Legal
Data Retention & Deletion Policy
Purpose
Defines retention periods and deletion procedures for data processed across Services.
Scope
Account data, conversation logs, model training data, infrastructure logs.
Definitions
Retention Period; Verifiable Unlearning (see Privacy Policy, Doc. 1).
Policy Statements
Account data retained for account life plus 30 days. Conversation/usage logs retained up to 24 months unless opted out or deletion requested earlier — opt-out and deletion requests now trigger the Verifiable Unlearning process defined in the Privacy Policy, not just storage-layer deletion. Security/audit logs retained 12 months. Enterprise customers may configure custom retention windows. Deleted data purged from production within 30 days, backups within 90 days.
Responsibilities
Privacy and Security jointly own retention schedules; Engineering implements automated deletion and unlearning pipelines.
Compliance Requirements
Complies with GDPR storage limitation principles and legal holds; unlearning pipeline audited semi-annually.
Enforcement
Systems failing deletion SLAs flagged for remediation and audit.
Reporting Process
Exceptions Process
Legal holds may override standard timelines with Legal approval.
Review Process
Every 6 months.
Contact Information
Related Policies
This policy references
Referenced by
None
