-21 | Prospect inactive for over 24 months | Monthly W4 | Removed from HubSpot; suppression hash kept |
| AT-22 | 20 test requests | End to end | 100 % completed in active stores within 15 business days (target: 1 day) |

## B.7 Open items [VERIFY]

- Actual table names and foreign keys; confirm `ON DELETE CASCADE` coverage.
- Where the vector index lives (pgvector in Supabase or an external service).
- Supabase project region, plan backup retention and PITR.
- R2 bucket location or jurisdiction (US or EU).
- Instagram unsubscription path for each login type; the deauthorize callback for business integrations; the WhatsApp `deregister` endpoint.
- n8n Cloud execution retention and contact-level execution search.
- HubSpot GDPR-delete payload; Resend per-message deletion.
- Dapta deletion capability while agents remain there.

---

## Anexo interno — no publicar

### Cambios respecto a versiones anteriores

| Sección | Antes | Ahora | Motivo |
|---|---|---|---|
| Documento completo | No existía | Documento nuevo (plan P16) | Fase 4 del plan |
| A.2 | 08 §16.1 dejaba en corchetes el plazo de prospectos, la prueba de autorizaciones y el registro de solicitudes | 24 meses; mientras tratemos los datos y 3 años más; 2 años | Contexto Maestro v2 §7 |
| A.3 | Sin plazo para ejecuciones de n8n | Máximo 30 días | Minimizar copias de conversaciones fuera de la base principal |
| W5 | 07 §4.3 mencionaba /legal/eliminacion/estado | Estado en /legal/eliminacion?codigo=… | Contexto Maestro v2 §3: no crear otras URL |

### Pendientes antes de usar

- [ ] Mapear la Parte B al esquema real de la base de datos y confirmar las cascadas.
- [ ] Confirmar la región de Supabase, la ubicación del bucket R2 y dónde vive el índice vectorial; todo debe quedar en EE. UU. o UE.
- [ ] Identificar el sistema de facturación electrónica y confirmar que guarda las facturas 10 años.
- [ ] ElevenLabs: activar la exclusión de entrenamiento y fijar `retention_days = 90` en cada agente (bloqueante).
- [ ] Twilio: programar el borrado de grabaciones a los 90 días.
- [ ] n8n: activar la depuración de ejecuciones a 30 días en la nube y en la instancia propia.
- [ ] Registrar en Meta la URL del callback de eliminación y, si aplica, la de desautorización.
- [ ] Hacer una prueba de restauración con `replay_deletions` antes de vender a más clientes.
- [ ] Dapta: confirmar cómo se borra mientras dure la migración.
- [ ] Resolver los puntos [VERIFY] de B.7.
- [ ] Revisión del abogado.