Data retention
We keep data only as long as it's useful to you or required by law. Most categories can be deleted on-demand from the app. The schedule below is the default — your organisation can tighten any customer-configurable category from Settings → Security & Privacy.
| Category | Retention | Trigger |
|---|---|---|
| Organisation and all its data | Until the owner requests deletion, then a 30 day grace period | An owner requests deletion in Settings → Data A reminder email is sent 2 days before the deletion runs, so an accidental request can be cancelled during the grace period. |
| Your individual account | Until you delete it. Removal is immediate, with no grace period | Delete my account in Settings → Security This removes you from your organisation and erases your own meeting transcripts. It does not delete the organisation or its records, and your sign-in identity is currently retained: contact us to have it erased. |
| Platform records (companies, contacts, deals, notes, tasks) | Until the customer deletes them, or until the organisation is deleted | Per-record delete, or organisation deletion A deleted record is recoverable for 30 days, then permanently removed by a daily job. |
| Email messages (Gmail / Microsoft sync) | Per customer setting — default unlimited, configurable 30/90/365 days | Daily retention cron |
| Meeting transcripts (raw text) | Per customer setting — default keep forever, configurable 30/60/90/180/365 days | Nightly transcript-retention cron The AI extraction is erased at the same time as the raw text. It reconstructs the same meeting, so keeping it would not be a deletion. |
| AI extraction outputs | Same as the parent record | Platform record deletion |
| Audit log | For the life of the organisation | Deleted with the organisation Kept for forensic and compliance purposes and never deleted by user action. We do not currently run a scheduled purge, so entries persist for the life of the organisation. |
| Billing records (invoices, payment history) | 10 years | Legal requirement (Belgian commercial law) Stored by Stripe; we only retain Stripe customer IDs and invoice references. |
| Server logs | 30 days | Vercel platform retention policy |
| Webhook event log (stripe_events, webhook_events) | 180 days | Deleted with the organisation, and purged daily after 180 days Used for replay during incidents and for idempotency. Payment event records are deleted outright. Provider event records keep only their delivery id, so a resent webhook is still recognised as a duplicate, and the message content itself is erased. |
| Data export files (the ZIP you download) | 7 days | Daily purge, and deleted with the organisation An export is a complete copy of your data, so it is kept only briefly. The download link itself expires after 24 hours; ask us for a new one while the file is still there. |
| Uploaded files (import spreadsheets, term sheets, logos) | Until you delete them, or until the organisation is deleted | Organisation deletion. Import spreadsheets are removed within 24 hours of upload Removed from file storage as well as from the database when an organisation is deleted. |
| Profile picture | Until you replace or remove it | You change it in Settings Your avatar belongs to you rather than to a company, so it is kept if an organisation you belong to is deleted. Remove it from your profile to erase it. |
| Backup snapshots | 30 days (daily PITR) | Supabase platform rotation Required for disaster recovery; deletion requests are honoured by re-running deletions after restore. |
Need a custom retention period for an enterprise contract? Email dpo@michiplatform.com.