A message flow records what a customer answered, which steps ran and how each conversation ended. This page says what is kept, for how long, who can see it and how to remove it — the promise the platform makes, and the same numbers the nightly clean-up enforces.
What a flow keeps
| What | Kept for | Then |
|---|---|---|
| The step-by-step trace of a conversation (which step ran, which branch it took, when) | 30 days on the standard plan (7 on Free, 90 on Pro) | deleted |
| The variables a conversation stored — every answer the customer typed or tapped — and the wait it was parked on | 30 days after the conversation ended | emptied; the conversation row stays |
| The conversation record itself (when it started, what it ended on, the outcome) | 180 days after it ended | deleted |
| Saved test results in the Studio | 90 days | cleared |
| Published versions of a flow | the 50 most recent | older ones deleted — never the live one, never one a running conversation still uses |
| Per-step statistics (the funnel in Insights) | 2 years | deleted |
The messages themselves — what the customer sent and what the flow replied — live in the inbox and follow the inbox's retention. A file a customer sent to an Ask for a file step is kept with the message; the link the flow stores for it works for 30 days.
Different numbers can be agreed per workspace.
Who can see what
- Answers are never shown on a list. The runs list shows outcomes, steps and timings only.
- Opening one conversation's trace shows the variables redacted: anything that looks like a token, password, one-time code, PIN, ID or passport number, card number, phone, email or address is masked. Reading them in clear needs a separate permission (
flows.sessions.pii) that owners and managers hold, agents and viewers do not, and every such read is logged. - Variables and the parked wait are encrypted at rest.
- Assistants connected over MCP see the same masked view and cannot be granted the raw one.
- Reports a flow sends to a customer (Send report) are rendered with every sensitive column masked, and the download link expires.
Removing a person's data
Ask us for a right-to-erasure request for a phone number: every flow conversation of that person in your workspace is deleted, or exported first for a subject-access request. Consents recorded by a Consent step — the wording and the moment — can be exported as a CSV at any time.
What we do not keep
- A simulation in the Studio runs inside a transaction that is rolled back: no conversation, message, variable or charge survives it.
- Credentials never live in a flow. API keys and signing keys go in Flow secrets; a definition, a version, a diff and an assistant's view all show
{{secret.name}}, never the value.
Where next
- Message flows — the Runs tab of any flow shows what is currently kept.
- Why did my flow stop? — reading the outcome of a conversation.
- Manage team roles and workspace access — who holds which permission.