Data removal

1. What happens when you submit

1. Identity verification. Signed-in users use their active session. Signed-out users verify the account email with a one-time code.
2. Request receipt. We create a unique reference and queue the selected cleanup actions. Signed-out request-status credentials are sent in a protected header rather than placed in the URL.
3. Background cleanup. The system removes the selected account records, workflow history, stored files, search-index entries, and/or connection credentials associated with the verified user.
4. Result tracking. The page polls for completion. If a subsystem reports an exception, the request is marked completed with exceptions so it can be investigated instead of appearing fully complete.

2. Removal scope

3. Disconnect here and revoke at the provider

Deleting a stored credential prevents future Hive Citadel use of that credential. For defense in depth, also revoke Hive Citadel in the provider’s security or connected-app settings. Provider revocation immediately changes the provider-side authorization boundary and is especially important if a request is still processing.

Removing Hive Citadel data does not delete content held by Google, Microsoft, GitHub, YouTube, or another provider. Delete provider-held content using that provider’s product or an authorized tool that supports deletion.

4. Limited retention and backups

Deletion is subject to applicable law and legitimate preservation needs. We may retain a minimal deletion-request record, security and fraud evidence, billing/accounting records, records subject to legal hold, and information needed to establish or defend legal claims. These records are access-restricted and are not retained for ordinary product use.

Residual copies may remain in protected backups until normal rotation. They are not restored to active use except for disaster recovery, and deletion controls are reapplied where appropriate.

5. Organization-managed data

If your account belongs to an organization, some workspace data may be controlled by that organization. A personal request removes data within the verified user’s deletion scope; it may not authorize deletion of records the organization owns or must retain. Contact your workspace administrator for organization-level deletion.

6. Manual escalation

If the form is unavailable, a request shows completed with exceptions, or you cannot access the account email, contact support@hivecitadel.com with “Data Removal Request” and any request reference. Do not send passwords, access tokens, or one-time codes.