Retention and account deletion

JOINKY · 2026-10-06.1

Account and contact data are used while the account is active and its purposes remain necessary. You may request deletion at any time in Help and privacy. A deletion request is distinct from signing out, pausing an organization, withdrawing a service request or cancelling an app-store subscription. Do not send passwords or identity-document copies in the request text.

The platform owner is accountable for reviewing and carrying out data-rights requests. Initial substantive response target: 30 calendar days from receipt, subject to any shorter legal deadline. There is no mandatory 30-day cooling-off period. You may withdraw an open request. Necessary identity checks, unresolved obligations and organization ownership are assessed explicitly; they must not silently convert deletion into indefinite suspension.

The operating schedule is purpose-based: ordinary account/contact data are removed or anonymized when verified deletion can be carried out; private child/health documents and care records receive a necessity review at the end of the service and at most 90 days later; closed report evidence receives a necessity review after 180 days; financial and transaction evidence receives a review five years after final settlement. These are operational limits, not statutory minimums. The retention worker removes personal service/order details 90 days after proved fulfillment or closure, closed-report evidence after 180 days, and settled payment reference/proof text after five years. Active services do not expire from submission age. Specific evidence snapshots held for a documented continuing purpose remain private and require a review within 180 days. Remove unnecessary data earlier.

A legal hold must record its specific basis, narrowly retained fields, responsible reviewer and next review date. A retention exception does not permit continued marketing or unrestricted access. Financial dispute evidence must not be used as a blanket reason to retain unrelated child images or messages. Where an organization is responsible for a service record, coordinate its response and identify the responsible party to the requester.

Backups are isolated recovery copies, not a second user-accessible archive. The current infrastructure configuration retains 14 automated database backups and seven days of point-in-time logs; this is not a promise that all copies disappear after exactly 14 days. Deleted file generations can remain recoverable by infrastructure administrators for seven days. Ordinary replaced file versions expire after 14 days before that recovery window; an approved erasure removes all live and noncurrent generations earlier. Approved erasures must be reapplied before a restored backup is returned to normal service. Export copies use private time-limited delivery, never public links.

Verified deletion closes ordinary account activity, removes sign-in credentials and personal account/request data, and detaches retained transaction and audit references from the identity. Transfer organization ownership and resolve active requests, orders, payment reviews and open safety cases first; support remains available for an assisted review. Organization-owned business content and narrow evidence holds remain separate. Completion requires recorded files to be removed; unfinished cloud uploads can require up to eight days for final erasure. A private receipt can check execution after account access ends. An administrative reply alone is never an execution receipt.