(Last checked 14 October 2026)

GDPR automatic account deletion for inactive and unconfirmed users

The short answer

The GDPR does not say after how many months an unused account has to go. It says you may keep data that identifies a person only as long as you need it for the purpose you collected it for, and that you should be able to explain your choice. So the period is yours to set. What Nautilus takes off your hands is the part nobody enjoys doing by hand: it warns the person by email, waits, and deletes the account if they have not come back.

We are not lawyers and this page is not legal advice. It says what the texts below say, as we read them, and what our software does. Switching these rules on does not make you compliant by itself; have the period you choose checked by someone qualified.

What the law asks

What the law asks
SourceWhat it saysWeightChecked
GDPR, Article 5(1)(e), “storage limitation”Data that identifies a person is kept no longer than is necessary for the purposes it is processed for.Regulation14 Oct 2026
GDPR, Article 17(1)(a)A person can ask for erasure once their data is no longer needed for those purposes, and the controller must then erase it without undue delay.Regulation14 Oct 2026
GDPR, Article 13(2)(a)You tell people how long you keep their data, or how you decide it.Regulation14 Oct 2026
EDPB, Guidelines 4/2019 (version 2.0, adopted 20 Oct 2020), points 80 to 82The purpose decides how long data is kept. Deleting certain personal data should be automated. You should be able to justify the period, and decide it for backups and logs too.Guidance from the EU data protection authorities14 Oct 2026
CNIL (France), questions and answers on its “commercial management” référentiels, page dated 28 Jan 2022Accounts people have stopped using: 2 years from the person's last action, with a warning before the deadline. Prospects: 3 years from collection or from the last contact the prospect initiated. Customers: during the relationship, then 3 years after it ends (for marketing use).Recommendation. The CNIL says the référentiels are not binding and that you may depart from them if you justify it14 Oct 2026 (archived copy of 18 May 2026, see Sources)

The CNIL's 2 years and 3 years

No text gives a number of days for deleting an unused account. The “3 years” you may have seen quoted is the CNIL's figure for sales prospecting files: three years from collection or from the last contact the prospect initiated. For inactive accounts it recommends 2 years from the person's last action, with a warning before the deadline.

Neither figure is a legal deadline. The GDPR sets none, and the CNIL itself says its référentiels are not binding: an organization may depart from them if it justifies the departure. They concern commercial management. For any other use, the period depends on your purpose, not on a number found online.

In practice

  • Pick a period from the purpose of your product (how long a real customer can stay away before you could consider them gone) and write it down.
  • State it in your privacy notice.
  • Warn before you delete. The CNIL suggests it, and Nautilus does it for every account that has an email address.
  • Delete the copies you made in your own systems too. See “What is not covered”.

Our view: two years of silence suits a tool people open every few months. A tool used once a year for a tax return needs longer, a chat app needs less. Nautilus accepts anything from 1 to 120 months, so the number is yours, not ours.

You are the controller of your users' data and Nautilus processes it for you. A data processing agreement is available on request.

How Nautilus does it

Nautilus has four rules per project, in its sign-in and users API (the Gate API, /v1/gate/*). Each rule is off until you switch it on, and each acts only on the end users of the project it belongs to. You set them in the dashboard, under Users & sign-in → Rules, or through the API.

Example: see how many people a one-year inactivity rule would reach, then switch it on.

curl -X POST https://api.vernesoft.com/v1/gate/lifecycle/rules/delete_inactive/preview \
  -H 'Authorization: Bearer vrn_9f8a7...' \
  -H 'Content-Type: application/json' \
  -d '{ "params": { "inactive_after_months": 12, "warn_before_days": 30, "include_without_address": false } }'
{
  "kind": "delete_inactive",
  "available": true,
  "matching_now": 41,
  "capped": false
}

matching_now is the number of people who would get the warning email right now. The preview writes nothing and works whether or not the rule is on.

curl -X PUT https://api.vernesoft.com/v1/gate/lifecycle/rules/delete_inactive \
  -H 'Authorization: Bearer vrn_9f8a7...' \
  -H 'Content-Type: application/json' \
  -d '{
    "enabled": true,
    "params": { "inactive_after_months": 12, "warn_before_days": 30, "include_without_address": false }
  }'

inactive_after_months takes 1 to 120, warn_before_days 7 to 90. For two years, send 24.

What then happens to a person:

  1. About once an hour Nautilus finds the people whose last sign-in is old enough.
  2. They get an email warn_before_days days before the deletion date. It names your project and the date (UTC), and says that signing in once is enough to keep the account. The emails are in English for now and come from noreply@vernesoft.com.
  3. On that date, if nothing has changed, the account is deleted. It is the same deletion as DELETE /v1/gate/identities/{id}: the identity and its sessions go, together with the records that tie the person to your projects and organizations. If the person signs in first, the deletion is cancelled.
  4. Your endpoints receive an identity.deleted webhook whose payload.reason is inactive_account_expired (or unverified_account_expired for unconfirmed accounts). That is your cue to delete the person in your own systems.

