Data Retention Schedule
Version: 0.1-draft Effective date: not yet in force (draft) Status: Draft pending review by a qualified Romanian lawyer before use. Periods marked [TBC] are proposed defaults that the founder must confirm against the Platform's actual behaviour. Statutory periods marked [verify] must be confirmed with the Company's accountant or lawyer.
1. Purpose and scope
1.1. This schedule sets out how long ALTTAB PROFIT SRL (the "Company") keeps each category of data processed in connection with the 1ads platform (the "Platform") and the website https://1ads.net. It also sets out how the data is deleted and why it is kept.
1.2. It covers: (a) data the Company processes as controller (Schedule A), as described in the Privacy Policy (privacy-policy.md); (b) Customer Data the Company processes as processor on behalf of the Customer (Schedule B), under the Data Processing Agreement (data-processing-agreement.md, the "DPA"); (c) retention limits imposed by Third-Party Platforms (Schedule C); and (d) system copies such as backups and logs (Schedule D).
1.3. Capitalised terms have the meaning given in the DPA and the Terms of Service (terms-of-service.md).
2. Principles
2.1. Storage limitation. Personal data is kept only for as long as necessary for the purpose for which it is processed (Article 5(1)(e) GDPR), or for as long as the law requires.
2.2. The shortest limit wins. Where more than one rule applies to the same data (for example a Customer setting and a Third-Party Platform limit), the shortest retention period applies, unless the law requires the data to be kept longer.
2.3. Customer control. For Customer Data, the Customer decides on retention within the options the Platform offers. The Customer can delete data at any time, subject to Section 9 (exceptions and legal holds).
2.4. End of the Agreement. When the Agreement ends, Customer Data can be exported for 30 days (the "Export Window", Section 25.2 of the Terms of Service). It is then deleted from active systems within 30 days, and remaining backup copies expire no more than 14 days after that (DPA, Section 16).
2.5. Automation. Retention periods are enforced by scheduled deletion jobs wherever possible, not by manual processes.
3. Deletion methods
| Code | Method | Description |
|---|---|---|
| DEL-1 | Hard deletion | Records are deleted from the active PostgreSQL databases [TBC: and from file storage, if a file store is introduced for uploads and creatives], and the storage is reclaimed by routine database maintenance. |
| DEL-2 | Automated expiry | A scheduled job deletes records when they reach the end of their retention period. |
| DEL-3 | Anonymisation or aggregation | Personal data is removed irreversibly, and only aggregated or anonymous metrics are kept (for example total revenue per campaign and day). |
| DEL-4 | Token deletion and revocation | The encrypted OAuth token is deleted, and the Platform asks the Third-Party Platform to revoke it where that platform's API allows. |
| DEL-5 | Backup expiry | Database backups are nightly logical dumps, encrypted with age (X25519) before they are written to network storage in the same facility. They are kept for no more than 14 days and then deleted automatically (each night, the backup job deletes dumps older than 13.5 days) [TBC – confirm first successful backup and restore]. Backups are used only for disaster recovery. If a backup is restored, deletions made after the backup was taken are applied again before the data is used. |
| DEL-6 | Provider-side deletion | Data held by a sub-processor is deleted under that sub-processor's agreement with the Company (see subprocessors.md), or on the Company's request when a connection is removed. |
| DEL-7 | Archive deletion | Documents kept for legal reasons are kept in a restricted archive and deleted securely when the legal period ends. |
4. Schedule A – Data processed by the Company as controller
| # | Data category | Examples | Retention period | Deletion method | Legal basis / source |
|---|---|---|---|---|---|
