Retention, return and deletion

1. Periods with implemented cleanup

Visitor data has a retention limit of 30 days. Limited API error records have 14 days. The platform administration audit log has 365 days. Cleanup runs periodically, normally every hour while the worker is running, so physical deletion may take place after the limit has been reached.

This applies to the named datasets. Other operational logs, provider logs, database copies and backups require separately documented retention.

2. Cases, messages, attachments and drafts

Moving a case to trash hides it from ordinary views and allows recovery. Related messages and R2 objects are retained. This is a recovery workflow and does not by itself fulfil a request for permanent erasure.

Retention for active cases, customer profiles, message content, attachments and ordinary workspace logs must be determined through lawful customer instructions and documented standards. The AI draft setting defaults to 30 days. Automatic enforcement of this setting must be confirmed before it is stated as an actual deletion guarantee.

3. Accounts, sales and accounting documentation

Account and membership data must be retained for as long as necessary for the relevant access and any lawful documentation needs. Removing a member from one organisation is distinct from deleting the person’s account and data in other organisations.

Website contact enquiries, including contact and company details and the message, are retained for 365 days from creation. Older enquiries are immediately hidden from administration views and automatically deleted in bounded batches by the hourly cleanup job. A technical receipt containing a hash of the request’s idempotency key and its original acceptance time is retained without a fixed end date to prevent old repeated requests from recreating deleted content. The sections below describe backups and erasure before the deadline.

Statutory accounting documentation is retained under applicable rules, normally for five years after the end of the financial year for primary documentation. A privacy request cannot override statutory retention. Data retained for an obligation or legal claim must be limited to that purpose.

4. Requests and documented execution

Data subjects may contact their controller. The workspace’s authorised administrator may register and follow up privacy requests. Identity, scope, legal basis and any exceptions must be assessed before disclosure or deletion.

A request status change does not prove that data has been deleted from all stores. Execution must cover relevant tables, attachments, search data, queues, subprocessors and subsequent restores, with documentation of the outcome and any lawful exceptions.

5. Termination and data return

On termination, the customer chooses return or deletion under the data processing agreement. The customer may send the instruction to info@svarlane.no. Svarlane must verify the instruction and carry it out without undue delay. The scope, practical format, access during execution and any additional work with a lawful justification must be documented and disclosed to the customer.

Self-service CSV exports cover limited datasets and do not provide a complete export of all messages and attachments. A request for full return or permanent deletion must therefore be handled separately and confirmed after completion. Ending a subscription does not in itself trigger confirmed complete erasure.

6. Copies and backups

Retained copies must have restricted access and be used only for lawful recovery and retention purposes. Svarlane must clarify and document how relevant copies are covered by a deletion instruction, including necessary deletion by subprocessors. Deletion instructions must be applied again if an older copy is restored.

This overview specifies no quantified maximum backup period or guarantee of a particular time when all copies will be gone. In response to a deletion request, Svarlane must provide specific information about remaining copies, necessary retention and how they are deleted or expire. Routine backups confer no general right to extend retention beyond a lawful and necessary purpose.