Both actions live under Settings → Account, and both are owner-only. Admins and editors see a notice explaining that only the workspace owner can export or delete.

Export everything

Export my data downloads one JSON file containing what the workspace holds:

• the workspace record (name, slug, plan, subscription status, created date);
• connected Instagram accounts — without any token material;
• contacts, tags, contact–tag assignments, and contact identities;
• messages and their attachments;
• automations;
• forms and form responses;
• short links;
• media assets.

Each section carries a truncated flag. It's false in every normal case; a workspace large enough to pass the per-table export ceiling gets an honest true rather than a silently short file.

This is the GDPR Article 20 (portability) route. It's a dashboard download — it is deliberately not reachable with a personal access token, because the file contains every contact's messages and form answers, and a leaked token must not be able to pull it.

What big records about your API tokens

Separately from the export above, big keeps a small usage record for every personal access token and remote-MCP grant, so we can see which tokens are active and which surfaces are worth investing in. Two things are stored:

• Last used. A single timestamp on the token itself, shown beside it in Settings → API tokens. It is overwritten on every call, so it tells you a token is alive, not what it has done.
• A daily call tally. One row per token per day per surface per client, holding a count. "This token made 214 calls to the contacts endpoint on 14 August, from the CLI" — nothing finer. It is a running total, not a log of individual requests, so there is no way to reconstruct one call from it.

What that tally does not hold: the token value or its hash, IP addresses, request bodies, query strings, the names of the contacts or forms you touched, or anything else about the people in your workspace. The client field is the X-Big-Client hint the caller sent — cli, mcp-local, mcp-remote, sdk, or unknown when it sent nothing.

It is kept for 200 days and then deleted automatically. It is also erased sooner in two ways: deleting a token removes its tallies with it (revoking one does not — a revoked token's history stays readable to us), and deleting the account below erases all of it along with everything else.

It is not included in the export file above, which covers workspace content rather than operational counters. Ask support if you want your workspace's tallies and we will send them.

Delete the account

The Danger zone deletes the whole workspace. You have to type the workspace name exactly to confirm, and that's re-checked on the server, so the confirmation can't be skipped.

What happens, in order:

1. Your subscription is cancelled first. If cancelling fails, nothing is deleted — you'll be told to retry or contact support. Deleting the data while billing kept running would be the worst outcome, so it's the first step and it's allowed to abort the rest.
2. Uploaded files are purged from storage.
3. The workspace is deleted, and everything scoped to it goes with it: connections, contacts, messages, automations, forms, links, tokens, and memberships.
4. Your login is deleted only if this was your last workspace. If you belong to other workspaces, you keep your account and your access to them. Other members' logins are never touched — only their membership of this workspace disappears.

Your Stripe customer record and past invoices are kept. Invoices are retained for tax and accounting obligations; they're no longer linked to a live workspace.

This is the GDPR Article 17 (erasure) route, it is irreversible, and — like the export — it is owner-only and unreachable with a personal access token.

One thing it does not cover: the product-update mailing list. If you're on it — you joined it with the waitlist — your address sits with Resend, the email provider big sends through, rather than in the workspace. So it is not in the export above, and deleting the account does not take it off the list. Use the unsubscribe link in any product-update email, or write to [email protected] to have the address removed. See Product updates.

Related

• Billing — cancel a subscription without deleting anything.
• Team & roles — who can do what.
• Product updates — the mailing list, and how to leave it.