| A1 | Access requests (closed access program) | Company, website, contact name, work email, role, country, organisation type, ad-spend band, platforms used, number of clients, goal, locale, privacy-notice version, version of the Access Program Terms accepted and submission date and time (record of that acceptance), marketing consent (optional, unticked); the link to an ROI estimate, if the request was sent with one (A18); review status and notes; the internal notification sent to the sales team | If approved: becomes part of the customer relationship (account data and customer contact data, A2–A5). If rejected, waitlisted or withdrawn: deleted 12 months after the decision (for a waitlisted request, after it was placed on the waitlist; for a withdrawn request, after the withdrawal was recorded) by an automated job, so that repeat requests can be handled consistently. If never decided: deleted 12 months after submission by the same automated job. The pseudonymised IP hash and the user agent are deleted earlier, after 30 days (A17). The copy of the internal notification in the sales mailbox is deleted on the same schedule [TBC] | DEL-2 | Art. 6(1)(f) GDPR (selecting business customers, preventing fraud, managing the access program); Art. 6(1)(c) (sanctions screening); Art. 6(1)(b) only where the Applicant is an individual acting in their own name |
| A2 | Customer contact and signatory data | Names, roles and contact details of contacts and Order Form signatories | Term of the Agreement plus 3 years (general limitation period, Art. 2517 Romanian Civil Code), or longer if contained in documents under A4 or A5 | DEL-1 / DEL-7 | Art. 6(1)(f) GDPR; Art. 6(1)(b) where the person contracts in their own name |
| A3 | Authorized User account data | Name, email, role, identity-provider and SSO identifiers, MFA enrolment status, preferences | While the user is active. Deleted within 30 days after the user is removed or, at the end of the Agreement, after the Export Window. Pseudonymised references in audit logs are handled under A8 | DEL-1 | Art. 6(1)(f) GDPR; Art. 6(1)(b) where the person contracts in their own name |
| A4 | Signed contracts | Order Forms, amendments, signed DPAs, express-acceptance statements; for Pilots, the Pilot estimate (Order Form, Annex E-1), the signed baseline summary and the measurement report | Term of the Agreement plus 5 years after it ends. This covers the limitation period and the accounting retention period where the contract is a supporting document [verify] | DEL-7 | Art. 6(1)(c) GDPR (Law no. 82/1991); Art. 6(1)(f) (establishing, exercising or defending legal claims) |
| A5 | Invoices and accounting records | Invoices (including RO e-Factura XML files and validation messages), payment confirmations, usage statements supporting invoices, accounting registers | 5 years from 1 July of the year following the end of the financial year in which the document was drawn up (Art. 25 of Law no. 82/1991, as amended by Law no. 36/2023) [verify]. Annual financial statements: 10 years [verify]. Where a tax audit or dispute is open, until it is closed, within the limitation periods of the Fiscal Procedure Code (Law no. 207/2015) | DEL-7 | Art. 6(1)(c) GDPR (Law no. 82/1991; Law no. 227/2015 Fiscal Code; Law no. 207/2015) |
| A6 | Usage and metering data | Counts of AI credits, automation runs, API calls and seats, per tenant and user; the Credit Cap in force, packs opened and credit alerts sent | Term of the Agreement plus 3 years. Totals used for invoicing are also kept with the invoices under A5. Aggregated, non-identifying statistics may be kept longer | DEL-2, then DEL-3 | Art. 6(1)(b) GDPR (billing); Art. 6(1)(c) (supporting documents); Art. 6(1)(f) (capacity planning, abuse prevention) |
| A7 | Support communications | Tickets, emails, call notes | 3 years after the ticket is closed | DEL-2 | Art. 6(1)(b) and (f) GDPR |
| A8 | Audit logs | Pseudonymised record of sign-ins, permission changes, Credit Cap changes, AI proposals, approvals, executed changes, publications, exports, deletions and administrative access | Visible to the Customer during the term. Kept for the term plus 3 years to establish, exercise or defend legal claims about actions taken through the Platform [TBC]. The key that links pseudonyms to users is held separately, with restricted access, and is deleted at the end of the same period. The integrity anchors kept in immutable storage contain no personal data [TBC] | DEL-2 | Customer: Art. 28 GDPR (DPA). Company: Art. 6(1)(f) GDPR (security, defence of claims) and Art. 5(2) (accountability) |
