Data deletion request

How to request the removal of data processed through Karacal, what gets deleted and how long it takes.

This page describes the deletion procedure for data relating to Karacal's AI conversational agents, including those published on WhatsApp.

Who this page is for

Karacal is the Red Lynx Robotics S.r.l. platform that allows you to build and distribute AI agents, including on WhatsApp.

This privacy notice applies to:

The categories of data processed and the respective privacy roles are different in the two cases.

Who processes your data

For WhatsApp conversations, the controller is normally the company or entity that operates the number the user wrote to. Red Lynx Robotics S.r.l. acts as a data processor, pursuant to art. 28 of Regulation (EU) 2016/679, based on the instructions given by the controller.

The deletion request must therefore be exercised towards the controller. The data subject can however send it to Red Lynx Robotics S.r.l., which will promptly forward it to the controller and provide the necessary assistance, carrying out the deletion on the managed systems only in accordance with the received instructions.

Upon request, Red Lynx Robotics S.r.l. will communicate to the data subject the identity and contact details of the controller linked to the WhatsApp number involved.

Red Lynx Robotics S.r.l. instead acts as the data controller for data relating to the Karacal account, the Meta authorisation and, where applicable, for the administrative logs kept for its own purposes of security, accountability and protection of rights.

End user If you talked to a WhatsApp assistant

What data may be processed

Depending on the configuration chosen by the controller, the following may be processed:

• your phone number in international format and the public name of your WhatsApp profile, if transmitted;
• the technical identifiers assigned by WhatsApp to messages, also used to prevent duplicate processing;
• the content of the messages sent and the assistant's replies, when conversation history retention is enabled;
• the state and context of the conversation necessary to manage the interaction;
• the attachments sent, such as images, documents and voice notes, kept in non-public archives;
• diagnostic data relating to the functioning of the assistant, which may include the user's number and the content of the messages exchanged.

This data is not sold or used by Red Lynx Robotics S.r.l. for advertising profiling purposes.

How long it is kept

The retention period of the conversation history is determined by the data controller in relation to its own purposes and legal bases. Red Lynx Robotics S.r.l., as data processor, retains the data for the period indicated by the controller and, upon termination of the relationship, deletes or returns them according to the instructions received and the provisions of the contract.

Diagnostic data is automatically deleted after 90 days and technical message identifiers after 8 days, unless a different retention is necessary to comply with a legal obligation or to establish, exercise or defend a legal claim.

How to request deletion

The request can be sent to privacy@redlynx.ai, stating:

• the data subject's WhatsApp number in international format, for example +39 333 1234567;
• the business number to which the messages were sent or, if known, the name of the company or assistant;
• the approximate time frame during which the conversation took place.

Red Lynx Robotics S.r.l. will assign an identification code to the request and promptly forward it to the controller, providing assistance for its management.

The right to erasure can be exercised in the cases provided for by art. 17, paragraphs 1 and 2, of Regulation (EU) 2016/679 and encounters the exceptions established by paragraph 3 of the same article, including those relating to legal obligations, public interest and the establishment, exercise or defense of legal claims.

What can be deleted

When the legal requirements are met and based on the controller's instructions, the deletion may concern:

• the link between the user's number and the conversations had with the assistant;
• the message history stored, if any;
• the stored state and context of the conversation;
• the attachments sent;
• the number and personal content present in diagnostic data.

If some data cannot be deleted, the data subject will be informed of the categories retained, the relative reason and, where possible, the period of further retention.

Administrator If you connected a WhatsApp number to Karacal

This section is for company administrators who connect a WhatsApp number to Karacal via Meta authorisation.

What data is acquired

The authorisation is used to manage the company's WhatsApp assets and not to collect data from your personal Facebook or Instagram profile. The following may be retained:

• the access credential issued by Meta, in encrypted form and used exclusively to manage authorized assets;
• the identifiers of the WhatsApp Business account, phone number and business portfolio;
• the connected business number and the related display name;
• a reference to the Karacal account from which the operation was performed, with date and time;
• the operations log for the activation, error and removal of the number.

