Data Retention Schedule

This schedule sets out how long Straight2PDF keeps each kind of data. It should be read with our Privacy Policy, DPA and Pricing page.

Data type	How long we keep it
Form submissions (answers, photos, signatures and GPS location)	For as long as the company's account is open, unless the customer deletes them. The plan sets how far back they can be viewed and searched: 7 days on Free, 6 months on Pro and 18 months on Business. Older submissions stay stored and come back into view if the plan changes.
Deleted submissions	The answers, photos, location and PDFs are removed straight away. A short record that the submission existed, who deleted it and when is kept for the audit trail.
Generated PDFs and spreadsheets	Removed 8 days after they are made. They are rebuilt from the submission when needed.
Timesheet & HR records (timesheets, holiday requests and entitlements, sickness records)	6 years after the period they cover: the date worked, the end of the holiday, the leave year, or the end of the sickness absence. Open sickness absences are kept until they are closed.
Cancelled or downgraded accounts	A cancelled paid plan moves to the Free plan at the end of the period already paid for, and an expired trial moves to Free when it ends. Data stays stored; only the viewing window changes. For 30 days afterwards, the company can still view and export the submissions its previous plan showed, and the account owner is emailed when this starts and 7 days before it ends. To have the account and its data deleted, contact us.
Deleted accounts	When a company account is deleted, its users, forms, submissions, files and HR records are deleted at the same time. Edit logs are anonymised, and other logs are removed on their normal schedule above. Payment, policy agreement and audit records are kept as listed below.
User accounts	While the user exists. When a user is deleted, their sign-in details, two-factor settings and personal activity logs are deleted and their edit history is anonymised. Their past submissions and HR records stay with the company.
Billing and payment records	At least 6 years, as tax law requires. They are anonymised if the account is deleted.
Saved AI summary questions	12 months after they were last used.
AI Assistant requests	What is sent to the AI provider is not stored by Straight2PDF. A usage record (date, user and credits used) is kept while the account is open.
Access logs (sign-ins, API events) and API activity log	90 days.
Account activity logs	90 days.
Page visit analytics	90 days.
Document edit and audit logs	365 days.
System error logs	365 days.
Rate-limit records	2 days.
Mobile sign-in sessions	30 days after the session expires.
Two-factor fallback codes	1 day after the code expires.
Policy agreement records and admin action audit log	For as long as the company's account is open. After the account is deleted, removed once they are 6 years old.
Data breach register	Closed incidents are removed 6 years after they were detected.
Contact form enquiries and support emails	Up to 2 years after the last message.

Customer deletion requests

Customers can ask us to delete their account and data, or for an export, by contacting us. We will handle requests in line with our contractual obligations, applicable law and any legal retention requirements.

Backups

We keep the five most recent encrypted backups of the database and of customer files on the main server, which covers about five days. Each night our host, 24host.uk, also keeps a copy on a separate server in the UK for 30 days. Deleted data drops out of backups once those copies are replaced, so within 30 days. Backups are never used for normal customer access.