| A9 | Security logs | Authentication events recorded by the self-hosted identity provider (Keycloak), IP addresses, user agents, administrative access, edge web server logs, Vault audit logs [TBC: whether Vault audit logging is enabled] | 30 days; longer only where needed to investigate a specific incident, and then only for the logs concerned (see A13) [TBC] | DEL-2 | Art. 6(1)(f) and Art. 32 GDPR |
| A10 | Website visitor data | Server access logs of the edge web server; strictly necessary cookie identifiers (no analytics or marketing cookies at launch) | Access logs: 30 days [TBC]. Cookies: as set out in the Cookie Policy (cookie-policy.md) | DEL-2 | Art. 6(1)(f) GDPR (security); Art. 6(1)(a) GDPR and Art. 4(5) of Law no. 506/2004 (non-essential cookies, with consent) |
| A11 | Cookie consent records | Consent choice, timestamp, banner version, pseudonymous identifier. None at launch: kept only once optional cookies and a cookie banner are introduced | For the duration of the consent (6 months, see cookie-policy.md), then kept as proof of consent for 3 years | DEL-2 | Art. 7(1) GDPR (demonstrating consent); Art. 6(1)(c) and (f) |
| A12 | Data subject request records | Request, identity verification, response | 3 years after the request is closed | DEL-2 | Art. 6(1)(c) and (f) GDPR (accountability, defence of claims) |
| A13 | Security incident records | Facts, effects, remedial action, notifications | 5 years after the incident is closed [TBC] | DEL-7 | Art. 33(5) GDPR; Art. 6(1)(c) |
| A14 | Dispute files | Correspondence and evidence about a specific claim | Until the claim is finally resolved, plus the applicable limitation period | DEL-7 | Art. 6(1)(f) GDPR |
| A15 | Marketing preferences | Subscription to business communications, opt-outs | Until consent is withdrawn or the person objects; proof of the opt-out is then kept for 3 years | DEL-2 | Art. 6(1)(a) or (f) GDPR; Art. 6(1)(c) (proof of opt-out) |
| A16 | Platform-wide public trend signals (Trend Radar) | Public search, news, Wikipedia, GDELT, YouTube, Bluesky and Mastodon items collected for all Customers | Post-level raw items: no longer than 30 days. Aggregated topic signals: as long as needed to provide trend insights | DEL-2, DEL-3 | Art. 6(1)(f) GDPR (privacy-policy.md, Sections 4 and 6) |
| A17 | Access-request technical data | Pseudonymised IP address hash (keyed hash: HMAC-SHA-256 with a server secret, key changed every 30 days, truncated) and browser user agent recorded with each access request, for abuse prevention; status of the acknowledgement email (sent at most once per inbox per 24 hours; if not sent, the reason) and of the internal notification | IP hash and user agent: deleted 30 days after the request is submitted, by an automated job. Email status flags: with the access request (A1) | DEL-2 | Art. 6(1)(f) GDPR (security of the form, abuse prevention) |
| A18 | ROI estimate requests (website ROI calculator) | Work email, contact name, company, language, persona (the example profile chosen), display currency, model version, calculator inputs (business inputs such as ad spend, team size, number of clients, hourly cost, current tools and prices, plan and add-ons), the results computed on the server, privacy-notice version, marketing consent (optional, unticked), link to an access request (if any) | If not linked to an approved access request: deleted 12 months after the request by an automated job (whether or not it is linked to an access request that was refused, waitlisted, withdrawn or never decided). If linked to an approved access request: becomes part of the customer relationship and is kept like customer contact data (A2). An estimate attached to a signed Order Form as the Pilot estimate (Order Form, Annex E-1) is kept with the signed contract (A4). Deleted earlier on request | DEL-2 | Art. 6(1)(b) GDPR where the requester acts in their own name (steps at their request before a contract); otherwise Art. 6(1)(f) (answering business enquiries, preparing a contract); marketing only with consent, Art. 6(1)(a) (A15) [TBC: lawyer review] |
| A19 | ROI estimate technical data | Pseudonymised keyed hash of the IP address (HMAC with a server secret rotated every 30 days) and the browser family and major version, recorded with each ROI estimate request to enforce the rate limits (3 per email address per 24 hours, 10 per IP hash per hour). Submissions flagged as automated are not stored. Status of the estimate email: sent, or suppressed and why, delivery attempts and the last delivery error (raw mail-server text, which can contain the recipient's address) | IP hash and browser: deleted 30 days after the request, by an automated job, even if the estimate itself is kept longer (A18). Email status: kept with the estimate (A18) | DEL-2 | Art. 6(1)(f) GDPR (security of the form, abuse prevention) |
