Spicelab respects your right to request deletion of personal data we hold, in compliance with Republic of Indonesia Law Number 27 of 2022 on Personal Data Protection (PDP Law), GDPR Article 17 (“Right to be Forgotten”), and Meta Platform Terms.

This page explains 3 ways to request deletion of your data: (1) self-service in dashboard, (2) via email, (3) via Meta Platform automatic callback.

Option 1 — Self-Service via Dashboard (Fastest)

Log in to app.spicelab.ai.
Open Settings → Account → Delete Account.
Confirm by typing DELETE PERMANENTLY and click the confirmation button.
You will receive a confirmation email with a verification link (valid 24 hours).
Click the verification link — deletion is scheduled in 30 days (grace period for cancellation).
Within 30 days you may re-login to cancel the request. After 30 days, data is permanently deleted.

Note: before deleting your account, we recommend exporting your data to CSV/JSON via Settings → Export Data.

Option 2 — Manual Request via Email

If you cannot access the dashboard (e.g. suspended account, forgotten password that cannot be reset), send an email to privacy@spicelab.ai with subject “Data Deletion Request — [Your Business Name]” and include:

Full name of the account owner.
Email registered at Spicelab.
WhatsApp number registered (for verification).
Business / brand name registered.
Brief reason (optional, for our feedback).
Confirmation: “I request permanent deletion of all my data at Spicelab.”

We will verify identity within 3 business days (via WA callback to the registered number) and execute deletion within 30 calendar days max per PDP Law Article 16 paragraph (2).

Option 3 — Revoking Meta Platform Permissions

If you connected Spicelab via Login with Facebook, Instagram Graph, or WhatsApp Business API, you may revoke permission directly from Meta settings. Revocation automatically triggers a callback to our server to delete the token and related data.

How to revoke:

Facebook: facebook.com/settings → Business Integrations → find “Spicelab” → Remove.
Instagram: instagram.com/accounts/manage_access → find “Spicelab” → Remove.
WhatsApp Business / Meta Business Manager: Meta Business Manager → System Users → Remove Spicelab assignment.

After revocation, Meta sends a signed callback to our endpoint https://spicelab.ai/api/meta/data-deletion. We will:

Validate the signed-request from Meta (HMAC SHA-256 with App Secret).
Generate a unique confirmation code for request tracking.
Schedule deletion within a 30-day grace period.
Return the status URL & confirmation code to Meta so the user can check progress at Facebook Help Center.

Check Deletion Request Status

After submitting a request via any option, you will receive a confirmation code in the format SPL-DEL-XXXXXXXX. Check status anytime at:

Email privacy@spicelab.ai with subject “Status: [confirmation code]” — we will reply with progress update within 2 business days.

Data That Will Be Deleted

Account profile, email, WhatsApp number, business name.
Brand voice configuration, content asset library, previously generated PDF reports.
AI Consultant conversation history.
Meta, IG, WhatsApp Business API tokens.
Customer DM/comment history auto-replied by AI.
Cookies, analytics logs tied to your identity.
Encrypted backups (max 30 days after main deletion).

Data That Cannot Be Deleted (Legal Exceptions)

Per PDP Law Article 16 paragraph (4) and other legal obligations, the following data must be retained even if a deletion request is made:

Invoice & tax data: 10 years (Tax Law Article 28).
Security audit logs: 12 months (for forensic & compliance).
Data needed for active legal claims: until the dispute is resolved.
Aggregated and anonymized data (no longer identifies you) may continue to be retained for analytics.

Execution SLA

Acknowledgment: max 3 business days after request received.
Identity verification: 7 business days (via email + WA callback).
Deletion execution: max 30 calendar days (PDP Law Article 16).
Backup deletion: 60 calendar days after main deletion.

Escalation & Complaints

If your request is not addressed within SLA or you are unsatisfied with our response, you may:

Contact the Data Protection Officer: dpo@spicelab.ai.
File a complaint with the Ministry of Communication and Informatics of the Republic of Indonesia (Kominfo) or the competent data protection authority.
For EU/EEA users: file a complaint with the Data Protection Authority of your country.

Contact

Privacy: privacy@spicelab.ai
DPO: dpo@spicelab.ai
WhatsApp: +62 811-1095-42
Address: Jl Cikini Raya FG 6 No 2, Tangerang Selatan 15227, Indonesia

User Data Deletion