Deleting Candidate Data in Compliance Hub

HeyMilo includes a built-in system for managing candidate data deletion requests, supporting GDPR Article 17 (right to erasure) and general data compliance needs.

Where to find it: Admin dashboard → Compliance → Requests → Erasure

How deletion requests work

Deletion can be triggered three ways:

Candidate-initiated: After an interview, candidates can request deletion from their interview experience page by clicking My Data at the bottom of the page. They get a verification email, confirm via the link, and the deletion is queued.

Admin-initiated: Admins can trigger a deletion from a candidate’s profile. An optional audit note or reason can be added for record-keeping.

Where: Sidebar → Source Candidates → Interviewed Candidates → open a candidate profile.

What gets deleted

Once confirmed and processed, everything is removed from the workspace including:

• Interview recordings and transcripts
• Profile information and resume
• Assessment scores

Workspace scope: Deletion applies to the specific workspace where the request was made only. If your organization uses multiple HeyMilo workspaces, each must be handled separately.

ATS note: Deleting data in HeyMilo does not remove it from your connected ATS. If a candidate has requested full erasure, that needs to be handled in your ATS separately.

Compliance log

Admins can view all deletion activity under Compliance → Requests → Erasure. The dashboard includes:

• Summary stats at the top showing total, pending, completed, cancelled, and failed request counts, plus a volume chart
• Filterable table of all requests with status, source, timestamps, and a Scheduled deletion column showing when deletion will occur based on your retention period
• Detail view per request showing candidate ID, request ID, status history, and deletion log
• Export PDF to download the log for audit or legal purposes
• Audit log tab — a separate tab tracking governance actions like retention setting changes

Deletion statuses

Pending / Completed / Cancelled / Failed

Requests in Pending status can still be cancelled by an admin if needed.

Retention settings

Under Compliance → Settings, admins can configure how long HeyMilo holds data before deletion is processed:

• Request retention: the grace period between when a deletion is confirmed and when data is actually deleted. Default is 60 days (range: 30–180 days).
• Archive retention: how long archived documents are kept before being purged. Default is 30 days (range: 30–180 days).

Changes to retention settings apply to new requests only — existing pending requests are not affected.

What candidates see

Once a deletion request is confirmed, the candidate is marked Deactivated

and can no longer access their interview pages or application:

They appear in your candidate list with a Deactivated tag until the deletion is fully processed, then they are removed from the list entirely.

A few things to note

• Deletion cannot be reversed once processing begins.
• If a deletion request already exists for a candidate’s email, the system surfaces the existing request instead of creating a duplicate.