Your customers' messages stay in your CRM.
Here is exactly where.
What Omnithread stores, where the encryption key and the files live, how long things are kept, how to export or erase one person, and what uninstall removes.
01What is stored, and where
| Data | Where | Kept |
|---|---|---|
| People, their channel addresses (e-mail, phone numbers, chat IDs), conversations, messages, notes, drafts, labels | The module's tables in your Perfex database (prefix + ot_) | Until you delete the conversation or channel, erase the person, or uninstall |
| Attachment files | uploads/omnithread/files/, or the folder in Settings > E-mail > Storage folder | Until deleted; optionally removed after Delete stored attachments after N days (default 0 = keep). The message stays, and for e-mail the original remains on your mail server. |
| Mailbox passwords, OAuth tokens, channel tokens and secrets, Google and Microsoft client secrets, the AI key | Database, encrypted with AES-256-GCM | Until you change or remove them |
| The encryption key | uploads/omnithread/omnithread-key.php (see below) | Until uninstall |
| Webhook requests from chat providers | Table ot_webhook_log | 14 days; content only while Keep the content of incoming webhooks for 14 days is on (default on). See Webhook content. |
| Website chat sessions | Table ot_widget_sessions: visitor name, e-mail, page, a hash of the visitor token, a keyed hash of the network address | Network address hash cleared after one day; session deleted after the idle days in Settings (default 30) |
| Satisfaction ratings | Table ot_csat: score, comment, a hash of the link token | Until uninstall; the comment is removed when the person is erased |
| AI audit log | Table ot_audit: who, what for, model, token counts. No message content. | Until uninstall |
| Who is looking at or writing in a conversation | Table ot_presence | Short-lived; swept by the daily clean-up |
Messages go only to the providers of the channels you connect, and to your AI provider when AI is used (what is sent). The module sends nothing to its author and has no tracking.
02The encryption key
On first activation the module creates a random key and writes it to uploads/omnithread/omnithread-key.php, outside the database, so a database copy alone does not reveal your passwords and tokens. The file is a PHP file that prints nothing when requested, the folder gets an Apache deny rule and an empty index.html, and on nginx you should add the rule in Security.
- Back it up together with the database. Without the key, stored passwords and tokens cannot be read; you would have to enter them again (the module then says The stored password cannot be read (the encryption key changed)).
- Never share it. It is a secret like a password.
- If the folder was not writable at activation, the key is stored as a Perfex option in the database instead, and the System check shows The encryption key is stored in the database. To move it out of the database, make
uploads/omnithreadwritable, then deactivate and activate the module: activation writes the same key into the key file and removes the database copy, so your stored passwords and tokens keep working.
03Attachment files
Each stored file gets a random name without an extension in a two-level folder, so nothing a sender chooses becomes a path or a file type the web server would run. Files are only ever read back through the module, which checks permissions first; risky types are always downloaded, never shown in the page. The folder carries an Apache deny rule and an empty index.html. For the strongest setup, point Storage folder to an absolute path outside the web root (it must exist and be writable).
04Data requests: export and erase one person
In the person panel (permission Move to trash, delete labels):
- Export their data downloads a JSON file with the person, their channel addresses, their conversations, every message (sender, time, subject, text) and the list of attachments (name, type, size).
- Erase this person (type
ERASEto confirm) deletes their messages, files, notes, drafts, mentions, AI suggestions, channel addresses and website chat sessions, and removes rating comments. Their conversations stay as empty rows so your reports keep their counts. This cannot be undone.
It does not change Perfex records (contacts, leads, tickets and ticket replies created from conversations), mail on your mail servers, data at the providers, or webhook log content (which expires after 14 days). Handle those separately when you answer a deletion request.
05Your privacy notice
You are responsible for your own privacy notice. Points it may need, depending on what you switch on: the channels you use and their providers (Meta, Telegram, Twilio, Google, Microsoft), the website chat (it keeps a random token in the visitor's browser localStorage and sets no cookie), satisfaction ratings, an AI provider if AI is on, and how long you keep messages. The website chat can show a consent checkbox (Texts).
06What uninstall removes
- All 39 module tables with every conversation, message, person, note, rule, report, log and setting row.
- Every Omnithread option in Perfex's options table, including the key when it was stored there.
- The stored attachment files in the default folder and in a custom storage folder, and the key file.
It does not remove Perfex records, mail on your mail servers or anything at the providers. The uploads/omnithread/ folder may remain with its two guard files; delete it by hand. Details: Uninstall.