顧客データの保持・マスク・消去

Busymate AI keeps a workspace's conversations for 90 days by default and shows stored text as it was written. This guide covers the retention window for conversations and for customer memory, the switch that hides card, bank account and id numbers from everyone who reads a conversation afterwards, and the tools that hand over or remove a single customer's data.

What is kept, and for how long

A conversation that is still running is never erased by the sweep; it waits until it has finished.

1. Set how long conversations are kept

1. Open Console › Channels and access and set Retention days.
2. Publish. The window is part of your published configuration, so it applies to every channel at once.
3. An hourly job erases finished conversations whose last activity is older than the window: the messages, the sub-agent runs and the telemetry. Shortening the window erases older conversations on the next run.

From your AI tools the same field is access.retentionDays in get_tenant_config, published with publish_tenant_runtime.

Caution. The erasure is permanent. Export what you need before you shorten the window.

2. Set how long customer memory is kept

Customer memory is the short summary the assistant keeps about a signed-in customer between conversations. On Console › Customers › Customer context, choose Forget a customer's memory after a number of days without a conversation. Turning memory off deletes every stored summary within a day. Erasing a customer erases their memory at once.

3. Mask personal data when conversations are read

Customers type card numbers, IBANs and id numbers into chats and emails. With masking on, your team, your exports and your AI tools see a placeholder instead of the stored value. The stored conversation is unchanged.

On Console › Customers › Customer context, switch on Mask personal data when conversations are read. The card saves on its own and is live within 15 seconds. Only a workspace admin can change it, and every change is recorded with who made it and when.

What is masked, on top of credentials and API keys that were already hidden:

• Card numbers that pass the card checksum, keeping the last four digits: •••• 4242.
• IBANs that pass the IBAN checksum, keeping the last four characters.
• National ids where the format is reliable: Romania (CNP), Moldova (IDNP), United States (SSN), United Kingdom (National Insurance number), Spain (DNI and NIE). Shown as ••••••••.

Email addresses and phone numbers are not masked. Your team needs them to reach the customer.

Where the mask applies when the setting is on:

• Transcript exports (Markdown and CSV) and the transcript page. 提供中
• Transcript, event and handoff reads over MCP and the REST API. 提供中
• Reply drafts: the copilot in the Inbox and draft_tenant_support_reply work from the masked text. 提供中
• Email: thread lists, thread bodies, search, the summarize, suggest-a-reply and translate helpers, and the Inbox email view. Message ids and addresses are untouched. 提供中
• Insights evidence and thread translation. 提供中
• The live Inbox thread view, with a reveal that a permitted teammate can use and that is recorded. 先行提供変更履歴をフォローする
• Outbound webhook payloads. 先行提供変更履歴をフォローする

A text too large to scan (over 1 MB) is withheld rather than shown unmasked. If the setting cannot be read, reads are masked until it can. Turning the setting off shows the stored values again within 15 seconds.

From your AI tools: get_tenant_data_handling returns pii_read_masking (your setting), platform_pii_read_masking (a switch we can set for every workspace; the card says so when it is on) and effective_pii_read_masking. set_tenant_data_handling takes tenant_id, pii_read_masking and confirm.

4. Export or erase one customer or one conversation

• One conversation. Delete it from the Inbox, or call delete_tenant_conversation. The messages, sub-agent runs and telemetry go; billing rows and the customer's identity stay. A conversation still running is refused.
• One customer. export_tenant_customer returns what the workspace holds about a signed-in customer. forget_tenant_customer erases it, including their memory, after you confirm.
• Test traffic. purge_tenant_test_traffic deletes every conversation and usage row your test account produced.

Verify

1. Console › Channels and access shows the retention days you set, and get_tenant_config returns the same value under access.retentionDays.
2. In a test conversation, send the test card 4242 4242 4242 4242. With masking on, the Markdown export and get_tenant_conversation_transcript show •••• 4242, and get_tenant_data_handling returns effective_pii_read_masking: true.
3. Switch masking off. Within 15 seconds the same export shows the full number again.

Troubleshooting

• The card says "Only a workspace admin can change this." Your role can read the setting but not change it; ask a workspace admin.
• A value is still visible after turning masking on. Wait 15 seconds and read again. Emails and phone numbers are never masked. If the surface is marked beta above, it may not mask yet.
• An old conversation is still there. The sweep runs hourly and only erases conversations that have finished. Check that the shorter window was published.

Next steps

• Set up human handoff — who sees transcripts in the Inbox and when.
• Bring your own EmailEngine — retention and redaction for mail on your own server.
• Governance — features, limits and where every workspace setting lives.
• Security — hosting, sub-processors and the platform's own controls.