Overview
This policy defines how COVIS AI retains, manages, and permanently deletes personal data and business data across the platform. It applies to all tenants, users, and data processed through the COVIS AI platform.
This policy is incorporated by reference into our Privacy Policy and Terms of Service.
Account & Identity Data
| Data Type | Retention Period | Deletion Trigger | Who Can Delete |
|---|---|---|---|
| Full name, email, role | Account active + 30 days | Account deletion request | User (self) or Super Admin |
| Password hash | Account active + 30 days | Account deletion | Auto-purged |
| Profile photo | Account active + 30 days | Account deletion or manual removal | User (self) |
| Login history | 90 days rolling | Rolling auto-purge | Auto-purged |
| Session tokens | Session expiry or logout | Session end | Auto-purged |
| Active sessions list | Real-time | Session revocation | User or Super Admin |
| Years of experience / professional profile | Account active + 30 days | Account deletion | User (self) or Super Admin |
Billing & Financial Data
| Data Type | Retention Period | Who Can Delete |
|---|---|---|
| Invoices and receipts | 7 years | Cannot be deleted — legally required |
| Subscription history | 7 years | Cannot be deleted |
| Transaction records | 7 years | Cannot be deleted |
| Payment method tokens | Until removed by user | User (via payment settings) |
| Raw card numbers | Never stored | N/A — tokenized via Stripe |
| Order IDs (payment gateway) | 7 years | Cannot be deleted |
| Billing disputes / chargebacks | 7 years | COVIS AI Super Admin only |
Content & AI Data
| Data Type | Retention Period | Default | Who Can Delete |
|---|---|---|---|
| Chat history (inputs + outputs) | Configurable by Company Admin | 12 months | Company Admin or User |
| Uploaded files and documents | Configurable by Company Admin | 12 months | Company Admin or User |
| AI-generated proposals and outputs | Configurable by Company Admin | 12 months | Company Admin or User |
| Custom AI agent configurations | Account active + 30 days | Account deletion | Company Admin |
| Knowledge base entries | Configurable by Company Admin | 12 months | Company Admin |
| LinkedIn profile imports | Account active + 30 days | Account deletion or manual removal | Company Admin or User |
| Call logs (metadata) | 12 months | 12 months | Company Admin |
| Call recordings (if applicable) | Configurable by Company Admin | 12 months | Company Admin |
Usage & Analytics Data
| Data Type | Retention Period | Who Can Delete |
|---|---|---|
| Token usage logs (count, type, timestamp) | 12 months | Auto-purged |
| API call logs | 12 months | Auto-purged |
| Agent usage statistics | 12 months | Auto-purged |
| Feature usage analytics | 12 months (then anonymized indefinitely) | Auto-purged |
| Resource usage metrics (users, clients, agents, projects, storage) | 12 months | Auto-purged |
| Aggregated / anonymized analytics | Indefinitely | N/A — no PII |
Security & Audit Data
| Data Type | Retention Period | Who Can Delete |
|---|---|---|
| Audit logs (who did what, when) | 24 months | Immutable — cannot be deleted |
| IP address logs | 90 days | Auto-purged |
| Error logs / crash reports | 90 days | Auto-purged |
| Technical / server logs | 90 days | Auto-purged |
| Security incident records | 7 years | COVIS AI Legal team only |
| Fraud investigation records | Duration of investigation + 7 years | COVIS AI Legal team only |
| Subscription status change history | 24 months | Immutable — audit trail |
Communication Data
| Data Type | Retention Period | Who Can Delete |
|---|---|---|
| Support tickets | 3 years | COVIS AI Admin only |
| Support ticket attachments | 3 years | COVIS AI Admin only |
| In-app feedback | 2 years | COVIS AI Admin only |
| Email correspondence | 3 years | COVIS AI Admin only |
Tenant-Configurable Retention Settings
Company Admins may customize the following retention settings from: Settings → Data & Privacy → Retention Policy
Chat & AI Output Retention
File & Document Retention
Auto-Delete Inactive User Data
Deletion Tiers — Who Can Delete What
Tier 1 — End User
- Own chat history and messages
- Own uploaded files and documents
- Own profile data (name, avatar, preferences)
- Own account (triggers Account Deletion Flow)
- Own API keys (revocation)
Tier 2 — Company Admin
- Any user's chat history within the workspace
- All workspace files and AI-generated content
- Invite and remove users (removal anonymizes shared records)
- Workspace-level agent configurations and knowledge base
- Full workspace deletion (triggers Workspace Deletion Flow)
Tier 3 — COVIS AI Super Admin
- Process GDPR / regulatory erasure requests
- Apply or release legal holds
- Override retention schedules under court orders
- Hard-delete billing records after legal hold period expires
- Emergency deletion in the event of a data breach
- Anonymize audit log PII on schedule
Legal Hold Policy
A legal hold suspends normal deletion schedules for data relevant to:
- Active fraud investigations
- Legal proceedings or court orders
- Regulatory investigations
- Unresolved billing disputes
Legal Hold Process
A legal_hold: true flag is applied to affected records
Normal automated deletion jobs skip legal-held records
No user — including Super Admin — can delete held data
The hold is lifted only by COVIS AI's Legal team
Where legally permissible, the affected user/tenant is notified
Once lifted, standard retention schedules resume (or data is deleted if past retention period)
Automated Deletion Jobs
All automated jobs are logged. Failures trigger alerts to the infrastructure team.
| Job Name | Frequency | Action |
|---|---|---|
| purge-expired-sessions | Hourly | Delete all sessions past expiry time |
| purge-error-logs | Daily | Delete error / crash logs older than 90 days |
| purge-ip-logs | Daily | Delete IP and technical logs older than 90 days |
| purge-chat-history | Daily | Delete chat history past tenant retention setting |
| purge-call-logs | Daily | Delete call logs older than 12 months |
| purge-linkedin-data | Daily | Delete LinkedIn profile data for deleted accounts |
| purge-inactive-users | Daily | Anonymize users inactive beyond tenant setting |
| purge-deleted-accounts | Daily | Hard-delete accounts past 30-day grace period |
| purge-deleted-workspaces | Daily | Hard-delete workspaces past 30-day grace period |
| purge-token-logs | Monthly | Delete token usage logs older than 12 months |
| purge-resource-usage-logs | Monthly | Delete resource usage metrics older than 12 months |
| anonymize-audit-logs | Monthly | Replace PII in audit logs older than 12 months |
| purge-old-audit-logs | Monthly | Delete anonymized audit logs older than 24 months |
| purge-support-tickets | Quarterly | Delete resolved tickets older than 3 years |
Key Retention Timeframes Summary
Sessions revoked, login disabled on deletion request
Grace period — user or tenant can cancel deletion request
Hard deletion executed for all eligible data
Technical logs, IP logs, error logs auto-purged
Chat history, files, call logs, token logs, AI outputs auto-purged
Audit logs anonymized, then purged on rolling basis
Support tickets and email correspondence deleted
Billing / invoice records — legally cannot be deleted earlier
Changes to This Policy
We reserve the right to update this policy. Material changes will be communicated via:
- Email notification to Company Admins
- In-app notification requiring acknowledgement
Previous versions are archived and available upon request at privacy@covis.ai.