Fillo keeps data until someone with access deletes it, apart from a small set of fixed cleanup windows.
Current retention behavior
| Data | Current behavior |
|---|---|
| Completed responses | Kept until an authorized user deletes them or the workspace is deleted |
| In-progress drafts | Deleted on submit, Start over, or seven days after the last save |
| Unclaimed upload data | Cleaned after its fixed recovery window when it never becomes part of a response or live draft |
| Funnel sessions | Purged after 90 days |
| Delivery rows | Retained for up to 90 days; removing their webhook or integration can delete them sooner |
| Workspace or sole-owner account deletion | Disabled immediately, then permanently purged after a 21-day grace period unless canceled |
There's no automatic per-form response-retention window yet. If your policy requires deletion after a fixed period, run a scheduled server job against the Management API and record the outcome.
Delete one response
Open the response drawer and choose delete, or call the scoped Management API:
curl -X DELETE "https://fillo.so/api/v1/manage/responses/RESPONSE_ID" \
-H "Authorization: Bearer $FILLO_KEY"The key needs responses:delete. The operation is workspace-scoped and also removes that response's files from connected storage when provider cleanup succeeds.
Deleting a Fillo response can't retract a row, message, email, event, or copy an external destination already accepted. Those copies have to be deleted in the destination, under its own policy.
Erase a person
From a respondent view:
- Forget person removes the workspace-level profile, drafts, and identity while leaving completed answers anonymous.
- Delete person + responses also deletes that person's responses and their connected files.
Both operations are workspace-wide because respondent identity is scoped to the workspace, not one form.
Delete a workspace
Only an owner can schedule workspace deletion. The workspace stops accepting and serving data immediately, and the owner can cancel during the 21-day grace period. Permanent purge covers Fillo records and connected provider cleanup that Fillo can authorize.
Plan status and responsibility
Export and deletion controls are available on every plan. Fillo supplies product controls, data-processing terms, and subprocessor information — but choosing a lawful retention schedule, and applying it to downstream systems, is still on your organization.
Related
- Management API: Automate scoped response reads and deletion from a server.
- Uploads and storage: Understand provider ownership and file cleanup.
- Build a GDPR consent form: Connect consent copy to a concrete data workflow.