Privacy and retention

This page covers what Genie keeps about people and for how long: how long conversations are kept, what long-term memory remembers, how a person gets a copy of their data or has it erased, and which emails Genie sends. Use it when you set your company's retention rules, answer a personal-data request under Decree 13/2023/NĐ-CP or a similar law, or set up outgoing email. System administrators set these for the whole company: the retention period and long-term memory of every workspace, personal-data requests and outgoing email. Workspace admins and Owners no longer change retention or long-term memory.

Conversation retention

Genie deletes conversations that have had no activity for a set period. The system administrator sets the period for every workspace: a default and, if needed, a maximum (see Platform limits). Workspace admins no longer choose a period of their own. A workspace whose admins chose one before keeps it, still within the maximum.

Every member sees the period that applies to their workspace on their Profile page under Your data.

What the daily cleanup deletes, permanently:

• every conversation of the workspace whose last activity (the last question, rename or pin, or the newest message) is older than the period;
• with its messages, attachments, pasted images and files Genie generated, and its sandbox if one is still running;
• the answer ratings given in it, which then leave the Analytics reports.

The cleanup includes pinned conversations (pinning is not a legal hold), conversations in Recently deleted, and conversations from Teams, Zalo, the website widget and API keys. It never deletes knowledge base documents, which follow their own review and expiry rules (see Knowledge bases), and it does not touch long-term memory.

Cảnh báo

Deletion by the cleanup is permanent and skips Recently deleted. Before you shorten the default or the maximum, export what you must keep, for example the conversations of a person under a legal hold (see Personal data).

After each cleanup, the workspace audit log records Expired conversations deleted with the counts and System as the actor. Changes to the default and the maximum are recorded in the platform Audit log as System setting changed.

Platform limits

System administrators set three values for every workspace. Open Settings → System settings (in the System administration group) and choose the Security & privacy tab:

Setting	What it does
Default conversation retention (days)	The period for every workspace, except one that kept a period its admins chose before. 365 (one year) by default; 0 means never delete
Maximum conversation retention (days)	The longest any workspace may keep an inactive conversation, even one that kept Never delete from before. A shorter period still applies as it is. 0 means no limit; at most 3650
Days a deleted conversation can be restored	How long a deleted conversation stays in Recently deleted. 30 by default; 0 deletes conversations permanently at once; at most 365

The period applied to a workspace is the shorter of the default (or the period it kept) and the platform maximum:

Default, or the period the workspace kept	Platform maximum	Applied
Default one year	None	365 days
Never delete	None	Nothing is deleted
Never delete	365 days	365 days
730 days	365 days	365 days
30 days	365 days	30 days

Lowering the maximum asks for confirmation, because the next cleanup deletes older conversations in every workspace.

Recently deleted

When someone deletes a conversation, it moves to Recently deleted (at the bottom of the sidebar). It disappears from their list, from search and from anyone it was shared with, but its owner can Restore it for 30 days, or the number of days the platform setting gives. After that the daily cleanup deletes it permanently. The owner can also Delete permanently one conversation, or Empty trash for all of theirs. See Conversations.

• Conversations held by Teams, Zalo, the website widget or an API key have no Recently deleted: deleting them is permanent at once. Admins and Owners delete website widget conversations from the sidebar, and the confirmation says so; an application deletes its own API conversations. Teams and Zalo conversations are not shown in Genie, so no one deletes them there: the retention period does (see Who reads channel conversations).
• The retention period still applies: a deleted conversation older than the period goes at the next cleanup, even inside its restore period.
• The workspace audit log records Conversations deleted permanently and Deleted conversations purged.

Long-term memory

Long-term memory lets Genie remember what members tell it across conversations: who they are, how they like to work, stable facts and what they are working on. It is off until a system administrator turns it on, because it keeps what people say. Each member has their own memory, which they can review, edit, delete or switch off under My memory (see Memory).

To set it up (system administrators):

1. Open Settings → Assistant & conversations (in the System administration group) and scroll to Long-term memory.
2. Turn on Enable long-term memory in this workspace. On this page the switch turns memory on in every workspace.
3. Under How memories are written, choose:
   • Explicit only: Genie records only what a member asks it to remember, plus entries added by hand. No extra model calls.
   • Distill automatically: after a conversation, Genie also makes one background model call to pick out what is worth keeping.
4. With Distill automatically, you can also set the Distillation model (blank uses the model for background tasks, the cheapest chat model unless you chose another), Custom distillation rules such as "never record customer names", and Questions before a topic becomes an interest.
5. Review the other settings:
   • Match memory by meaning finds a memory even when people word things differently. It uses the Memory embedding model you choose; leave that blank to match on wording only.
   • Let memory shape retrieval lets memory help Genie understand a question and rank documents, not only add context to the answer.
   • Memories per member caps how many active memories each person keeps. Beyond it, the least important are archived; people still see them under My memory.

