This article covers what we store, how to export your data, how to schedule a deletion, and what gets retained vs removed. For the formal commitments, see the privacy policy and the subprocessors page.
Both data export and account deletion live under Settings → Security in the panel labelled data subject requests.
Click Download my data. Candor builds a JSON file with your profile, workspace memberships, audit events, projects, synthetic participants, interview sessions, conversation transcripts, your help chat history with Candor Bot, and any answers you gave to the feedback question at the bottom of a participants page or a report. If you joined the waitlist with the same email address before signing up, any waitlist row we hold (including publicly available enrichment we looked up against it) is included in the export. The file is uploaded to a temporary signed URL and emailed to you. The link is valid for seven days; after that it expires and you’d request a new one.
Each data type has a generous upper limit (thousands to tens of thousands of rows). If your account is large enough to hit one, the export says so: a truncated_tables field inside the file lists any section that was cut off, so a partial export never silently looks complete.
Only one export request can be in flight at a time. If you already have one running, the button stays disabled until it finishes.
Click Delete my account and a confirmation dialog asks you to type your email address to confirm. That schedules the delete for seven days from now and sends you a cancellation email. The email contains a link you can click any time within that window to call off the deletion. No login needed for the cancellation link; the token in the URL authenticates it.
The seven-day grace period is intentional. It protects against accidental clicks and gives you time to change your mind. After the grace period elapses, deletion runs automatically on the next cron tick (around 04:00 UTC).
Deletion removes you from every workspace you’re a member of. Your auth account is deleted, which cascades to sessions, identities, and MFA factors. Audit events keep their rows but the user reference is anonymised. The row still exists for compliance, but there’s no longer a link back to you.
If you joined the waitlist with the same email address, the waitlist row (and any enrichment we held against it) is deleted in the same step.
Your email address is unsubscribed from our email list in Mailchimp in the same step, so you get no more emails from that list. (Every Candor account holder is on that list for factual updates about Candor. Marketing emails go only to people who asked for them.)
Your help chats with Candor Bot are deleted outright, not anonymised. Those messages are free text and can name work you haven’t launched yet, so we remove the content rather than keep it without your name on it.
Answers you gave to the feedback question on a participants page or at the bottom of a report go the same way, and for the same reason: the comment box is free text. We keep those answers indefinitely otherwise, because they tell us where the research misses and there’s no reason to expire them. Deleting your account removes yours.
Projects you created keep existing inside the workspaces they live in (they belong to the workspace, not you personally). The created_by field on those rows is set to null. The team you were part of can continue working with that data; they just won’t see your name attached.
Two append-only tables persist indefinitely, regardless of account deletion or per-workspace retention settings:
Candor automatically deletes the documents you upload 30 days after you upload them. This is a deliberate privacy default. The original file is the most sensitive thing we hold, so we don’t keep it longer than we need to extract value from it.
Deleting the file does not delete your research. When Candor processes an upload, it pulls out signals: short, structured insights, each with a brief supporting quote. Those signals are what power your audience and your participants. When the 30-day window passes, Candor removes the original file and the internal full-text copy it made for search, but keeps every signal, its supporting quote, and the link back to the document it came from. On the audience page the document stays listed and marked as deleted, with its signal and evidence counts intact. You lose the ability to download the original, and nothing else.
Workspaces can adjust the window (shorter for tighter privacy, longer to keep originals around for re-runs), and conversation transcripts have their own separate retention setting. Short windows reduce blast radius if there’s ever a breach; long windows preserve more research history. The tradeoff is yours.
When you ask Candor Bot a question, we store your message and its reply, plus the page you were on. We read these to find where Candor or its help content is confusing, which is how these articles get better. We don’t use them to train models.
Help chats are kept for 180 days and then deleted automatically. That window is fixed for everyone rather than per-workspace, because this is Candor’s own product feedback rather than your research data. Starting a new chat in the widget begins a separate conversation; it does not delete the previous one. To remove them sooner, delete your account or email us at the address below.
Candor uses third-party services for LLM inference, interview quality checks, web search, embeddings, transactional email, infrastructure, and product analytics. The full list, with what each one receives, is on the subprocessors page. Each gets only the data it needs for its part of the work. How long they keep it varies. Anthropic deletes prompts and responses within 30 days, Voyage AI deletes document text as soon as it has processed it, and the web-search provider may keep the search queries it receives. TypeSafe, which checks your age, role and region answers against what you wrote, judges research evidence, the quality of simulated interviews, which option a participant picked, and how each value proposition or message landed, sets no fixed period for the setup answers, research text, transcript excerpts and concept descriptions it receives. Session recordings follow the analytics provider’s own schedule, as described below.
Only if you accepted analytics cookies on the banner, and only inside the signed-in app. If you declined, nothing is recorded at all. You can change that answer whenever you like: open the user menu in the top right and choose Cookie settings. Declining stops a recording that is already running, without a page reload.
