Deleting Your Account

You can delete your NeuraLIA Labs account, and the data that belongs to it, yourself — from inside the app, without asking anyone and without giving a reason. There may be one or two things to do first, and the sections below explain them: end any subscription you still have and, if you own an organization with more members, transfer its ownership. This page is public on purpose: you can read it, and ask for the deletion by email, without installing anything.

How to Delete It From the App

The steps are the same on the web, on iOS and on Android:

1. Open Account.
2. Go to Settings.
3. Scroll down to Danger zone and choose Delete account.
4. Confirm. We ask you to have signed in recently, to type your own account email, and — on the mobile apps — to confirm with your device biometrics. If any organization of yours is going to be deleted with you, we also ask you to confirm that.

The deletion starts immediately and cannot be undone.

End your subscription first. While a subscription is still running — active, in a trial, or with a payment pending — the deletion is refused: the app tells you so and nothing is deleted. That is true however you pay, by card on the website or through the App Store or Google Play.

Cancelling is not immediate. Your plan stays active until the end of the period you have already paid for, and until that period ends the account still cannot be deleted; on a yearly plan that can be months. Once the subscription is no longer running, the deletion works. A subscription billed by the App Store or by Google Play is cancelled from your account in that store and not from here: the Danger zone tells you which of the two you have and where to go.

If you own an organization with other members, transfer its ownership first. An organization cannot be left without anyone to manage it. While you are the owner of an organization with other active members, the deletion is refused: the app tells you which ones and nothing is deleted. Transfer the ownership of each one to another member and try again.

Your organizations with no one else are deleted with you, 30 days later. If you are the owner of an organization in which there is no one else active, or of an archived organization, the app shows you which ones before going on, and offers to export their data. Once you confirm, your account is deleted at once, but those organizations are not: they are kept archived for 30 days, with no one able to open them and nothing in them running. At the end we give you a link for each one, on the final screen and by email, with which, during those 30 days, you can request and download its export without an account. Keep it safe: no one else can do it, and we cannot recover it, because we keep nothing that identifies you. After the 30 days, they are deleted with everything in them. From the other organizations you simply leave.

How to Ask For It By Email

If you cannot get into the app — you have lost access to your sign-in, or the device is gone — write to support@neuralialabs.com from the email address of the account, with "Delete my account" as the subject. We answer within 30 days, and normally within a few working days. The same conditions apply by email: an account with a subscription still running, or that owns an organization with other active members, cannot be deleted until the subscription ends or the ownership is transferred, and before deleting it we will tell you which organizations would be deleted with you. Because the deletion cannot be reversed, we may first ask you for something that shows the address is yours.

What Gets Deleted

Everything that is yours is destroyed, not merely hidden or deactivated:

• Your conversations, including every message inside them, the files and images attached to them, and the runs of any agent that took part.
• Your files and everything you generated: documents, images, video and audio, whether you uploaded them or the service created them for you. Both what the service wrote for you and what you uploaded from your own device.
• Your knowledge base: folders, documents, the indexed fragments and the vectors built from them.
• Your agents, automations and plans: agents, tasks, scheduled runs, batches and their execution history, including the agents' memories.
• Your library: prompt templates, chatbots, API connectors, MCP servers, image styles (LoRAs), voices and code workspaces.
• What you published: sites and pages generated from the service, use cases, content projects and renders.
• Your connected channels and integrations: WhatsApp, Telegram, Instagram and the rest, together with the third-party access tokens the service was holding on your behalf. Deleting the account revokes our side of those connections.
• Your account itself: your profile, your preferences, your sign-in credentials and your API keys.
• Your chats in an organization's space: they are private and yours, and are deleted like the rest.
• Your organizations with no one else active and your archived organizations, if you confirmed it, with everything in them, 30 days after you delete your account.

What belongs to an organization stays in it. What you created for an organization — agents, chatbots, channels, scheduled tasks, knowledge and accounts connected for it — was never yours: it remains the organization's, and what you were responsible for passes to its owner. What you wrote or uploaded in its Work and your entries in its audit log stay without your name, as the next section explains.

If the same deletion cannot reach some of that in one pass — an external system is down at that moment — the account is deleted anyway and what is left is recorded so we can finish the job. Your right to leave does not wait on our plumbing.

What We Keep, and Why

These things survive, each for a reason we can point to. Beyond what each one says, everything else is deleted.

