> ## Documentation Index > Fetch the complete documentation index at: https://docs.attensira.com/llms.txt > Use this file to discover all available pages before exploring further. # Delete or export your data > Download everything stored for your account as one signed JSON file, delete the account and its data with a 7-day window to stop it, and erase one outreach contact. > [!WARNING] > > **Not on `api.attensira.com` yet.** Delete and export are live in the app (**Settings → Data**), and the hourly purge runs. For keys, `GET /v1/export`, `DELETE /v1/workspace`, `POST /v1/workspace/restore` and `POST /v1/suppressions/erase` are served on `webapp.attensira.com`: call them there with the same key. `api.attensira.com` does not serve them yet and answers `404`. Over MCP, every row in [From your assistant and the API](#from-your-assistant-and-the-api) is served today. **Settings → Data** has two buttons: **Download your data** and **Delete account**. Both cover the whole account: every workspace in it. Your assistant can download one workspace's data, but it can never delete the account or stop a deletion. Only a person can do that, in the app. ## Download your data **Download your data** saves one JSON file, `attensira-export-.json`, with everything stored for the account and every workspace in it: questions, readings, changes, threads, the Brand Book, settings, outreach threads and the rest. ```json theme={null} { "format": "attensira-export/1", "bundle": { "org_id": "…", "workspace_ids": ["…"], "scope": "account", "generated_at": "2026-10-27T12:00:00Z", "collections": { ".": [ { "_id": "…" } ] }, "withheld": [ { "collection": "api_keys", "reason": "…" } ] }, "signature": { "alg": "HMAC-SHA256", "value": "" } } ``` * **`collections`** holds every stored record of the account, one array per collection, in relaxed extended JSON (dates are `{"$date": "…"}`). * **`withheld`** lists the collections that are left out because they hold what lets a connection act: API key hashes, connection tokens, webhook signing keys. Each comes with the reason. * **Fields that are always removed**, from every record: credentials and tokens, and our own costs (any field about cost, margin, markup or agent-minutes). * **`signature`** is an HMAC-SHA256 of the `bundle` exactly as written, from its opening brace to its closing one, under a key only Attensira holds. It lets Attensira confirm that a file it produced has not been changed. A large account takes a while to prepare. If the download stops part way, the file has no `signature` at the end: download it again. ## Delete your account Click **Delete account**, then **Delete my account**. In an organization, only an admin can do this. Three things happen at once: 1. **Your plan is cancelled at the end of the paid period.** If no plan is running, there is nothing to cancel. If the plan cannot be cancelled right now, nothing else happens and the page says so: try again in a minute. 2. **All work stops.** Nothing runs and no credits are spent, as when work is [paused](https://docs.attensira.com/account/plans.md#pausing-resuming-and-cancelling). 3. **The data is deleted 7 days later.** The page shows the date. ### Stop a deletion Until that date, **Settings → Data** shows **Stop deletion** instead of **Delete account**. Stopping keeps the data and starts work again. The plan's cancel stands: choose a plan again under **Settings → Billing** to keep it. Once the date has passed, the data is gone and the deletion cannot be stopped. ### What is deleted Within an hour after the 7 days, the purge deletes every workspace and everything stored for it and for the account: * every stored record of the account and its workspaces; * the custom domain of a [hosted answer site](https://docs.attensira.com/account/hosted-answer-pages.md), released so it serves nothing; * the hosted browser's saved site sessions, if any; * cached copies of the account's data. A test in our build fails if a new store of account data is added without saying how it is deleted, or if a store whose rows are keyed by the account or workspace id is not deleted by that id, so nothing is left behind by accident. ### What is kept | What | Why | | - | - | | Credit and billing ledgers, monthly statements, contract terms | Accounting records, kept as tax law requires. They hold amounts and dates, not your content. | | Referral credits already granted | So one referral code cannot pay out twice. Ids and dates only. | | The [suppression list](https://docs.attensira.com/security/data-retention.md#the-suppression-list-keeps-no-addresses) | Only a one-way hash of each address, so an address that asked not to be written to is never written to again. | | That a domain already had its free first change | The domain and when, so deleting an account does not give the same domain a second change drafted before payment. | | The record that the account was deleted | Its id, who asked, when, and the workspace ids. No content. | Deleting the account does not delete your login. ### When your login or organization is deleted When your login is deleted, your personal account is deleted the same way: the plan is cancelled at the end of the period, work stops, and the data is deleted 7 days later. When an organization is deleted, the same happens to the organization's account. With the login or the organization gone, nobody can sign in to stop it. ## Erase one outreach contact A person your workspace wrote to can ask to be forgotten. Erasing their address deletes everything the workspace holds that names it: * the address on every draft that holds it; * the [outreach threads](https://docs.attensira.com/offsite/outreach-rules.md) to it; * the emails sent to it and received from it; * the record of why they were written to and where their address was found. One thing stays: a one-way hash of the address on the workspace's suppression list, so the agents never find and write to the same person again. From your assistant over MCP it is `act` on `attensira://{workspace}/contact_suppression` with action `erase` and `payload: {email}`, and over the API the same `act` through [`POST /v1/actions`](https://docs.attensira.com/api/endpoints#post-/v1/actions). Both need the `configure` scope. The direct route is `POST /v1/suppressions/erase` with `{"email": "…"}`, on `webapp.attensira.com`. ## From your assistant and the API | What | MCP | REST | Scope | | - | - | - | - | | Download one workspace's data | `get(attensira://{workspace}/export)` | `GET /v1/export` | `read` | | Delete the account | `configure` with `kind: "workspace"`, `op: "delete"` | `DELETE /v1/workspace` | — | | Stop a deletion | `configure` with `kind: "workspace"`, `op: "restore"` | `POST /v1/workspace/restore` | — | | Erase a contact | `act` on `attensira://{workspace}/contact_suppression`, action `erase` | `POST /v1/actions` with `erase`; `POST /v1/suppressions/erase` with `{"email": "…"}` | `configure` | * **The export over the API is one workspace**, `"scope": "workspace"`: its own records, without the account's. The download in the app is the whole account. * **Delete and restore are never done for a key or an assistant.** Every such call answers `403` with code `raise_human_only`, `details.outcome: "needs_human"` and `details.elicitation` holding the question to put to a person. Nothing changes. * **Erasing** answers `{"erasure": {"email_hash", "drafts", "threads", "messages", "lawful_basis_records", "suppressed"}}`: the hash that was kept and how many of each were deleted. The REST routes other than `POST /v1/actions` are served on `webapp.attensira.com` and not on `api.attensira.com` yet, where each answers `404` (see the note at the top of this page). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.