Data retention and deletion policy

By default, submissions, signed records and uploaded documents are kept while the account is active.

An Owner can instead choose a retention period of 1, 3 or 7 years (any whole number up to 30). Once a submission has been signed for that long (or created, if never signed) it is deleted automatically each day. The Owner can choose to keep an encrypted copy of the signed PDF, which stays downloadable until the account is deleted.

An Owner can export every record at any time: signed PDFs, uploaded documents, and CSV files of every answer. Individual submissions can also be exported as CSV and PDF.

• The account becomes read-only straight away, and unsigned Magic Links stop working.
• Owners keep read-only access for at least 30 days to download their records.
• Owners are emailed reminders before the deletion date.
• Submission data and uploaded documents are permanently deleted 90 days after cancellation.

Documents and form answers are removed. A minimal record of the submission is kept as an audit entry so the history of what was sent and when is not lost.

Magic Links expire after seven days. After signing, the client receives a secure link to download their own copy; it expires after 30 days.

Deletion applies to the live system. Backups (see the backup policy) are not edited: deleted data ages out of the nightly backups within six months, and pre-release backups taken earlier are kept as they were taken.