1. Principles
We keep data only as long as it is needed for the Service, for the customer’s legal obligations, or for our own. Customers can change some of these periods in their settings where the Service allows it.
2. Customer Data (we process it for the customer)
| Data | Kept |
|---|---|
| All Customer Data while the subscription is active or read-only | For as long as it lasts |
| After the subscription ends | Read-only for 90 days for export, then deleted from live systems within 30 days |
| Database backups | Rolling 35 days, then overwritten |
| Payroll, pay and statutory deduction records | The customer decides; we recommend at least 7 years, in line with record-keeping for tax and national insurance |
| Attendance and time records | The customer decides; we recommend at least 6 years |
| Audit trail | For the life of the organisation’s data, because it proves the integrity of the records |
| Client contacts and leads | Until the customer deletes or erases them; erasure on request is available |
3. Data we control
| Data | Kept |
|---|---|
| Sign-in sessions | Expired sessions deleted after 30 days |
| Sign-in attempts and rate-limit records | 90 days |
| Unconfirmed sign-up requests | 30 days |
| Request replay protection records | 7 days |
| Delivered notification messages | 90 days |
| Invoices, payments and accounting records | 7 years after the end of the financial year |
| Platform audit trail | 7 years |
| Records of which Terms and Privacy Notice versions were accepted, when and from where | 7 years after the account closes |
| Application and security logs | 90 days |
| Sales and support records about business contacts | Up to 3 years after the last contact, unless the person is a customer contact |
4. Deletion
Automatic clean-up runs daily for the transient records above. Deletion of an organisation after the 90-day export period is carried out by the platform operator with a recorded, two-step procedure.