The four rules

The four rules
RulekindWhat it doesPlanEmail to the person
Delete unconfirmed accountsdelete_unverifiedSomeone signs up and never confirms their email address. The account is deleted delete_after_days days after sign-up (2 to 365).Free and aboveA warning warn_before_days days before deletion (1 up to delete_after_days minus 1)
Remind people to confirm their emailremind_unverifiedOne reminder remind_after_hours hours after sign-up (1 to 720), only for people who sign up after you switch the rule on. Nothing is deleted.Pro and aboveThe reminder itself
Remove roles when their deadline passesexpire_rolesAn organization member whose expires_at has passed loses the membership and the role with it.Pro and aboveNone: no account is deleted
Delete inactive accountsdelete_inactiveA person has not signed in for inactive_after_months months (1 to 120). They are warned, then deleted unless they sign in first.Pro and aboveA warning, 7 to 90 days before deletion

Turning on a rule your plan does not include is refused with 403 and the code plan_required.

What it checks before it acts

  • Nothing is on by default, and a rule also reaches people who already exist, not only new sign-ups. Run the preview first; the dashboard asks you to confirm before it switches on a rule that deletes.
  • No deletion without a warning that went out. If the warning email cannot be delivered for 72 hours, the person is left as they are.
  • Everything is checked again right before the email and right before the deletion. If the person has confirmed their address, signed in, been deactivated or deleted, or the rule has been switched off, changed or dropped from your plan, the step is cancelled and nothing is sent or deleted.
  • The deletion is never earlier than the date in the email, even if you change the rule in between.
  • Only people in this project and no other. A person with accounts in two of your projects is not touched by a rule of either. An account you deactivated yourself is left alone.
  • People who sign in with Telegram have no email address, so nothing can warn them. They are never touched, unless you set include_without_address to true: then they are deleted without any warning once inactive for the period. Switch it on only if that is what you tell your users.
  • “Inactive” means no sign-in, by any method. Sign-ins were not recorded before the feature was released on 8 October 2026, so a person with no recorded sign-in counts as active from the day they joined your project, never from before recording began. No inactivity deletion can happen before a full inactivity period has passed from that date.

What is not covered

What is not covered
WhatWhyWhat you do
Server logsThe rules do not touch server logs. They expire on a schedule of their own.Ask us if your auditor asks.
Your own systemsA rule deletes the person in Nautilus. The copy in your database, CRM, analytics, logs or email provider is yours.Act on the identity.deleted webhook.
Webhook delivery historyThe delivery history keeps the messages we sent to your endpoints (sign-up and sign-in events carry the person's email address) for 7 days on Free, 90 on Pro and 180 on Advanced and Contract. Deleting a person does not remove them earlier.Nothing: the window comes with your plan.
Audit logThe audit log keeps sign-in entries (person ID, IP address, user agent) for 7 days on Free, 30 on Pro and 90 on Advanced. Deleting a person does not remove their entries; they expire with the window.Choose a shorter window in the dashboard if you need one.
Active-user counts of closed monthsThe monthly count of active users is what we bill on, so closed months are kept for 13 months. Its rows name a person by ID only. Deleting a person removes them from the current month.Nothing.
The rules' own activity listThe finished entries (who was warned, who was deleted) are kept for 90 days. They name a person by ID and hold no email address.Nothing.
People without an email addressTelegram sign-ins cannot be warned, so the rules leave them alone by default.Decide on include_without_address.

FAQ

Does the GDPR require deleting inactive accounts after a fixed time?

No. It requires that you do not keep identifiable data longer than you need it for its purpose, and that you can justify the period you chose. The CNIL's 2 years for inactive accounts is a recommendation, not a deadline.

Do I have to warn people first?

The GDPR does not expressly require it. The CNIL recommends a warning before an inactive account is deleted. Nautilus always warns first, except for Telegram accounts you explicitly allow it to delete without one.

Can I try it without deleting anyone?

Yes. Rules are off by default, the preview writes nothing, and the dashboard asks you to confirm before a deleting rule goes live.

Start

Delete unconfirmed accounts is on the Free plan: 1,000 active users a month, no card. Delete inactive accounts needs Pro, €99 a month for 10,000 active users (prices checked 14 October 2026; the pricing page has the current list).

Verne Software is registered in Serbia. Identity data is stored on our servers, hosted at OVHcloud in France.

Sign up for FreeRead the reference → See pricing

Sources, checked 14 October 2026