Data Retention and Deletion Schedule
How long we keep data
| Data | Kept for | Then |
|---|---|---|
| Raw position pings | 12 months | Deleted. A summary by area and hour, with no names, may stay for forecast checks |
| Sensor observations | 24 months | Same |
| Condition reports | 24 months | Same |
| Consent records | Life of the account plus 7 years | Deleted |
| Audit log | 7 years | Deleted |
| Breach records | 24 months from the date the breach was determined | Deleted |
| Device sessions | Until revoked, or 90 days idle | Deleted |
| Webhook events | 30 days | Deleted |
| Backups | 35 days | Overwritten |
Note: [LAWYER: confirm] every period in this schedule. They are proposals. A legal hold, such as a claim or an investigation, can keep records longer.
Exporting your data
You can export everything you own from your account page. Choose Download my data. The file covers every group you belong to, and it downloads straight away so you can keep it. [LAWYER: confirm.]
Deleting your account
- On your account page, choose Delete my account and type DELETE to confirm.
- Your positions, sensor readings and condition reports are deleted within 30 days.
- Consent records and the audit log stay for the periods above. We remove free text from them.
- Your sign-in account is deleted last.
- If you are the only fleet admin for your group, the group must name another one first.
When a group leaves
A group can stop using the service at any time. The fleet admin can export the group's shared data. Each person in the group still has the right to export or delete their own data. Group data that is not personal, such as the group's settings, is deleted when the group's agreement ends. [LAWYER: confirm the timing.]
Backups
Backups are kept for 35 days and then overwritten. Deleted data can remain in a backup until it is overwritten. If we ever restore from a backup, we will delete again anything you had asked us to delete. [LAWYER: confirm this wording.]
Questions: [PRIVACY CONTACT EMAIL].