Red Lynx Robotics S.r.l. does not store the administrator's public Meta profile and does not access the related personal data present on Facebook or Instagram.

How to request deletion

The request must be sent to privacy@redlynx.ai from the address associated with the Karacal account, indicating the WhatsApp number involved.

Revoking the authorisation and deletion

The authorisation granted to the application can be revoked through the business settings of your Meta account. Revoking stops Karacal's future access to WhatsApp assets, but does not automatically determine the deletion of the data already stored in Karacal systems.

To obtain the deletion, a specific request must therefore be submitted.

Effects of deletion

Deleting the data relating to the connection stops the service on the number involved. In particular:

• the access credential is revoked and deleted;
• the link between the number and the Karacal workspace is removed;
• the asset identifiers and the display name are deleted.

Deleting the link does not automatically include the conversations of the end users. The administrator who intends to request their removal must explicitly indicate it, without prejudice to compliance with the controller's instructions and the rights of the data subjects.

Identity verification

Red Lynx Robotics S.r.l. adopts verification methods proportionate to the risk, such as confirmation via the WhatsApp number involved or the email address associated with the Karacal account.

As a rule, a copy of an identity document is not requested. If there are reasonable doubts about the identity of the requester, strictly necessary additional information may however be requested for verification, pursuant to art. 12, paragraph 6, of Regulation (EU) 2016/679.

If it is not possible to adequately verify the identity, the requester is informed and the request is not executed until the verification is completed.

Timing and notification of the outcome

Information on the action taken is provided without undue delay and, in any event, within one month of receipt of the request.

Considering the complexity or number of requests, this period may be extended by two further months. In this case, the data subject is informed of the extension and the reasons for it within one month of receipt of the request, pursuant to art. 12, paragraph 3, of Regulation (EU) 2016/679.

Upon completion of the operations, a written confirmation is sent, bearing the request code, indicating:

• the deleted data;
• the systems involved;
• any retained data and the relative reason;
• the remaining time necessary for deletion from backup copies.

Backups, providers and recipients

The data is deleted from active systems and the corresponding deletion instruction is given to the providers and sub-processors involved.

Copies present in backup systems, which cannot be used for ordinary operations, are deleted through the normal overwrite cycle within 90 days. If a backup copy is exceptionally restored before being overwritten, the deletion is applied again.

Pursuant to art. 19 of Regulation (EU) 2016/679, the controller communicates the deletion to any recipients to whom the data have been transmitted, unless this proves impossible or involves disproportionate effort. The data subject can ask to know these recipients.

Data that may be retained

Even after the request, the following may be retained:

• data necessary to comply with legal obligations;
• data necessary to establish, exercise or defend a legal claim;
• data for which another exception provided for by art. 17, paragraph 3, of Regulation (EU) 2016/679 applies;
• aggregated or irreversibly anonymized data;
• the reduced log of administrative operations on the connected numbers.

The administrative log is kept for 24 months from the single operation, for security, traceability of activations and removals, prevention of abuse and protection of Red Lynx Robotics S.r.l.'s rights. The log contains only strictly necessary data and, for this processing, Red Lynx Robotics S.r.l. acts as an independent data controller based on its legitimate interest, after balancing with the rights of the data subjects.

Copies held by WhatsApp

The conversation may also be present on the user's device and in the WhatsApp infrastructure, managed by Meta and not under the control of Red Lynx Robotics S.r.l.

The procedure described concerns Karacal systems and the copies kept by providers on whom Red Lynx Robotics S.r.l. or the controller can issue instructions. For data kept independently by WhatsApp, the tools provided by Meta must be used.

Other rights, complaints and contacts

In the cases provided for by law, the data subject can also exercise the rights of access, rectification, restriction, objection and portability, using the contact details indicated on this page.

It is also possible to lodge a complaint with the Data Protection Authority: garanteprivacy.it (in Italy).

The complete privacy notice regarding processing by Red Lynx Robotics S.r.l. is available in the privacy policy.