Data protection
Data Retention Policy
How long Spifex keeps personal data, workspace records, logs, cookies and backups, and how deletion works.
Last updated:
This Data Retention Policy explains how long Spifex keeps personal data and customer workspace data, and how deletion works. It should be read with the Privacy Policy and the Data Processing Agreement.
Retention periods are based on the purpose of processing, contractual commitments, security needs and legal obligations. Actual periods may vary depending on the workspace configuration, the customer’s instructions and applicable law.
Retention schedule
| Data category | Typical retention | Reason |
|---|---|---|
| Account and profile data | Duration of the account, then deletion or anonymization | Provide access and manage the relationship |
| Workspace and financial records | Duration of the subscription, then customer-controlled export or deletion | Provide the service and preserve the customer’s records |
| Billing and tax records | As required by applicable tax and accounting law | Legal obligation and audit |
| Support communications | Up to 3 years after the request closes | Resolve issues and improve support |
| Security and audit logs | Up to 24 months, unless needed for an investigation | Security, abuse prevention and audit |
| Website analytics and attribution | Up to 180 days, or as described in the Cookie Notice | Measure campaigns and improve the website |
| Cookie consent records | Up to 180 days | Demonstrate consent choices |
| Backups | Normal backup cycle, then automatic deletion | Resilience and recovery |
| Legal claims and disputes | Until the matter is resolved plus the applicable limitation period | Establish, exercise or defend legal claims |
Customer workspace data
For business workspaces, the customer controls much of the data in its workspace. The customer can:
- export workspace data during the subscription;
- delete records through product features where available;
- configure retention or archive settings where offered; and
- request deletion at the end of the agreement.
When the agreement ends, Spifex will delete or return customer personal data as described in the DPA, unless law requires continued storage. The customer is responsible for exporting data before the end of any transition period.
Deletion from backups
Deleted data may remain in backups until the normal backup cycle expires. Backup data is protected, access-restricted and not used for other purposes. Backup copies are deleted or overwritten according to the backup schedule.
Legal holds
We may retain data longer when required by law, a regulatory request, a court order, an investigation or the establishment, exercise or defense of legal claims. Access to retained data is limited to those who need it for the relevant purpose.
Aggregated and anonymized data
We may retain aggregated or anonymized information that cannot reasonably identify an individual. This data may be used for analytics, capacity planning, security and product improvement.
Customer responsibilities
Customers are responsible for:
- setting appropriate retention in their workspace;
- exporting data they need to keep;
- ensuring their own retention obligations are met; and
- not submitting data that they are not authorized to keep.
Requests
To request deletion or ask about retention:
- Privacy: privacy@spifex.com
- Legal: legal@spifex.com
We may need to verify your identity or authority before acting on a request.