Privacy and erasure
Who can see CRM data
Contacts hold personal data: names, phone numbers, emails, what people wrote to you. So:
- Members of your organization can read and write the CRM, through the API, an SDK, an AI assistant or a composition.
- Converting a lead and erasing a contact need an organization owner or admin.
- Your app's end users never can. Every CRM workflow refuses a run made with an end-user token, even when the data is about that same person.
- One app at a time. Every call names one Identity app, and contacts of one app are never returned for another.
Record an opt-out
When someone asks you to stop contacting them, set opted_out: true with crm.contact.update. Orkestia stamps opted_out_at. opted_out: false clears it if they opt back in.
The opt-out shows up wherever the contact does: opted_out on contact rows and on the result of crm.lead.capture. Check it before your own code sends a message to the contact.
Erase a person's data
crm.contact.erase handles a request to erase someone's data (for example under LGPD). It needs an organization owner or admin and cannot be undone.
curl -sS -X POST https://workflow-api.orkestia.dev/api/workflows/start \
-H "Authorization: Bearer $ORKESTIA_TOKEN" -H "Content-Type: application/json" \
-d '{
"workflow_type": "crm.contact.erase",
"initial_data": { "identity_app_uuid": "…", "contact_uuid": "…" }
}'
It anonymizes instead of deleting rows, so your counts and funnel reports stay true:
| What | After erasure |
|---|---|
| Contact | Name becomes "Erased contact". Phone, email, WhatsApp id, attribution, tags and attributes are emptied. The contact is marked erased and opted out |
| Timeline | Every entry loses its text, external id and extra data. The kind, channel and time stay |
| Leads | Free text (lost_reason) and lead attributes are removed. Every open lead is closed as lost with reason erased, so the person leaves your pipelines |
The result reports activities_erased, leads_scrubbed, leads_closed and erased_at. Running it again on an erased contact succeeds with leads_closed: 0.
An erased contact cannot be edited and gets no new timeline entries. If the same person writes to you again later, their phone no longer matches anything, so capture creates a new contact.