• Your invoices and payment records. Kept because we are legally obliged to: an issued invoice cannot be destroyed on the customer's request (tax and accounting law; Article 17(3)(b) GDPR, compliance with a legal obligation), and the law sets how long, at least six years (Article 30 of the Spanish Commercial Code). They hold what was charged and when, not what you did with the service.
• A one-way hash of your email address, if you claimed the welcome credits. Kept to prevent fraud (legitimate interest, Article 6(1)(f) GDPR): without it, deleting and re-registering would hand out the free credits again and again. It is a SHA-256 hash plus two timestamps; your email cannot be recovered from it.
• A record that the deletion happened. Kept as proof of it — the app stores require it, and so does the accountability principle (Article 5(2) GDPR). Once the deletion has fully finished, it only holds dates and counts of what was deleted, not your email and not your content. While something is still left to finish, it also keeps your account's internal identifier and what is missing, only so that we can complete it.
• Messages you left in conversations of other people and of organizations are anonymised rather than destroyed, because those conversations also belong to the people still in them or to the organization (legitimate interest, Article 6(1)(f) GDPR). They stay as you wrote them, signed by "A deleted account" and without your email or your photo, and you stop being a member of those conversations. The same goes for what you wrote in an organization's support inboxes. What each message cost stays, because it is what the organization adds up from its usage, but without saying who paid for it or who asked for it. Of an agent run you started in one of those conversations, an internal identifier that is shown to no one remains; if it was still running when you deleted your account, it keeps who started it. In the conversation of a Work task's agent, you stop being among those who launched it, who are the ones who can read it.
• Records of costs we absorb without charging you, if there are any, are summarised into anonymous totals and deleted. Some things we pay a provider for and charge no one; for example, a phone call rejected for lack of balance, a generation that fails because of an error on our side, or an image-style training or a video that fails or is cancelled. We record them to keep track of those costs, and losing their totals would stop our accounts from adding up (legitimate interest, Article 6(1)(f) GDPR). No individual entry is kept: entries are added up into totals per month, reason, provider, model and the service that recorded them (how many, the usage and the cost). Of the moment, only the month remains, and those totals carry no identifier of yours or of your calls.
• A mark of an organization's free trial, if you started it as its owner. The trial is one per organization and one per owner: without this mark, deleting the organization or the account and starting again would give the trial again (fraud prevention, legitimate interest, Article 6(1)(f) GDPR). It is a hash of the organization's identifier, or of yours, with the date the trial started: neither the organization nor your account can be recovered from it.
• Your entries in the audit log of the organizations you belonged to, with nothing that identifies you. Each organization keeps a log of the changes made in it (who changed what, when and from which IP address), which only its owner and administrators can see. The entries you appear in stay, because they are the organization's history and not only yours, but in your place it says "A deleted account", and the name or email and the IP address they kept about you are deleted. Each entry is deleted automatically a year after the change (legitimate interest of the organization, Article 6(1)(f) GDPR).
• What you wrote or uploaded in an organization's Work: tasks and projects, comments and updates, links and files, milestones, the views you shared and the history of changes. It belongs to the organization and to the people who work in it, and deleting it would break their work (legitimate interest of the organization, Article 6(1)(f) GDPR). It stays as it was written and uploaded, signed by "A deleted account" and without the chat you wrote it from: you are no longer assigned to tasks, following them, or a member or lead of projects or milestones, and what an automation of the organization did on your behalf no longer says for whom. Because the text is not changed, it may still name you if someone named you in it, for example in a mention. Your saved views that you did not share, and the weekly close drafts that were waiting for you, are deleted.
• What the agents you launched did on an organization's tasks: each time you launched an agent on a task (by giving it the task, mentioning it or trying again) or stopped its work, the agent, the task, how it ended and why, what it spent and the dates stay. It is the organization's record of what its agents did and what they spent, which each task shows (legitimate interest, Article 6(1)(f) GDPR). It stays without saying who launched it or who stopped it, and it is deleted on its own one year after it ended. While an agent waits for an approval, a summary of what it asks is kept too, with secrets hidden, until someone answers or its work ends; and what it proposes, until someone applies or discards it, or 14 days.
• Other people's bell notices that tell what you did in an organization: in Work, a change of access, a departure or a change of who is responsible. They are the inbox of whoever received them, and taking them away would take away what happened to that person (legitimate interest, Article 6(1)(f) GDPR). They stay with "A deleted account" where your name was, without your email; if they quote an excerpt of a comment or update of yours, up to 140 characters, it stays as you wrote it. They are deleted automatically after 90 days, like every notice in the bell.
