Skip to content
imessageapi

How long to keep customer messages, and where

Message history is useful right up until it becomes a liability. Most small businesses keep everything forever by accident, which is the one option with no upside.

7 min readUpdated August 23, 2026Compliance

Almost nobody decides a retention policy. They just never delete anything, and three years later they are holding a searchable archive of customer conversations that would be genuinely damaging in a breach and awkward in a data request.

Three categories, three answers

Keep for a long time

  • Consent records and every status change
  • Opt-out list — effectively forever
  • Proof of what was disclosed at opt-in
  • Delivery records tied to disputed invoices

Keep briefly, then delete

  • Conversation content
  • Delivery-status events past reporting need
  • Draft and queued messages already sent
  • Anything you cannot name a use for

The opt-out list is the exception to every deletion rule

If someone asks to be deleted, you still need to know not to message them. Keep a minimal suppression record — a hashed number and a date, nothing else — so honouring their deletion does not accidentally re-enrol them next year. Flag this specific tension with your advisor.

A default that is defensible

Conversation content for twelve to twenty-four months covers the realistic need: resolving a dispute about what was agreed, and giving context on a returning customer. Beyond that the value drops sharply and the risk does not.

retention.ts
const RETENTION = {
  messageContent: months(18),      // disputes and context
  deliveryEvents: months(6),       // reporting and deliverability analysis
  consentRecords: years(7),        // you may need to prove this
  suppressionList: null,           // never delete — this is the safety net
} as const;
 
export async function pruneExpired(now: Date) {
  await db.message.deleteMany({
    where: { createdAt: { lt: subtract(now, RETENTION.messageContent) } },
  });
  await db.deliveryEvent.deleteMany({
    where: { createdAt: { lt: subtract(now, RETENTION.deliveryEvents) } },
  });
  // consentRecords and suppressionList are deliberately untouched.
}

Where it lives matters as much as how long

Your provider holds a copy of everything too. Ask three questions and get the answers in writing: how long do they retain message content, can you configure it, and who at their company can read it. Several vendors retain indefinitely by default and will shorten it on request — but only if you ask.

This is also a switching question. If you leave, what happens to the archive they hold? A vendor that cannot answer that has told you something about their maturity.

Handling a deletion request

  1. Verify who is asking. A phone number is not identity, and deleting the wrong person's history is its own incident.
  2. Delete conversation content in your systems.
  3. Ask your provider to delete their copy, and record that you asked.
  4. Keep the minimal suppression record so they stay unmessaged.
  5. Write down what you did and when. The record of compliance is part of compliance.

Deleting is cheaper than defending

There is no scenario where a four-year-old conversation about a haircut helps you, and several where holding it hurts. A scheduled prune job is an afternoon of work and it permanently reduces the size of your worst day.

Next step

Generate a tagged link for whatever you send next with the UTM builder, see what this looks like in your industry, or compare the services that can send it on the providers page.

Keep reading

All 61 guides