Attorney-review draft — not legally approved
This document has been drafted but has not been reviewed by a lawyer. It is published here so you can see our intent and so counsel can review it. It is not a final agreement, and EveryContact Technologies, Inc. does not represent it as legally approved or enforceable.
Retention and Deletion Policy
How long data is kept and how deletion works.
Draft prepared for review · EveryContact Technologies, Inc.
Default retention
Conversation transcripts and messages: 730 days.
Closed leads: 1,825 days (five years).
Call event records: 365 days.
Consent records: 2,555 days (seven years) — deliberately longer, because they are the evidence that messages already sent were authorized.
Audit logs: retained for the life of the account.
These are configurable per business, except the consent-record minimum.
Deletion requests
A business can request deletion of a specific contact’s data, or of the whole account.
Deleting a contact removes their profile, conversations and messages. Consent records are retained with identifiers redacted, because deleting the evidence of a lawful message does not make the message not have happened.
Account deletion removes all business data after the retention period, except audit and consent evidence required for compliance.
Export
A business can export its conversations, leads, appointments, contacts, consent records and knowledge base as structured data.
Exports exclude encrypted third-party credentials and provider cost data.
Backups
Database backups are retained by our database provider according to their policy. Deleted data may persist in backups until those backups expire.
[ATTORNEY REVIEW REQUIRED: whether backup persistence must be disclosed more specifically, and whether it affects deletion-request compliance.]
Open questions for counsel
Published deliberately. These are the points we know we cannot resolve ourselves, listed so a reviewer can start with them rather than discover them.
- Whether retaining redacted consent records after a deletion request is permissible under applicable state privacy law, and how to characterize the lawful basis.
- Whether the 7-year consent retention is correct relative to the TCPA statute of limitations.
- Required deletion-request response deadlines by jurisdiction.
- Whether backup retention periods need to be contractually specified.