Confirm who is asking
Check the request comes from the account owner or a verified contact before you delete anything. Reply to the address on file, or ask a question only the account holder can answer. Deleting for the wrong person cannot be undone.
Say what will happen
Tell the customer what will be deleted, what you must keep, such as invoices required for tax, and for how long. Plain language beats a policy link.
Check what depends on the data
Look for active subscriptions, open tickets, shared workspaces or integrations. Offer an export first if they may want a copy, and warn them that deletion is permanent.
Do it within the time you promise
Agree a date, do the deletion and confirm in writing when it is done. Check the rules that apply to you, such as GDPR, for the deadline, and ask a lawyer when unsure.
Remember the places data hides
Ticket history, backups, analytics, email tools and notes in other systems may all hold copies. Keep a short list of where customer data lives so nothing is missed.
Keep a minimal record
Record that the request came in, when it was done and by whom, without keeping the deleted content. That record is your proof if anyone asks.