| A20 | Pilot measurement data | During a paid Pilot (Order Form, Part E.2): baseline and pilot time logs entered by the Customer's Authorized Users (task type, minutes, count); task counts and active time on task screens taken from the Platform's records; working copies used to compute the measurement report | Time logs and activity extracts: deleted 12 months after the last day of the Pilot [TBC], unless a dispute about the measurement is pending (Section 9). The signed baseline summary and the measurement report, which show figures per task type, are kept with the signed Order Form (A4) | DEL-2; DEL-7 for the report | Art. 6(1)(f) GDPR (objective measurement of the Pilot as agreed in the Order Form; establishing or defending claims about the break-even exit); Art. 6(1)(b) where the person contracts in their own name [TBC: lawyer to confirm the roles of the Company and the Customer, Art. 26 GDPR, and Art. 5 of Law no. 190/2018] |
| A21 | Email suppression list (public forms) | The normalised key of an email address (lower case, without a "+tag" and, for Gmail, without dots) whose owner asked us not to send any more email from the access-request or ROI estimate forms, and the date of the request. The request itself, and the estimates or access requests deleted at that time, are recorded in an internal register with the date and a reference only, without the address | Kept for as long as the request applies, so that the address keeps being blocked; deleted when the person asks to be unblocked [TBC: lawyer to confirm the retention period and whether a periodic review, for example every 24 months, is needed] | DEL-1 | Art. 6(1)(c) and (f) GDPR (giving effect to an objection or erasure request, Art. 17 and 21 GDPR, and not emailing that person again) |
5. Schedule B – Customer Data processed by the Company as processor
For all categories in this Schedule, the processing is carried out on the Customer's documented instructions (Art. 28 GDPR; DPA, Section 5.1). The Customer, as controller, determines the legal basis. "Term" means the term of the Agreement, followed by the end-of-agreement process in Section 2.4. Schedule C prevails where it sets a shorter limit.
Disconnection rule. When a Third-Party Platform connection is removed (by the Customer in the Platform or by revocation at the provider), the OAuth token is deleted immediately and the data synchronised from that connection is deleted within 30 days, or sooner where Schedule C requires it.
| # | Data category | Examples | Retention period | Deletion method |
|---|---|---|---|---|
| B1 | Advertising data | Accounts, campaigns, ad sets, creatives, spend, impressions, clicks, conversions; names and emails of account users returned by the APIs | Term, subject to the limits in Schedule C (for example 1 year for LinkedIn reporting data) | DEL-1 |
| B2 | Analytics data | Reports from Google Analytics 4, Adobe Analytics and Search Console (mostly aggregated) | Term | DEL-1 |
| B3 | E-commerce and CRM data | Orders (order ID, customer ID, value, products, refunds, cash-on-delivery refusals, locality), CRM contacts and deals | Term. By default, identifiers in order-level data are kept for a rolling 24 months from the order date, after which they are removed and only aggregated metrics are kept [TBC]. Records the source system asks to delete (for example a Shopify customer redaction request) are deleted within 30 days | DEL-1, DEL-3 |
| B4 | Hashed identifiers and conversion events | SHA-256-hashed emails and phone numbers, click identifiers, IP address and user agent supplied for server-side conversion uploads | Kept only until the upload is confirmed by the receiving Third-Party Platform, and for no more than 30 days to allow retries and reconciliation [TBC] | DEL-2 |
| B5 | Social comments and direct messages | Comment and message text, author name and identifier, timestamps, reactions | 30 days from retrieval by default, configurable by the Customer [TBC: available range]. Shorter limits in Schedule C apply (for example 24 hours for LinkedIn) | DEL-2 |
