Deletion policy

• raw events: according to the retention chosen by the tenant, within their plan between 30 and 1,095 days; default 180 days
• derived journeys, touchpoints and attribution shares: for as long as the underlying raw events exist
• conversions and ad spend: until the end of the commercial and tax retention period, where they form part of the tenant’s accounting
• log data: for as long as the tenant exists; a log with an expiry date proves nothing
• website server logs: 7 days
• chat on the website: question, course of the case and any email address given, 30 days after the last message; for a recurring support case, 365 days after the last message
• account and contract data: until the end of the statutory retention periods after the contract ends

The person is looked up through a pseudonymous identifier — journey identifier, order number, case number or pseudonymised customer identifier. The “Privacy” area in the product shows in advance how many records are affected.

Identity links, journeys, touchpoints, conversions and raw events for that identifier are deleted.

Aggregated figures remain if they no longer carry a personal reference — and only then. That recalculating would be expensive is not a reason to keep anything. A total for one day and one channel says nothing about an individual; a row with the value one would be closer to an event than to a statistic. In reach measured without consent, sources therefore appear individually only from five views upwards, smaller ones are pooled into a single row, and the count expires on the same schedule as the events themselves.

An erasure without lasting effect would be a snapshot: the next event from the same browser would recreate the person under a new identifier. For an objection this weighs heavier than for an erasure — someone who objects to processing does not want to be processed again a minute later.

The identifier is therefore suppressed. Only a checksum is stored, not the value itself. If it were held in clear text, the suppression list would be exactly what it is meant to prevent: a new set of personal data, created on the occasion of an erasure.

A suppression can be lifted, for example if the same person consents again later. The action remains in the log with its time and the person who carried it out.

After termination the data remains available for export for 30 days and is then deleted — measurement data, campaigns, settings, the log, and the accounts that belong to no other tenant. The deletion runs automatically and leaves a record of when it happened and how many rows were removed; that record holds no content.

Backups expire on their own cycle; they are not searched selectively to remove individual records. The last 14 daily backups – around two weeks – and seven days of transaction log are kept; if a backup is restored, the erasures and objections since the time of the backup are carried out again before release. Statutory retention periods for accounting records are unaffected — what must be kept is blocked for every other use. Our invoices to you are among them; they are our own accounting records and not part of the data we process on your behalf.

Backups are not searched. That has a consequence we name rather than work around: restoring a backup also brings back what was deleted in the meantime. The suppression list lives in the same database and is then at the state of the backup too. So that an erasure stays an erasure, every erasure and objection request since the time of the backup is carried out again before a restored database is released; those requests are held outside the database. Only then does the service accept data again.

The analytics mirror for large-scale reporting is enabled per tenant and holds no direct identifiers. Deletions reach it: whatever disappears from the database is recorded at deletion time and carried over to the mirror — including rows that were not deleted directly but hung from a deleted record.

Test data lives in its own environment, enters no report, and can be reset in full at any time under Tracking setup.