> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usecrew.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Data Handling & Retention

> How Crew processes, stores, and retains your data

# Data Handling & Retention

This page describes how Crew handles data throughout its lifecycle—from collection to deletion. Understanding data handling is essential for compliance and privacy planning.

## Data Categories

### Customer Data

Data you provide directly:

| Data Type           | Examples                 | Storage            |
| ------------------- | ------------------------ | ------------------ |
| Account information | Email, name, company     | Encrypted database |
| Configuration       | Agent settings, pathways | Encrypted database |
| Knowledge base      | FAQs, documents          | Encrypted database |
| Integrations        | API keys, credentials    | Encrypted with HSM |

### End-User Data

Data from people interacting with your agents:

| Data Type             | Examples                  | Storage                  |
| --------------------- | ------------------------- | ------------------------ |
| Phone numbers         | Caller ID                 | Encrypted database       |
| Names                 | If collected              | Encrypted database       |
| Conversation data     | Transcripts               | Encrypted database       |
| Recordings            | Call audio                | Encrypted object storage |
| Collected information | Appointments, preferences | Encrypted database       |

### System Data

Data generated by Crew:

| Data Type    | Examples            | Storage               |
| ------------ | ------------------- | --------------------- |
| Logs         | API calls, events   | Log management system |
| Analytics    | Call metrics, usage | Analytics database    |
| Audit trails | Access logs         | Secure audit storage  |

## Data Processing

### Conversation Processing

```
Audio Input → Speech-to-Text → AI Processing → Response Generation → Text-to-Speech
     ↓              ↓                ↓                  ↓
  Encrypted    Transcript      Intent/Entities      Response Text
  Transit      (Optional)        (Metadata)         (Temporary)
```

### AI Processing

* Conversations processed by OpenAI for AI capabilities
* Audio converted to text for processing
* No persistent storage in AI systems beyond request/response
* See OpenAI's data processing terms for details

### Telephony Processing

* Twilio/RingCentral handle call routing
* Media streams processed through their infrastructure
* Subject to their respective security practices
* Recordings stored in Crew infrastructure (if enabled)

## Data Storage

### Geographic Location

| Plan         | Default Region | Options        |
| ------------ | -------------- | -------------- |
| Starter      | US (Virginia)  | —              |
| Professional | US (Virginia)  | EU available   |
| Enterprise   | US (Virginia)  | Custom regions |

### Storage Architecture

```
Primary Database (Encrypted)
    ├── Account data
    ├── Configuration
    ├── Call metadata
    └── Transcripts

Object Storage (Encrypted)
    ├── Recordings
    ├── Documents
    └── Exports

Backup Storage (Encrypted)
    └── Point-in-time backups
```

### Encryption Details

| Layer           | Method        |
| --------------- | ------------- |
| Database fields | AES-256-GCM   |
| Object storage  | AES-256-GCM   |
| Backups         | AES-256-GCM   |
| Key management  | AWS KMS / HSM |

## Data Retention

### Default Retention Periods

| Data Type     | Default Retention | Configurable |
| ------------- | ----------------- | ------------ |
| Call metadata | 12 months         | ✓            |
| Transcripts   | 90 days           | ✓            |
| Recordings    | 30 days           | ✓            |
| Analytics     | 24 months         | ✓            |
| Audit logs    | 12 months         | Enterprise   |
| Account data  | Until deletion    | —            |

### Configuring Retention

Adjust retention in workspace settings:

```json theme={null}
{
  "retention": {
    "transcripts_days": 90,
    "recordings_days": 30,
    "call_metadata_days": 365,
    "analytics_days": 730
  }
}
```

### Automatic Deletion

* Data is automatically deleted after retention period
* Deletion is permanent and irreversible
* Backups follow separate retention (30 days after deletion)

## Data Minimization

### Collection Principles

We follow data minimization practices:

* **Collect only what's needed** for the service
* **Purpose limitation** — data used only for stated purposes
* **Storage limitation** — deleted when no longer needed