When you have accepted, we record how the interface is used (pages, clicks, scrolling, the path through a task) so we can find where Candor is confusing or broken, and the recording reproduces the screen as it appeared. That means workspace content on the page at the time is visible to our team in the replay, the same as it would be if you shared your screen with us.
Three things are never in it. Text you type into a field is masked before it leaves your browser. Passwords and payment details are not captured at all. Profile photos and two-factor setup codes are excluded outright.
The tool receives your account identifiers: a user ID, a workspace ID, your role, and your plan, plus your workspace name if you have set one. Not your own name, and not your email address. Nothing is recorded on the public marketing pages, and nothing is recorded while our support staff are viewing your account on your behalf.
Deleting your account does not delete these recordings automatically. They sit with the analytics provider and expire on its retention schedule. Ask us and we will delete them for you.
No. Candor doesn't train AI models on your data, and neither do the AI providers that handle your content. Anthropic, which runs the language models behind Candor, is contractually barred from training on customer content, and deletes it within 30 days unless it's flagged for a usage-policy review. Voyage AI, which indexes your uploaded documents so Candor can search them, is set to delete your content as soon as it has processed it. TypeSafe, which makes small judgements while your research runs, receives what you wrote about your audience while you set up a study, with the age, role, region, company size and income you entered, so it can check the age, role and region boxes against what you wrote. Then it receives the research questions planned for your study and the findings web search returned, plus excerpts of your simulated interview transcripts. When it reads which option a participant picked in a concept test, it also receives the names and shortened descriptions of the options you are testing. When it grades how each option landed in a value proposition or messaging test, it receives the name and description of the product being tested, the option's statement, and the participant's answers about it. It never receives your documents. Its terms bar it from training on them, though it sets no fixed deletion period. Your uploaded documents, conversation transcripts, and synthetic participant profiles are used only to run your studies inside your own workspace, and are never shared between workspaces. Candor's web-search provider never sees your documents or transcripts. It receives search queries that describe your audience, such as its industry and region, and its terms let it use those queries to improve its own service. The full list of providers, and what each one receives, is on the subprocessors page.
By default, Candor automatically deletes an uploaded document 30 days after you upload it. Deleting the file does not lose your research: Candor keeps the signals it extracted (short insights, each with a brief supporting quote) and the link from each signal back to its document, so your audience and your synthetic participants stay fully intact. The document still appears on the audience page, marked as deleted, with its signal and evidence counts unchanged. Only the original file and the internal full-text copy used for search are removed. Your workspace can shorten the window for tighter privacy or lengthen it to keep originals available for re-runs.
Yes. Every row in Candor's database belongs to one workspace, and Candor checks your workspace membership and role on every request before it reads or writes any of that workspace's data. Row-level security is also switched on for every table, which blocks direct access to the database from outside the app. Storage buckets, signed upload URLs, and background processing jobs are also scoped per workspace. People outside your workspace can't see its data unless you invite them. Platform administrators can access workspace data only through audited impersonation, which is logged immutably.
You can delete your account from Settings → Security, which schedules deletion with a seven-day grace period and emails you a cancellation link. After the grace period runs out, Candor removes you from every workspace, deletes your auth account (which cascades to sessions, identities, and MFA factors), anonymises your references in audit events, and deletes your help chats with Candor Bot outright. Projects you created stay in the workspaces they belong to, since they're owned by the workspace, not by you. The team you were part of keeps using them with your name no longer attached.
Yes. When you ask Candor Bot a question, Candor stores your message, its reply, and the page you were on. The purpose is product feedback: reading where people get stuck is how the product and these help articles improve. Help chats are kept for 180 days and then deleted automatically. That window is fixed for everyone rather than per-workspace, because this is Candor's own feedback rather than your research data. They're included in your data export, and unlike audit events they're deleted outright (not anonymised) when you delete your account. They are never used to train AI models. Starting a new chat begins a separate conversation; it doesn't delete the previous one.
Candor runs on managed infrastructure in North America. Your data (uploaded documents, synthetic participant profiles, conversation transcripts, audit logs) sits in those regions and is replicated across availability zones within them. Subprocessors that process data for Candor (LLM inference, interview quality checks, web search, embeddings) operate from their own regions, listed on the subprocessors page. If your organisation requires specific data residency that we don't currently support, get in touch before signing up.
Only platform administrators can read workspace data outside an invited account, and only through audited impersonation. Every impersonation event writes an immutable audit log entry with the administrator's identity, the target workspace, the time, and the actions taken. Those logs are append-only at the database level: nobody can edit or delete an entry. They survive account deletion, with the link to the deleted user removed. There's no audit log viewer in the app yet. Your own actions are included in your data export from Settings → Security, and a workspace Owner can email ben@highlinebeta.com for a copy of the workspace's audit events, including every administrator access. That's the accountability mechanism.
Start with a free project, or walk through Candor with us first.