Data Retention Policy
KVKK art. 7 requires personal data to be erased, destroyed or anonymised once the reason for processing it has ceased; GDPR art. 5(1)(e) imposes the same storage-limitation duty. This policy collects, in one table, how long we keep each category and what happens at the end of the period.
1. Retention periods
| Data | Retention | At the end | Basis |
|---|---|---|---|
| Demo requests (name, company, email, phone, message, IP digest) | 12 months from last contact | Permanent deletion | Consent — the purpose has lapsed |
| Customer platform data (leads, captures, voice notes, card images, activities) | Subscription term + 30 days | Permanent deletion | MSA art. 6.5 · DPA art. 10.1 |
| User accounts and profiles | Same as customer data | Account and profile deleted | Contract performance ends |
| Automated backups | 7-day rotation | Drops out of rotation | SLA art. 6 |
| Error logs (carry no personal data; messages truncated) | 90 days | Permanent deletion | Legitimate interest — security and diagnostics |
| Usage events (quota counter; contains no personal data) | 24 months | Aggregated | Billing and capacity planning |
| Support session records | 24 months | Permanent deletion | Transparency and audit trail |
| Superadmin audit records | 24 months | Permanent deletion | Legitimate interest — accountability |
| Invoices, contracts and accounting records | Statutory period (as a rule 10 years) | Permanent deletion | Legal obligation |
| Tenant "tombstone" record (company name, date and proof of deletion only) | Same as accounting | Permanent deletion | To evidence the deletion itself |
2. How the 30-day window works
When a subscription ends the customer account is closed and a deletion date is recorded at that moment: closing date + 30 days. Those 30 days are the window in which the customer can export its data to Excel. At the end of the window the data is permanently deleted; deleted data leaves the backups within 7 days at the latest.
Because deletion is irreversible, it is carried out by an authorised operator and only after the company name has been typed to confirm. An account past its deletion date is flagged as overdue in the admin console and stays flagged until the deletion is completed.
3. Scope of a deletion
Permanently deleting an account removes all of the following:
- All leads, captures, activities and enrichment results,
- All events and event reports,
- Tenant configuration, invoices, usage events, error logs and support sessions,
- All team members — profiles and sign-in accounts,
- All storage objects — card images and voice-note files,
- Any encrypted-vault keys belonging to the customer.
Only the tombstone record required for billing and audit history is kept; it contains no lead data and no personal data.
4. Contract-specific periods
A customer may agree different retention or deletion periods under the Data Processing Agreement. Where it does, the period in the signed agreement replaces the default in this table. Absent such agreement, the periods above apply.
5. Early deletion and data-subject requests
For platform data the customer company is the controller. A trade-show visitor who wants their record deleted should address the request to the company they gave their card to; that company can delete the record from the platform. If a request reaches us directly, we forward it to the customer without delay and assist them technically in fulfilling it.
For data where Capleed is itself the controller — in particular demo requests — send your deletion request straight to kvkk@capleed.com; we complete it within 30 days.
6. Statutory retention prevails
Where tax, commercial or accounting law requires certain records to be kept, those records are retained for the statutory period notwithstanding a deletion request. In that case retention is limited strictly to the legal purpose and the data is used for nothing else.