# Data Retention Schedule, Annex 2 to the Terms of Service

 

Subscription status changes and automatic deletion of Organizations work once they are switched on in the Service.  Version 1.3. Effective from 2026-11-01.

## 1. Organization Content (the customer is the controller)

| data | period | how deleted |
|---|---|---|
| plans, prompts, epics, projects, comments in plans, questions and answers, generation requests | as long as the Organization or the project | deletion in the Service (plan, prompt, project) or with the Organization |
| version history of plans, prompts and the project template (the previous content with its author, time of saving and note) | the last 100 versions together with the appended sections (notes, questions, answers), and in addition always the oldest version and the version from a day before; no longer than the plan, prompt or project | with the plan, prompt or project; an Organization Administrator can delete all versions of a plan or prompt except the newest, but a single version cannot be deleted in the Service (Annex 1 § 8(2))  |
| source material of a capture session (pasted text, uploaded document) | three modes to choose from: (a) as long as the project; (b) deletion right after a plan has been successfully generated; (c) a maximum age from 1 day up to the upper limit we set (365 days by default), counted from the last use; until the Organization chooses a mode: 90 days from the last use, and the material of a session that produced a plan not yet realized waits for that plan to be realized, at most up to the upper limit | (a) with the project or on request; (b) after generation; (c) and without a chosen mode: the next time the hourly deletion runs; always with a register entry (reason: on request, after generation, retention, failure)  |
| the capture session record after its content has been deleted (identifier, project, author, kind of source, name and type of the uploaded file, size, time, reason for deletion; without content) | as long as the project | with the project or with the Organization  |
| integration settings and secrets (Slack) and model settings | as long as the integration or the Organization | hard |

## 2. Data of which featureloom is the controller

| data | period | how deleted |
|---|---|---|
| a person's account | until the account is deleted at the person's request (help@ or privacy@featureloom.com), carried out within 30 days; we delete an account with no Organization 12 months after it lost its last Organization, with an email 14 days in advance | hard; an unfinished two-step sign-in setup expires after 10 minutes, and its protected secret stays until the next attempt or until two-step sign-in is switched off  |
| the version of the Terms and the moment of its acceptance when an Organization is created or an invitation is accepted | as long as that person's membership of the Organization | with the membership or with the Organization  |
| sign-in session (protected token, shortened IP address, browser name) | 14 days from signing in or 3 days without use; the record of an ended session 90 days after its end | deleted automatically  |
| invitation (email, role, language, state) | the link 14 days; the record 90 days after expiry, use or revocation | deleted automatically  |
| password reset | the link 24 hours, single-use; the record 90 days after its end | deleted automatically  |
| sign-up request | the link 24 hours; the record 7 days after its end | deleted automatically  |
| sign-in steps in progress (Google, passkey, two-step sign-in) | 10 minutes (Google, two-step sign-in setup), 5 minutes (passkey, the code step of two-step sign-in); the step's record is deleted after expiry | deleted automatically  |
| a person's console with an `flc_` key (name, protected key, expiry dates) | 90 days from being issued and 14 days without use; the record of a disconnected or expired console 90 days after its end; a console that has signed something in the Service stays as an author name without a working key | deleted automatically  |
| a person's console through OAuth sign-in (name, program, OAuth client name, person, expiry dates) and its tokens | access at most 90 days from consent, it expires after 30 days without use; the tokens are deleted after its end; the console record stays until the person deletes it, and the record of a console that has signed nothing, 90 days after it stops working; a console that has signed something stays as an author name | record: the person, the daily deletion (unsigned console) or deletion of the Organization  |
| automation key | from 1 to 180 days (90 by default); the record of a revoked or expired key 90 days after its end | deleted automatically  |
| places where consoles and keys are used (shortened IP address, program name, day) | 90 days | deleted automatically  |
| trial trace (a marker derived from the email address, without the address itself; date) | 24 months from taking the trial | deleted automatically; earlier at the person's request  |
| the subscription in the Organization, its history and the register of subscription emails sent | as long as the Organization; the person's identifier is cleared when their account is deleted | with the Organization  |
| model balance ledger | as long as the Organization; before deletion available for download in the export; after deletion only the closing balance stays in the deletion register | with the Organization  |
| withdrawal from the contract recorded in the application | as long as the Organization; the person's identifier is cleared when their account is deleted; a statement submitted by email or by post: as correspondence | with the Organization  |
| register of payment events (identifier and kind of the event, identifier of the Organization and of the object at the Intermediary, result of handling, time; without the content of the event) | 13 months | deleted automatically  |
| an Organization in read-only mode (after a trial, after cancellation, after withdrawal from the contract for a subscription, after non-payment) | 90 days, but no less than 14 days from the deletion-notice email; then 7 days of waiting and deletion the next time automatic deletion runs; a purchase or a request by an Organization Administrator stops the deletion; we do not delete an Enterprise Organization automatically, only manually after agreement | deleted automatically, the whole Organization in one deletion  |
| an Organization deleted at an Organization Administrator's request | after the export has been downloaded or waived, within 14 days at the latest, and when the Organization is closed in the app, after 30 days from the confirmation (after 27 days when we delete the account together with it); on a request made outside the app, we state the amount of the balance at the moment of deletion in the reply, and we keep that reply as data for the defence of claims (last row of the table) | manually; when closed in the app, automatically  |
| Organization deletion register (the Organization's identifier as a pseudonym, source, plan, closing balance with currency, row counts per table, the dates of the warning and of the deletion; without the name, addresses and content) | 6 years with a positive balance, 3 years with a zero or negative one, from the end of the year in which the Organization was deleted (limitation of claims) | after the period  |
| sign-up origin and product statistics (without the name and addresses) | throughout the existence of the Organization; after its deletion at the longest until 26 weeks and 31 days have passed from the later of the dates: the creation of the Organization or its cancellation that was not reversed | deleted automatically every hour  |
| limiting sign-in attempts, sign-ups and password resets (the email address from the attempt, counter, time) | counted for 15 minutes, for sign-up also for 24 hours; the entry stays at the longest until a server restart | automatically  |
| counters of sign-ups, password resets and invitation emails per address (a marker derived from the email address, without the address itself; number, time) | at most 49 hours | deleted automatically every hour  |
| log of our proxy server | access entries: about 4 days, and less under heavy traffic; error entries: its shared log, limited in size | deletion at rotation and overwriting  |
| log of our application, with an IP address in some of the entries | at most 14 days | deleted automatically  |
| mail delivery log (recipient's address, time, result; without content) on our own mail server | 30 days | deleted automatically  |
| database backups (with Organization Content): automatic nightly backups | at most 6 months | overwriting in the cycle  |
| manual database backups before a migration and before the deletion of an Organization on request | at most 6 months after being made | manually or automatically  |
| correspondence (help@, privacy@: email, content) | until the matter is closed and 12 months after that; in the event of a dispute until it ends | manually |
| billing documents (Enterprise invoices, the Payment Intermediary's settlements, purchase data in the Intermediary's dashboard) | 5 years from the end of the calendar year in which the tax payment deadline passed | after the period |
| data for the establishment, exercise and defence of claims: billing documents, correspondence and the deletion register | until the limitation period expires (6 years, for claims connected with business activity 3 years, until the end of the year) | restriction of processing |

## 3. Accompanying rules

1. Deletion of source material and of an Organization is irreversible apart from the backup in its cycle (at most 6 months); we do not use backups to restore data deleted on request.
2. A shortening of the source material period by an Organization Administrator works retroactively: the next time automatic deletion runs, we delete material older than the new period; the shorter of the Organization's period and our upper limit is the effective one.