| B6 | LinkedIn member data | Profile and social activity data of LinkedIn members who are not Authorized Users | 24 hours maximum (see C1) | DEL-2 |
| B7 | Content and publishing data | Drafts, scheduled and published posts, media, publishing status | Term | DEL-1 |
| B8 | AI chat and files | Conversations, prompts, uploaded files, Outputs, feedback | Term, unless deleted earlier by Authorized Users | DEL-1 |
| B9 | Automation results | Performance Guardian proposals, Trend Radar concepts, Web Intelligence summaries, approval history | Term (approval history is also kept in the audit log, A8) | DEL-1 |
| B10 | Web Intelligence page cache | Copies of public web pages fetched for analysis | 30 days after fetching [TBC] | DEL-2 |
| B11 | Trend Radar items collected at a specific Customer's direction (custom topics, markets or monitored sources) | Public items from trend sources (search trends, news, Wikipedia, GDELT, YouTube, Bluesky, Mastodon) | Post-level raw items: no longer than 30 days. Aggregated topic signals: term | DEL-2, DEL-3 |
| B12 | Creatives | Images and texts generated or uploaded, including C2PA metadata | Term | DEL-1 |
| B13 | OAuth tokens and connection metadata | Encrypted access and refresh tokens, scopes, connection status | Until the connection is removed, authorization is revoked at the Third-Party Platform, or the Agreement ends. Deleted immediately when that happens, and revoked where possible. Copies in the encrypted database backups expire no more than 14 days later | DEL-4, DEL-5 |
| B14 | Customer configuration | KPI targets, cost-of-goods tables, brand guidelines, approval workflows, auto-approval policies, white-label settings | Term | DEL-1 |
| B15 | Customer uploads | CSV files and other files uploaded for analysis | Term, unless deleted earlier by the Customer | DEL-1 |
6. Schedule C – Limits imposed by Third-Party Platforms
These limits apply in addition to Schedule B and prevail where they are shorter. They reflect the developer terms in force when this schedule was prepared and are reviewed when those terms change.
| # | Platform | Requirement and the Company's rule | Source |
|---|---|---|---|
| C1 | Profile data of other members (for example commenters): cache for no more than 24 hours; do not store. Member social activity data (posts, comments, reactions by members): LinkedIn allows 48 hours; the Company applies 24 hours. Organisation social activity data: 6 weeks (6 months for organisations authenticated in the Platform). Organisation profile data: 8 weeks for authenticated organisations; otherwise only name and logo URL for 30 days. Page administration and reporting data, and advertising account administration and reporting data: 1 year. Member and object IDs/URNs: no LinkedIn limit; kept only as needed. Member data is not exported, combined or used for advertising, sales or recruiting. | LinkedIn Marketing API Program Data Storage Requirements and Restricted Uses (Microsoft Learn, updated 2 February 2026) | |
| C2 | YouTube (Google) | Stored API data is refreshed or deleted at least every 30 days. After the user revokes access in the Platform or asks for deletion, data is deleted as soon as possible and within 7 days. After revocation through the Google security settings page, data is deleted within 30 days. | YouTube API Services Developer Policies, Sections III.D.2 and III.E.4 |
| C3 | Meta (Facebook, Instagram, Threads) | Platform Data is deleted promptly, and in any case within 30 days [TBC], when: the user asks (including through the data deletion callback); the Customer no longer has an account; it is no longer needed for a legitimate business purpose; or Meta requires it. Aggregated or de-identified data may be kept where Meta's terms allow. Data is kept separately for each Customer. | Meta Platform Terms (updated 3 February 2026), Sections 3.d and 5.b |
| C4 | Shopify | Customer redaction request (customers/redact): delete the customer's data within 30 days. Shop redaction (shop/redact, sent by Shopify 48 hours after the app is uninstalled): delete the shop's data within 30 days of receipt. Customer data request (customers/data_request): provide the data to the merchant within 30 days. | Shopify privacy law compliance documentation (mandatory compliance webhooks) |
| C5 | Google (Google Ads, GA4, Search Console) | Data is used only to provide the Platform's user-facing features (Limited Use) and is deleted when the connection is removed, under Schedule B and DPA Section 16. | Google API Services User Data Policy |