### Optional Data

Configure what's collected:

```json theme={null}
{
  "data_collection": {
    "store_transcripts": true,
    "store_recordings": false,
    "collect_caller_names": true,
    "store_full_audio": false
  }
}
```

### PII Handling

```json theme={null}
{
  "pii_handling": {
    "redact_from_transcripts": true,
    "redact_patterns": ["ssn", "credit_card"],
    "anonymize_after_days": 30
  }
}
```

## Data Access

### Customer Access

You can access your data via:

* **Dashboard** — View calls, transcripts, analytics
* **API** — Programmatic access to all data
* **Export** — Bulk export functionality

### Export Formats

```bash theme={null}
curl -X POST https://api.usecrew.ai/v1/exports \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{
    "type": "calls",
    "date_range": {
      "start": "2024-01-01",
      "end": "2024-01-31"
    },
    "format": "json"
  }'
```

Supported formats: JSON, CSV

### Crew Staff Access

* Access requires business justification
* All access is logged and audited
* Access limited to support and operations roles
* Regular access reviews conducted

## Data Deletion

### User-Initiated Deletion

Delete specific data:

```bash theme={null}
# Delete a call record
curl -X DELETE https://api.usecrew.ai/v1/calls/{call_id} \
  -H "Authorization: Bearer YOUR_API_KEY"

# Delete caller memory
curl -X DELETE https://api.usecrew.ai/v1/memory?caller_id=+14155551234 \
  -H "Authorization: Bearer YOUR_API_KEY"
```

### Account Deletion

Request complete account deletion:

1. Contact [support@usecrew.ai](mailto:support@usecrew.ai)
2. Verify account ownership
3. Data deleted within 30 days
4. Confirmation email sent

### Right to Erasure (GDPR)

For end-user erasure requests:

```bash theme={null}
curl -X POST https://api.usecrew.ai/v1/data-requests \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{
    "type": "erasure",
    "identifier": "+14155551234",
    "identifier_type": "phone"
  }'
```

## Data Portability

Export all data in standard formats:

```bash theme={null}
curl -X POST https://api.usecrew.ai/v1/exports/full \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{
    "format": "json",
    "include": ["calls", "transcripts", "recordings", "knowledge_base", "configuration"]
  }'
```

You'll receive a downloadable archive with all your data.

## Third-Party Data Sharing

### Service Providers

Data is shared with service providers as necessary:

| Provider | Purpose             | Data Shared                  |
| -------- | ------------------- | ---------------------------- |
| Twilio   | Telephony           | Phone numbers, call metadata |
| OpenAI   | AI processing       | Conversation text            |
| Supabase | Database            | All stored data (encrypted)  |
| Vercel   | Application hosting | Application data             |

### No Data Selling

We do not sell customer data or end-user data to third parties.

### Law Enforcement

We respond to valid legal requests (subpoenas, court orders) following our law enforcement guidelines. Customers are notified unless legally prohibited.

## Backup and Recovery

### Backup Schedule

| Type            | Frequency  | Retention |
| --------------- | ---------- | --------- |
| Full backup     | Daily      | 30 days   |
| Incremental     | Hourly     | 7 days    |
| Transaction log | Continuous | 7 days    |

### Recovery

* **Point-in-time recovery** available
* **RTO**: 4 hours (Enterprise: 1 hour)
* **RPO**: 1 hour

## Audit and Compliance

### Audit Logs

All data access is logged:

```json theme={null}
{
  "timestamp": "2024-01-15T10:30:00Z",
  "actor": "user@company.com",
  "action": "read",
  "resource": "call_abc123",
  "ip_address": "203.0.113.10"
}
```

Access logs via API:

```bash theme={null}
curl https://api.usecrew.ai/v1/audit-logs \
  -H "Authorization: Bearer YOUR_API_KEY"
```

### Compliance Reports

Enterprise customers can request:

* SOC 2 report
* Data processing records
* Security questionnaire responses

## Next Steps

* [Security Overview](/security/overview) — Security architecture
* [Healthcare Readiness](/security/healthcare-readiness) — Healthcare considerations
* [Customer Responsibilities](/security/customer-responsibilities) — Your obligations