| Owner | Jonny Allum (Data Protection Lead) |
| Version | 1.0 · Effective 13/07/2026 · Review annually (July) |
| Applies to | All data held by JonnyAI as controller and processor |
1. Retention schedule
| Data | Retention | Rationale |
|---|---|---|
| Tenant workspace data (processor) | Life of subscription + 90 days grace after termination, then deleted (SOP-10). Export offered before deletion. | Room to reactivate or export; then the processor duty to delete |
| Platform account data (controller) | Life of account + 90 days | Contract |
| Billing/invoice records | 6 years from end of financial year | UK tax law (HMRC company records) |
| Contracts, DPAs, engagement records | 6 years after termination | Limitation period |
| Prospect/CRM data | 2 years from last meaningful contact, then delete or re-permission | Legitimate interests, kept honest |
| Marketing consent records + unsubscribes | Life of the list; suppression entries kept indefinitely | Proof of consent; honouring opt-outs forever |
| Platform audit logs (C05) & operational events | Life of tenancy (they belong to the tenant's record) | Tenants' own compliance evidence |
| Server logs (Caddy/PM2) | 90 days rolling | Security investigation window |
| Incident records | 6 years | Insurance, diligence |
| Backups | Provider cycle (see SOP-06); deleted data ages out of backups within that cycle | Restore capability without indefinite ghosts |
The platform's own retention features (e.g. X10's 2-year waste-transfer retention, H10's 6-year HMRC vault suggestion) implement each tenant's retention duties inside their workspace — this policy governs JonnyAI's own copies and infrastructure.
2. Deletion standards
- Deletion means removal from live systems within 30 days of the trigger, with backup copies expiring on the normal backup cycle.
- Erasure requests (POL-02 §4) targeting specific individuals inside a tenant workspace are executed on the tenant's instruction, using targeted deletes, and confirmed in writing.
- Decommissioned hardware is wiped (full-disk encryption + key destruction is sufficient).
3. The "keep less" rule
New features default to storing the minimum: derived values are computed at read time rather than duplicated (the platform's house pattern), and any new long-lived personal data field must justify itself in the feature's DPIA note (POL-02 §6).