Mesara

Legal

Data deletion

You can ask us to delete your Mesara account and the personal data we hold for you at any time. This page explains how to request it, what is removed, what we may keep for legal reasons, and how long it takes. It works alongside our Privacy Policy.

Last updatedAugust 2026
Contents6 clauses
  1. 01

    How to request deletion

    Choose whichever of these is easier for you.

    Option 1: email us

    Email hello@mesara.lk from the address on your account, with the subject "Data deletion request". Include your business name and the WhatsApp Business number or WABA you want removed so we can verify the request.

    Option 2: close your account

    Sign in and open your account settings, then choose to close your account. Closing your account starts the same deletion process described below.

  2. 02

    What we delete

    Once we verify your request, we remove the personal data we hold for you, including:

    • Your account details and the profiles of team members you invited.
    • Your business and WhatsApp Business Account details and stored verification documents.
    • Message content, media, contacts and templates that we process on your behalf.
    • Stored access tokens and the connection between Mesara and your number.

    All of that is removed from our live systems within 30 days of your account closing, or within 30 days of us verifying your deletion request, whichever comes first.

Section 03

How long we keep each thing

These are the periods we run to. They apply whether you close the account yourself or ask us to delete it.

What we holdHow long
Message content and conversation historyDeleted within 30 days of account closure
Contact records, including phone numbers and consent stateDeleted within 30 days of account closure
Account, team, business and WhatsApp Business Account detailsDeleted within 30 days of account closure
Billing records, invoices and payment referencesKept for 6 years, required by law
Audit and security logsKept for 12 months
BackupsPurged on a rolling 35 day cycle
  1. 04

    What we may keep, and why

    A small amount of information outlives a deletion request, either because the law requires it or because we need it to run the service safely:

    Billing records, invoices and payment references, for six years.

    Sri Lankan tax and company law require us to keep accounting records for that long. This is a legal obligation and it overrides a deletion request, so we cannot delete these records early, even if you ask us to. They hold the payment reference, the amount and the date. They do not hold your message content or your contacts.

    Audit and security logs, for 12 months.

    These record actions taken on an account, such as sign-ins and changes to sending settings. We keep them so we can investigate abuse, fraud and security incidents, and so we can show what happened if a dispute arises.

    Minimal records to resolve an open dispute or enforce our terms.

    Kept only until the matter is closed, then deleted.

  2. 05

    Backups

    Deleting data from the live service does not reach into backups straight away, and we would rather say so than pretend otherwise. We keep backups on a rolling 35 day cycle, so data that has been deleted can still exist in a backup for up to 35 days after deletion. Those backups are held for recovery only, they are not used to serve the product, and when the cycle turns over the deleted data goes with it.

  3. 06

    How long it takes

    We acknowledge a deletion request within one business day of receiving it, and we complete it within 30 days, unless the law requires us to keep certain records for longer as described above. We confirm by email once your data has been deleted.

    If you have any questions about the process, email us at hello@mesara.lk.

  • Deleted from live systems
  • Backups purged
Day 0Day 30
Day 35