Retention schedule, legal holds, backup deletion timelines, trial expiry, data exports and tenant offboarding.
Maintain a live retention schedule by account, CRM record, booking, order, financial ledger, audit trail, message, call recording, transcript, image scan, website asset, consent proof, AI prompt/output, billing event, log and backup. Statutory accounting, fraud and litigation preservation exceptions require case-specific authorization.
A 14-day no-card trial moves to 72-hour activation grace; thereafter suspended, then provides a 30-calendar-day data export and recovery opportunity before eligible active records may be deleted. Do not promise deletion of every copy immediately or guarantee recoverability beyond the archive window.
Give authorized owners a structured export in reasonable interoperable formats where technically feasible, with audit of export scope, requester, timestamp, encryption, availability and expiration. Notify of records that cannot lawfully be deleted and their limited purpose.
Data classification
Maintain a live retention schedule by account, CRM record, booking, order, financial ledger, audit trail, message, call recording, transcript, image scan, website asset, consent proof, AI prompt/output, billing event, log and backup. Statutory accounting, fraud and litigation preservation exceptions require case-specific authorization.
Trial account timing
A 14-day no-card trial moves to 72-hour activation grace; thereafter suspended, then provides a 30-calendar-day data export and recovery opportunity before eligible active records may be deleted. Do not promise deletion of every copy immediately or guarantee recoverability beyond the archive window.
Account exit
Give authorized owners a structured export in reasonable interoperable formats where technically feasible, with audit of export scope, requester, timestamp, encryption, availability and expiration. Notify of records that cannot lawfully be deleted and their limited purpose.
Backups
The public Privacy Policy should remain understandable; this more detailed matrix can live in the Trust Center or DPA annex.
| Data class | Recommended policy | Notes |
|---|---|---|
| Active Customer Content | Subscription term | Customer controls data subject to module/legal limits |
| Expired trial / unpaid suspended workspace | 30-day recovery/export target | Engineering must confirm before publication |
| Backups | Up to 90-day rolling deletion target | Not used for ordinary live processing |
| Security/audit logs | Risk-based period, commonly 12–24 months | Exact period approved by Security/Legal |
| Billing/transaction/tax references | Legally/payment-provider required period | Avoid storing full card data |
| Support tickets | Operational + dispute/security period | Minimize sensitive attachments |
| Marketing suppression | As long as needed to honor opt-out | Minimal identifier + evidence |
| Consent evidence | Permission/dispute period | Immutable version/source/timestamp |
| Call recordings/transcripts | Customer-configured, jurisdiction-aware | Default to minimization |
| Applicant/HR/payroll | Customer-determined under employment law | Noxtill processor role |
| eSign evidence | Customer/legal retention requirement | Evidence may outlive editable document |
| AI prompts/outputs | Customer-configured/product necessity | Minimize provider retention |
A deletion workflow should distinguish:
- active canonical record deletion;
- soft-deletion/recovery period;
- legal hold;
- provider/subprocessor deletion request;
- backup expiry;
- anonymized/aggregated analytics that no longer identify a person; and
- audit/security records lawfully retained.
Noxtill should never claim “deleted instantly everywhere” if backup/vendor cycles make that untrue.