​

Data Retention and Deletion Policy

​

1. Purpose

• SOC 2 Trust Service Criteria
• GDPR (General Data Protection Regulation)
• CCPA (California Consumer Privacy Act)
• Industry best practices

​

2. Scope

• Customer data (organizations and users)
• End user data (widget visitors)
• Conversation data (messages and sessions)
• Audit logs and system logs
• Backups and archives

​

3. Data Classification

​

3.1 Personal Identifiable Information (PII)

​

3.2 Sensitive Data

​

3.3 System Data

​

4. Retention Schedules

​

4.1 Customer Account Data

• “Active” means while the account/subscription is active
• 90-day grace period allows for accidental deletion recovery
• After grace period, data is permanently deleted (not just soft-deleted)

​

4.2 End User Data

• End users can request deletion at any time via their organization
• Anonymization preserves analytics while removing PII
• Organizations can configure shorter retention (product setting)

​

4.3 System and Audit Logs

• Audit logs must be retained for SOC 2 compliance (minimum 1 year, we use 7 for added security)
• Logs are archived to cold storage after 1 year for cost optimization
• Application logs can be extended if under investigation

​

4.4 Knowledge Base Data

​

4.5 Backups

• Backups may contain deleted data during retention period
• Backup retention is separate from primary data retention
• User deletion requests apply to backups created after the request

​

5. Data Deletion Procedures

​

5.1 User-Requested Deletion (GDPR Article 17 “Right to be Forgotten”)

1. Request Verification
   • Verify identity of requestor
   • Confirm authority to request deletion (org admin)
   • Log deletion request in audit log
2. Scope Determination
   • Identify all data associated with end user
   • Check for legal retention obligations
   • Determine if full deletion or anonymization
3. Deletion Execution
   • Delete from primary database
   • Delete from blob storage (files, images)
   • Delete from caches (Redis)
   • Mark for deletion in recent backups (within 30 days)
4. Verification
   • Confirm deletion completion
   • Document deletion in audit log
   • Notify requestor (within 30 days)

• Audit logs (for compliance)
• Aggregated analytics (anonymized)
• Data required by law or regulation
• Data involved in active legal proceedings

​

5.2 Automated Deletion (Scheduled Jobs)

// File: src/lib/data-retention/cleanup-jobs.ts

// Monthly job to delete expired data
export async function runRetentionCleanup() {
  // Delete old conversations (2+ years inactive)
  await deleteExpiredConversations();

  // Delete old end user profiles (2+ years inactive)
  await deleteInactiveEndUsers();

  // Archive old audit logs (1+ year old) to cold storage
  await archiveOldAuditLogs();

  // Delete very old audit logs (7+ years old)
  await deleteOldAuditLogs();

  // Delete expired sessions
  await deleteExpiredSessions();

  // Delete old agent debug logs (30+ days)
  await deleteOldDebugLogs();
}

​

5.3 Account Deletion

1. Grace Period (90 days)
   • Account marked as “pending deletion”
   • Data retained but inaccessible
   • Can be restored if requested
2. Hard Deletion (after 90 days)
   • All products deleted
   • All API keys revoked and deleted
   • All end user data deleted (or anonymized)
   • All conversations deleted
   • All knowledge sources deleted
   • All files deleted from blob storage
   • Audit logs retained (anonymized org reference)

​

6. Data Export (GDPR Article 15 “Right of Access”)

• User profile data
• All conversations
• All feedback
• Identity verification records
• Audit log entries (user’s own actions)

​

7. Legal Hold

1. Immediate suspension of deletion
   • Tag affected data with legal hold flag
   • Prevent automated cleanup jobs from deleting
   • Notify retention job to skip held data
2. Documentation
   • Log legal hold in audit log
   • Document scope and reason
   • Set review date
3. Release
   • Requires legal approval
   • Remove legal hold flag
   • Resume normal retention schedule

​

8. Third-Party Data

• Review third-party DPAs annually
• Ensure third parties comply with GDPR/CCPA
• Document data flows in data processing agreement

​

9. Monitoring and Compliance

​

9.1 Retention Metrics

• Total data volume by type
• Data age distribution
• Deletion request volume
• Deletion completion rate
• Cleanup job success rate

​

9.2 Audits

• Review retention policy adherence
• Spot-check deletion completeness
• Verify automated jobs running correctly

• Auditor reviews retention policy
• Auditor verifies deletion procedures
• Auditor samples data to confirm retention

​

9.3 Policy Updates

• Regulations change (new laws, updates to GDPR/CCPA)
• Business needs change
• Audit findings require changes
• Technology changes enable better practices

​

10. Responsibilities

​

11. User Rights

​

11.1 Right to Access (GDPR Article 15)

​

11.2 Right to Deletion (GDPR Article 17)

​

11.3 Right to Rectification (GDPR Article 16)

​

11.4 Right to Data Portability (GDPR Article 20)

​

11.5 Right to Restrict Processing (GDPR Article 18)

​

12. Implementation Checklist

• Create automated retention cleanup jobs
• Create user data export API endpoint
• Create user data deletion API endpoint
• Add legal hold functionality to database schema
• Create admin dashboard for retention metrics
• Set up monthly cleanup job scheduler
• Test deletion completeness (all related records removed)
• Document API endpoints for data rights
• Train support team on handling requests
• Create user-facing privacy policy
• Create data processing agreements (DPA) for customers