Data Retention & Disposal
How long each category of data is kept, what happens when you delete your account, and what survives deletion. Retention periods stated here are our current targets and may be extended where the law requires it.
1. While your account is active
Your business records — clients, services, invoices, quotations, attachments and activity history — are retained for as long as your account exists. We do not age out or archive your invoicing history behind a paywall.
This is deliberate: invoices are records you may be legally required to keep for years, and a tool that quietly disposed of them would be worse than no tool.
2. Retention schedule
| Data | Retention | Then |
|---|---|---|
| Business records (invoices, clients, services, quotations, attachments) | Life of the account | Deleted after the post-deletion recovery window |
| Account and profile data | Life of the account | Deleted after the post-deletion recovery window |
| Soft-deleted records inside the app | 30 days by default, configurable | Permanently destroyed |
| Account after a deletion request | 30-day recovery window | Securely destroyed, except the retained records in section 4 |
| Encrypted backups | Up to 35 days rolling | Expire automatically |
| Application and security logs | Up to 90 days | Deleted; redacted of sensitive values throughout |
| Audit trail entries | 7 years | Retained for accountability, then destroyed |
| Subscription and transaction history | As required by financial and tax law (typically 7 years) | Retained, then destroyed |
| Support correspondence | 24 months | Deleted |
| Email delivery diagnostics | 90 days | Deleted; customer-facing status is retained with the invoice |
3. Deleting your account
You can request account deletion from within the application. The request is confirmed, then the account enters a 30-day recovery window during which you can reverse it — this exists to protect you from a mistaken or malicious deletion.
Export your data before requesting deletion. Export is available from the application and includes your personal and business data in a portable format.
After the recovery window, data is destroyed from primary storage. Encrypted backups containing it expire on their own rolling schedule and are not restored to reinstate deleted data.
4. What survives deletion
Deleting a business or an account does not delete:
- subscription and transaction history required for our own financial and tax obligations
- security events connected to an active or historical abuse investigation
- audit entries recording administrative actions taken on the account
These are retained on the minimum basis necessary and are not used for any other purpose. We state this here rather than leaving it to be discovered after a deletion request.
5. How data is destroyed
Records are deleted from the primary database and from private blob storage. Storage is encrypted at rest, and destruction of the underlying media is handled by the cloud provider under its own certified processes. Deletion jobs are logged so that we can evidence that a request was carried out.