| C6 | X | X content that is deleted, made private, suspended, withheld or modified on X is deleted or modified as soon as reasonably possible, and in any case within 24 hours after a request from X or the account owner. | X Developer Agreement and Developer Policy |
| C7 | TikTok | Data received through TikTok is deleted when the user revokes authorization or deletes the account (signalled by TikTok webhooks), within the period required by TikTok's terms [TBC]. | TikTok for Developers Terms of Service; TikTok advertising terms |
| C8 | Others (Microsoft Advertising, Amazon Ads, Pinterest, Adobe, HubSpot, Salesforce, Pipedrive, WooCommerce) | Schedule B applies, together with any stricter requirement in the provider's API terms. | Respective API terms |
7. Schedule D – Backups, logs and copies held by sub-processors
| # | Data | Retention period | Deletion method |
|---|---|---|---|
| D1 | Database backups (nightly logical dumps of PostgreSQL, encrypted with age before storage, kept on network storage in the same facility) | No more than 14 days | DEL-5 |
| D2 | Background job records (graphile-worker queue in PostgreSQL) | Removed when the job completes successfully; failed jobs kept for no more than 30 days for troubleshooting [TBC] | DEL-2 |
| D3 | LLM observability traces (Langfuse, self-hosted in our cluster, PII redacted) | 30 days [TBC] | DEL-2 |
| D4 | Error tracking events (Sentry, self-hosted in the Company's infrastructure, scrubbed) | 30 days [TBC: confirm SENTRY_EVENT_RETENTION_DAYS on the shared instance, or use a dedicated project with 30-day retention] | DEL-2 |
| D5 | Operational application logs (no content of Customer Data) | 30 days [TBC] | DEL-2 |
| D6 | Transactional email logs (Amazon Web Services EMEA SARL (Luxembourg), Amazon SES, AWS region eu-west-1, Ireland) | 30 days [TBC: depends on AWS settings, including the account-level suppression list for bounced and complaining addresses] | DEL-6 |
| D7 | Data held by AI Providers | Anthropic: deleted within 30 days by default, or not stored after the response under zero data retention; content flagged by trust and safety systems up to 2 years; trust and safety classification scores up to 7 years; models designated as "Covered Models": at least 30 days, and zero data retention generally not available (the Company notifies Customers under DPA Section 10 before using such a model). OpenAI: abuse-monitoring logs up to 30 days unless zero data retention applies. These periods are set by the providers (see subprocessors.md). | DEL-6 |
| D8 | Data held by connector and publishing sub-processors (Zernio, Windsor.ai, Unified.to, Firecrawl) | Under each sub-processor's agreement. The Company asks for deletion when the related connection is removed or the Agreement ends. | DEL-6 |
8. Settings the Customer controls
The Customer can, through the Platform or by request:
- delete conversations, files, creatives, posts and other content;
- change the retention period for comments and direct messages within the range offered [TBC];
- disconnect any Third-Party Platform, which deletes the related OAuth token immediately (B13);
- delete an End Client's Workspace (Agency Customers);
- export Customer Data at any time and during the Export Window;
- ask for deletion of specific Customer Personal Data to fulfil a data subject request (DPA, Section 12).
9. Exceptions and legal holds
9.1. Deletion may be suspended for specific data only where: (a) the law or an order of a court or competent authority requires it; or (b) the data is needed to establish, exercise or defend a specific legal claim. A legal hold is documented, limited to the data needed, reviewed at least every 6 months and lifted as soon as its reason ends.
9.2. Data under a legal hold is not used for any other purpose.
9.3. Retention required by law takes precedence over a Customer's deletion request only for the data and the period the law requires (DPA, Section 16.3).
10. Ownership and review
10.1. The person responsible for data protection at the Company owns this schedule. Contact: privacy@1ads.net; data protection contact: {{DPO_CONTACT}}.
10.2. The schedule is reviewed at least once a year, and also when a new data category, feature, Third-Party Platform or sub-processor is introduced, or when the law or a Third-Party Platform's terms change.