ContactVault stores messages encrypted at rest and deletes them after the retention period (default: 90 days). We do not share your data with third parties except to send email (Mailgun) and to run automated moderation. You can request deletion at any time via /gdpr/delete.