Privacy and data deletion

daoco keeps two kinds of records about a workspace: the content you create (brand context, drafts, posts, assets, chat transcripts) and the agent’s own working record (which runtime handled a request, which tools ran, how the run ended, how you rated it). Both are yours. This page covers the controls over each.

​

Help improve daoco

Open Settings, then the Teams tab. The Privacy card holds one switch, Help improve daoco. Only a workspace owner or admin on the Growth plan can see the Teams tab, so this switch is a Growth control. On Starter it stays at its default of on. The switch sets the starting point for each deletion form, not the outcome. You choose again at the moment you delete. Errors are still recorded either way so support can help you. With the switch off they carry no content, only the error class, the runtime it happened in, and timing. This switch has no effect on how model requests are routed. That is unconditional: OpenRouter requests always require a zero-data-retention endpoint and always deny routing to providers that may collect request data.

​

Delete a brand

Only the brand’s owner sees this control. A workspace admin who does not own the brand cannot delete it.

1. Open Settings, then Brands, and pick the brand.
2. Under Delete brand, type the brand’s exact name. Capitalization must match.
3. Under After deletion, choose Delete all agent data or Help improve daoco. The preselected option follows the workspace’s Help improve daoco setting.
4. Confirm.

daoco records a deletion receipt and removes the brand’s content, assets, connected-account records, active storage, and search indexes in the background. Access to the brand is blocked from the moment you confirm. While cleanup runs, the brand stays in the Brands list as a disabled row marked Deleting and drops out of navigation, defaults, and your brand count right away. Deleting a brand never touches the workspace’s billing account. If you choose Help improve daoco, daoco keeps two things under a random key that is not linked to the brand, the workspace, or a person:

• How the agent worked. The working record is rewritten with every approval title, note, and artifact reference cleared. What remains is the shape of the work: runtimes, tool order, outcomes, and ratings.
• A redacted copy of the conversation. Before the thread is deleted, daoco takes a copy of its messages and runs a redaction pass over the text. The pass strips the brand and product names, the names and emails of everyone on the workspace, connected-account handles, and anything that looks like an email, link, @handle, phone number, IP address, long number, or credential. Tool inputs and outputs are dropped; only tool names are kept. If a thread cannot be read and redacted, it is deleted without a copy.

Redaction is deterministic and versioned. Each retained record says which rules produced it, and the receipt reports how many conversations were kept. A very long thread is copied up to its first 2,000 messages. A brand that is the only brand in the workspace cannot be deleted from the dashboard. Create another brand first, or use workspace deletion below.

​

Switching from Growth to Starter

Starter holds two brands. If your workspace has more, the downgrade dialog asks you to pick the brand to keep and then permanently deletes the brands above the Starter limit. That deletion always keeps the anonymized agent data described above. It does not offer the After deletion choice, and the workspace’s Help improve daoco setting does not change it. Delete a brand yourself first if you want the other outcome.

​

Delete a workspace or your account

Go to daoco.org/data-deletion while signed in.

• Workspace: the owner types the workspace’s exact name, with no extra spaces and matching capitalization. Only an owner can do this; an admin cannot. daoco deletes every brand in it, then the workspace’s assistant configuration, channels, memories, memberships, billing customer, and WorkOS organization.
• Account: type your email address. daoco deletes your memberships and personal preferences, your WorkOS login, and your product-analytics profile (if the analytics provider’s deletion API is unavailable, the receipt lists it as an exception and daoco completes it by hand). Workspaces owned by someone else keep their content. If you own any workspace, you must tick Also permanently delete my owned workspaces to continue; you cannot delete your account and leave a workspace you own behind.

Both forms carry a Keep anonymized agent data checkbox that does the same thing as the brand choice. On the account form it appears only after you tick the owned-workspaces box, and it starts ticked only when every workspace you own has Help improve daoco on. If a deletion fails and you start it again, retype the confirmation. A request that is still running keeps the anonymized-data choice you confirmed the first time; only a failed request takes a new one.

​

Reading the receipt

Workspace and account deletions show a receipt with the current stage, rows deleted, rows anonymized, conversations kept, and any retained-data exceptions. Exceptions name records daoco cannot erase immediately: provider backups that age out on their own schedule, billing and security records kept where required by law, and third-party cleanups that need a retry. The receipt is the record of what daoco did, not a claim that every third party has already purged its copy. Because deleting your account ends your session, the account receipt stays readable from the same browser for 7 days. Brand deletion does not have a receipt page; it confirms with a short receipt id when the deletion starts. Keep that id if you need to ask us about it.