---
title: "Data retention and deletion"
description: "How long Fillo keeps responses, drafts, files, telemetry, accounts, and workspaces — and how to delete them."
group: "Respondents & data"
order: 6
type: "feature"
keywords:
  - "retention"
  - "delete"
  - "GDPR"
  - "erase person"
  - "workspace deletion"
updated: "2026-07-14"
---

Fillo keeps data until someone with access deletes it, apart from a small set of fixed cleanup windows.

## Current retention behavior

| Data | Current behavior |
| --- | --- |
| Completed responses | Kept until an authorized user deletes them or the workspace is deleted |
| In-progress drafts | Deleted on submit, Start over, or seven days after the last save |
| Unclaimed upload data | Cleaned after its fixed recovery window when it never becomes part of a response or live draft |
| Funnel sessions | Purged after 90 days |
| Delivery rows | Retained for up to 90 days; removing their webhook or integration can delete them sooner |
| Workspace or sole-owner account deletion | Disabled immediately, then permanently purged after a 21-day grace period unless canceled |

There's no automatic per-form response-retention window yet. If your policy requires deletion after a fixed period, run a scheduled server job against the Management API and record the outcome.

## Delete one response

Open the response drawer and choose delete, or call the scoped Management API:

```bash
curl -X DELETE "https://fillo.so/api/v1/manage/responses/RESPONSE_ID" \
  -H "Authorization: Bearer $FILLO_KEY"
```

The key needs `responses:delete`. The operation is workspace-scoped and also removes that response's files from connected storage when provider cleanup succeeds.

Deleting a Fillo response can't retract a row, message, email, event, or copy an external destination already accepted. Those copies have to be deleted in the destination, under its own policy.

## Erase a person

From a respondent view:

- **Forget person** removes the workspace-level profile, drafts, and identity while leaving completed answers anonymous.
- **Delete person + responses** also deletes that person's responses and their connected files.

Both operations are workspace-wide because respondent identity is scoped to the workspace, not one form.

## Delete a workspace

Only an owner can schedule workspace deletion. The workspace stops accepting and serving data immediately, and the owner can cancel during the 21-day grace period. Permanent purge covers Fillo records and connected provider cleanup that Fillo can authorize.

<Callout variant="warning" title="Check connected storage first">
  Deleting provider-owned files safely requires provider access. Repair a revoked storage connection before destructive cleanup so the operation can prove what was removed.
</Callout>

## Plan status and responsibility

Export and deletion controls are available on every plan. Fillo supplies product controls, data-processing terms, and subprocessor information — but choosing a lawful retention schedule, and applying it to downstream systems, is still on your organization.

## Related

- [Management API](/docs/api): Automate scoped response reads and deletion from a server.
- [Uploads and storage](/docs/uploads): Understand provider ownership and file cleanup.
- [Build a GDPR consent form](/guides/build-a-gdpr-consent-form): Connect consent copy to a concrete data workflow.