• What you shared or created in other people's organizations: the resources you shared, the company tasks you created and, in a company email channel, your consent to unlimited replies and the recoveries you ran. It belongs to the organization (legitimate interest, Article 6(1)(f) GDPR). It stays in it without saying who shared, created, consented to or recovered it (a task's signature says "A deleted account", without email or photo), and what you were responsible for passes to whoever is its owner. Your membership record, your invitations, your permissions and your departures are deleted.
• What you uploaded to an organization's knowledge: folders, documents and files, the image you set on one of its folders, and the indexed fragments made from them. The organization uses it in its chats and its channels (legitimate interest, Article 6(1)(f) GDPR), and it is deleted with the folder or with the organization. It is kept under the internal identifier it was uploaded with, also in what is crawled from a website for that folder, which leads to no profile except the billing records the law obliges us to keep; who uploaded it becomes "A deleted account".
• Website crawls you launched in an organization's knowledge: the organization keeps watching its knowledge with them and keeps their record (legitimate interest, Article 6(1)(f) GDPR). The website being crawled passes to whoever owns the folder — the organization itself, which crawls it without charging anyone, or the person the folder went back to — and its finished crawls say "A deleted account"; one still running stops on its own and, when it ends, says the same. The trust you gave to the read-only hints of a company tool server (MCP) no longer names you either. Neither your name nor your email.
• What you spent in an organization's space: the organization's usage by day and by month (by use, model and team), what was spent in its pool's period or your seat's, the seat you held, and what the state of its plan says. It is the organization's account and goes with it (legitimate interest, Article 6(1)(f) GDPR). Your share is added to "A deleted account" and your identifier leaves the list of who appears: the totals stay, and they don't say whose. Your share of what was spent in its pool's period or your seat's leaves (the total stays); the seat you still held becomes free, with its credits, for the organization, and from the state of its plan go your credit limit, your request for more credits and your identifier. Neither your name nor your email.
• Content reports you made, or that concern something you wrote. A report and how it was resolved must stay reviewable even if the person who reported or the person reported leaves (moderation and abuse prevention; legitimate interest, Article 6(1)(f) GDPR). They stay as they were made: the internal identifier of the reporter's account and that of the account that wrote what was reported, what was reported, why, and what the reporter wrote.
• The record of something of yours that you moved to an organization, for example a channel or an automation: whose it was, where it went and how it was, so that the organization can know it and undo it (legitimate interest of the organization). It says "A deleted account" instead of your name, and your own "drafts only" locks of an email channel are deleted. Only your account's internal identifier stays, inside the keys of the links and conversations of an email channel you moved to the company, which are shown to no one: rebuilding them would break that channel.
• The connection of an integration you connected for an organization. It belongs to the organization, which needs it to keep working until it disconnects it (legitimate interest, Article 6(1)(f) GDPR). It keeps the name of the external account you connected (for example, your email address in that service) and what the provider answered when it was connected, but not your account's identifier.
• Two technical records: the ticket of each voice call (the channel, its owner, who pays for the call, the calling number and what it will answer), which only serves to open the call and is deleted after 2 minutes or, if nobody uses it, within the day; and each failed delivery of a webhook of an organization's chat (the webhook's address, the chat and the text that was not delivered), which belongs to the organization to review the failure and is deleted on its own after 30 or 90 days (legitimate interest, Article 6(1)(f) GDPR). Those of your own chats are deleted with your account. Neither your name nor your email.
• Exports already prepared of an organization you belonged to. They are a copy the organization asked for of its own data: a snapshot of the day it was prepared, with what it then said about you (your name, your email and what you wrote). They are not rewritten when you delete your account: each one is deleted automatically 7 days after it was prepared.
• Your organizations that are deleted with you, for 30 days. If you were the owner of an organization in which no one else was active, or of an archived one, it is not deleted at once: it is kept archived for 30 days, with no one able to open it and nothing in it running, so that you can take its data with the link we gave you when you deleted your account, as the EU Data Act provides (Regulation (EU) 2023/2854, Article 25). What you wrote or did in it stops naming you from the first day, as in any other organization. After the 30 days, it is deleted entirely.

One thing is outside our reach: anything already handed to a third party before you deleted the account — for example, images you sent for training an image style, which are processed by an external provider. Their retention is governed by that provider, not by us.

Your Other Rights

Deletion is not your only right. You can also ask us for a copy of your data, for a correction, or to object to a particular processing. The Privacy Policy explains all of them and how to exercise them; the address is the same: support@neuralialabs.com.

This page is updated as of November 6, 2026.