Data Retention

We retain your data only for as long as it's needed to provide the service or meet legal requirements. Here's a clear breakdown:

Account & profile data

Retained while your account is active. When you or your provider deletes your account, all personal data is permanently removed within 30 days.

Files & file versions

Retained while your account is active. When a file is deleted, the current version and all previous versions are permanently removed from our storage. When a client account is deleted, all of their files are automatically removed.

Form responses

Retained while your account is active. Deleted automatically when your client account is removed by your provider.

Activity logs

Access logs (login events, file uploads, downloads) are retained for 12 months for security and audit purposes, then permanently deleted.

Email notifications

Delivery logs are retained for 6 months by our email provider (Mailgun), then automatically purged.

Analytics data

If you've consented to analytics cookies, Google Analytics retains event data for 2 months. IP addresses are anonymized and no personal identifiers are stored.

Billing data

Payment records are managed by Stripe and retained for 7 years as required by tax and accounting regulations. Credit card details are stored exclusively by Stripe and never touch our servers.

Affiliate & referral data

Affiliate account records are retained while the affiliate account is active. Referral tracking records are retained for 24 months for attribution and analytics. Commission and payout records are retained for 7 years as financial records, consistent with billing data.

Backups

Database backups are automatically rotated on a rolling basis (7–30 days depending on infrastructure plan). Deleted data is removed from backups as they rotate out.

After deletion

When data is deleted from The Client Space:

• Database records are permanently removed (not soft-deleted or archived)
• Files in storage are permanently deleted from Cloudflare R2
• Authentication credentials are removed from our auth provider
• Backup copies are overwritten as backups rotate (within 7–30 days)

We do not retain anonymized or aggregated copies of deleted customer data.

Your rights

You can exercise your data rights at any time:

• Download your data — Available in your Account Settings under "Data & Privacy"
• Request deletion — Available in your Account Settings, or contact your provider
• Manage cookies — Adjust your preferences via the cookie banner or Account Settings

For any questions about data retention, contact [email protected].