The page saves each change as you make it and writes it into every workspace, including workspaces created later. A workspace that needs its own memory settings can get them under Workspaces with their own setting (see Assistant and conversations). Workspace admins no longer have a Long-term memory page; a link to it opens Assistant & conversations for system administrators and tells anyone else to ask them.

• Memory never widens what a person may read: knowledge base and document permissions still apply.
• Each agent has its own Long-term Memory switch in its settings, so you can keep memory out of a particular agent.
• Retention does not delete memory. A person's memory is removed when they clear it themselves or when a system administrator erases their data (see Personal data).
• Distilling memories is a model call and counts toward Usage & cost.

Personal data

People can download their own data. Requests to erase someone's data go to a system administrator.

A person downloads their own data

1. Open Settings → Profile.
2. Under Your data, click Download my data.

The ZIP file holds the person's profile, every conversation they own with its messages (including deleted conversations still stored), their long-term memory in each workspace, and the files they uploaded into chats that are still stored. A manifest.json file in the archive says whether anything was left out because the export reached its size limits. On purpose, the export leaves out passages quoted from other people's documents, conversations held by Teams, Zalo, the widget or API keys, knowledge base documents, and every password, key and secret. One export per person runs at a time; if the server is busy, try again in a few minutes. Each download is recorded in the system audit log as Personal data downloaded by the user.

Requests handled by a system administrator

Open Settings → Users (in the System administration group) and open the ⋯ menu at the end of the person's row:

• Export data… downloads the same ZIP file for that person, to answer a legal request or when someone leaves the company. Members must be able to trust that administrators do not read what they ask Genie, so an export is never silent (see Exporting a person's data).
• Erase conversations… permanently deletes, in every workspace, every conversation the person owns (deleted ones too) with its messages, attachments, pasted images, generated files and search entries, and all of their long-term memory. To confirm, type the person's email and click Erase permanently. The account, its workspace memberships and the knowledge bases, documents and agents the person created are kept. It is recorded as Conversations of a user erased. If part of the erasure fails, the page says so: run it again to finish.

A typical request runs in this order:

1. Export data…, if the person asked for a copy, and hand the file over securely.
2. Erase conversations….
3. If the person has left the company, delete the account with Delete… in the same menu. Deleting an account hands their knowledge bases and agents to a successor but does not delete their conversations, which is why you erase first. See System administration.

Exporting a person's data: reason and notice

1. Click Export data… in the person's ⋯ menu.
2. Under Reason for the export, write why, in 10 to 500 characters. For example: "Court request, letter no. 123 of 30 October" or "Handover when leaving the company".
3. Click Export data. The download can take a few minutes; keep the dialog open until it ends.

What happens:

• The system audit log records Personal data of a user exported with the reason, who exported, the number of conversations, messages and memories, and whether the person was told. The reason shows in the entry's summary line; the details hold reason, exported_by and notice.
• The person receives an email, in their language, saying that a system administrator exported their data, when, and the reason you wrote. It is sent even if they turned notification emails off.
• If outgoing email is not set up, the export still works, the dialog warns you before you start, and the audit entry says the person was not told (notice: not_sent). Tell them yourself.

Members read on their Profile page, under Your data, that a system administrator can export their data for a legal request or when they leave, must give a reason, and that they are emailed each time.

Email notifications

Genie sends a few emails, each in the recipient's language (English or Vietnamese, the language they last used in Genie). Nothing is sent until a system administrator sets up outgoing email.

