How long until data is actually deleted?

By default 14 days after the request, or within an hour if you choose Delete now. New processing (scans, schedules, intel, Assistant) stops as soon as the request is made.

Can team members download all organization data?

No. The organization export is for owners. Members can download their own account data and scan reports from the Scans tab.

Are my bills deleted too?

No. Bills and payment receipts must be kept for 10 years for tax purposes, without the creator's email, and are then deleted automatically.

Download your data, close an organization, and delete your Phylex Scan account

How to download a copy of your account (JSON) and organization data (ZIP), close an organization, and delete your Phylex Scan account under Indonesian PDP law and the GDPR, including what is retained.

All data settings live in the account menu (avatar, top right) → Account & data, or directly at phylex.foiniks.com/akun. The order is deliberate: download your data first, then close or delete. Deleted data cannot be recovered.

1. Download a copy of your data

Account data (JSON), for every user: profile, organization membership, invites, tickets you opened, Assistant conversations, bills you created, and your activity log (including IP addresses).
Organization data (ZIP), owners only: assets, scan history, findings with triage history, intel alerts, tickets, bills, RoE requests, members, and the audit log as JSON files, plus uploaded RoE documents and transfer receipts. Other members' IP addresses are left out.

The format is machine-readable and can be opened in other tools (data portability). Per-scan PDF reports are still downloaded from the Scans tab. Authenticated-scan credentials are not exported: they are stored encrypted and can only be opened by the Phylex scanner.

2. Close an organization (owners)

Download the organization data first.
Open the Close organization card, type the exact organization name, confirm the data has been downloaded, and click Close organization.
From that moment scans, schedules, intel alerts, the Assistant, invites, and new bills stop. Every member receives an email.
Data is permanently deleted after a 14-day grace period. Until then an owner can click Cancel closure and service resumes as before. If you do not need the grace period, tick Delete now: data is deleted within an hour.

Deleted: assets, login credentials, scan history and raw files, findings, alerts, tickets, Assistant conversations, invites, and memberships. Members' sign-in accounts are not deleted; each member can delete their own. Closing does not automatically refund the remaining subscription, so ask in a Billing ticket first if needed.

3. Delete your account

Download your account data first.
Open the Delete account card, type your account email, confirm the data has been downloaded, and click Delete account.
The account is deleted after the 14-day grace period (or within an hour with Delete now). During the grace period you can still sign in and click Cancel account deletion.

Rules for organizations with team members:

Members can delete their account right away; their membership goes, the organization's data stays with the organization.
The last owner of an organization with other members must first make another member an owner under avatar menu → Team, or close the organization. An organization cannot be left without an owner.
The only member: deleting the account also closes the organization. Cancelling the account deletion also cancels the closure.

After deletion your name on tickets is replaced with "Deleted user", your email is removed from bills and RoE requests, and IP addresses in the activity log are cleared.

What we keep

Bills, tax invoices, and transfer receipts: 10 years, as required for tax records (Indonesian General Tax Law, Art. 28(11)).
Audit log and RoE documents of a closed organization: 2 years, as proof that every scan was authorized by the asset owner.
Company email domain of a closed organization: 2 years, so the free trial is not reused.

After that, the data is deleted automatically. Other PDP/GDPR rights (such as correcting data or objecting to processing) can be exercised at support@foiniks.com. See the Privacy Policy.

Phylex and the PDP Law

Request deadlines: we respond to requests for access, correction, and suspension or restriction of processing within 3 × 24 hours.
Legal basis for each purpose (service, billing, security, Assistant) is listed in the Privacy Policy.
Transfers outside Indonesia: core data is stored in Google Cloud Jakarta. Sign-in (Firebase Authentication), the Assistant (Vertex AI, data masked first), and email delivery (Resend) use services outside Indonesia.
Data protection failures: we notify affected data subjects and the supervisory authority within 3 × 24 hours of becoming aware. If your organization's data is involved, the organization owner is notified within the same time.
Law enforcement requests: we disclose data only on a valid written request, reviewed by our Personal Data Protection Officer and limited to relevant data. The organization owner is notified unless the authority or the law prohibits it. Access for supervision and law enforcement is given only as required of Phylex as a registered private Electronic System Operator (PB-UMKU 812001414217800110001) and by law.

The PDP Law implementing regulation (Government Regulation 33/2026) takes effect on 16 January 2027. To assess your own organization's readiness, see the PDP Readiness Check service from Phylex Comply.