Email	Who receives it	When
Password reset link	The account's email address	Someone clicks Forgot password? on the sign-in page. Accounts that sign in only with Microsoft or another company sign-in get none
Workspace invitation	The invited address, with or without a Genie account	An Owner invites someone by email, or clicks Resend invitation email (see Members and sign-in)
Document review reminder	Document owners	After the daily review run, when documents they own are due for review or have expired. One email lists them
Documents waiting for approval	The knowledge base's approvers	When documents start waiting for approval, at most one email every 15 minutes per knowledge base
Approval decision	The person who submitted the document	When an approver approves or rejects it, with the comment
Temporary access ended	The person who granted the access	After the daily run removes memberships, shares, agent access or document permissions whose end date has passed (see Document permissions)
Your data was exported	The person whose data it is	A system administrator exports their data, with when and the reason given (see Exporting a person's data)
Test email	Any address	A system administrator sends it from the Email page

Genie does not email about budgets: budget warnings appear in chat (see Budgets).

Each person can turn off notification emails under Settings → Profile → Notification emails. That stops review reminders, approval emails, access-ended emails and invitations to their existing account; they still see invitations under My invitations in Genie. Password reset emails, data-export notices, and invitations to an address that has no account yet, are always sent. Disabled accounts receive no notification email, except a data-export notice.

Without outgoing email, the sign-in page shows no Forgot password? link, and only people who already have an account can be invited; they accept the invitation in Genie.

Outgoing email

System administrators set up outgoing email once for the whole platform, through your company's mail server (an SMTP relay) or through Microsoft 365.

1. Open Settings → Email (in the System administration group).
2. Under Send email with, choose SMTP relay or Microsoft 365 (Graph). Off stops all email.
3. In Genie address for links, enter the address people open Genie at, for example https://genie.contoso.test. Use this address fills in the address you are using now.
4. Fill in the settings for your choice (tables below).
5. Click Save.
6. Under Send a test email, enter your own address and click Send test email. Within a minute the page says the email was sent, or shows the mail server's error.

Setting	What it does
Genie address for links	Password reset and invitation links point here. Set it to the address people really use, or links will lead to the wrong place
From address, From name	The sender people see (SMTP only; with Microsoft 365 the email comes from the sender mailbox)
Reply-to (optional)	Replies go to this address instead of the sender, for example your IT helpdesk

For an SMTP relay, get the details from whoever runs your mail server, or ask your Genie provider:

Setting	What it does
SMTP server, Port	Your mail server's name and port
Encryption	STARTTLS (port 587) or TLS from the start (port 465) encrypt the connection. None (internal relay only) is for a relay inside your network
Username (optional), Password	The mailbox Genie signs in with. Leave the username empty for a relay that accepts mail from Genie without signing in

For Microsoft 365 (Graph), your Microsoft 365 administrator first registers an app in Microsoft Entra ID with the Mail.Send application permission (with admin consent) and a client secret, and picks a sender mailbox such as noreply@contoso.test. Then fill in:

Setting	What it does
Directory (tenant) ID, Application (client) ID	Identify your company's directory and the app you registered
Client secret	The app's secret. Email stops on the day it expires, so note the date and save a new secret before then
Sender mailbox	The mailbox Genie sends from
Keep a copy in Sent Items	Saves each email in the sender mailbox

• Saved passwords and client secrets are never shown again. The field says Saved; leave empty to keep it.
• The Mail.Send permission lets the app send as any mailbox until you limit it. Ask your Microsoft 365 administrator to restrict the app to the sender mailbox with an Exchange Online application access policy.
• If your Genie provider has already set up email for you, the page says so. Settings you save here take precedence over theirs.
• If the test email keeps saying it is still waiting, ask your Genie provider.
• If emails arrive in spam, ask your mail administrator to publish SPF and DKIM records for the sender's domain.
• Changes and test emails are recorded in the system audit log as Changed email settings and Sent a test email.

Good to know

• Retention covers conversations only. Documents in knowledge bases have their own owners, review dates and expiry rules (see Knowledge bases).
• Retention and erasure are permanent. There is no way to bring back a conversation once the cleanup or an erasure has removed it.
• Personal-data exports and erasures work only for a person signed in to Genie, never through API keys.
• Members can read the retention period of their workspace on their Profile page, so tell them before you shorten the default or the maximum.
• Erasing a person's conversations does not remove them from the workspace or close their account.
• The server log does not hold what members ask or what Genie answers at the usual log level (info); only lengths and ids. The text appears only when your Genie provider turns on debug logging to investigate a problem.
• Usage reports show each person's totals only, never which agent or knowledge base they used or on which day (see Usage & cost).

Related pages

• Conversations: history, deleting and Recently deleted, from the user's side
• Memory: what people see under My memory
• Usage, analytics and audit
• Members and sign-in
• System administration