Data retention policy
Effective March 13, 2025. Last updated October 26, 2026.
About this policy
This Data Retention Policy explains the categories of data GetProSpace generally keeps, how long we aim to keep them, and why those periods exist. Actual retention may be longer where needed for legal holds, dispute resolution, fraud prevention, backup cycles, or compliance obligations.
General Approach
We keep data only as long as reasonably necessary to provide the service, maintain records users expect from a business operations platform, meet contractual and legal obligations, protect the platform, and resolve disputes. When possible, we remove data from active systems when it is no longer needed, but some records may remain in backups or archives for a limited period.
Retention Schedule
| Category | Examples | Typical retention | Why |
|---|---|---|---|
| Account and profile data | User profile details, sign-in records, legal acceptance records, workspace membership | While the account is active, then generally up to 7 years after account closure | Account recovery, tax and audit support, fraud prevention, legal recordkeeping |
| Client records | Client names, contact details, notes, linked client portal relationships | Generally 3 years after the last meaningful interaction unless tied to longer-lived business records | Service continuity, customer history, support, dispute handling |
| Team and subcontractor records | Employee invitations, roles, permissions, crews, subcontractor links, assignments, review queues, workstation activity | Generally while the workspace is active, then up to 7 years after removal, completion, or workspace closure where tied to business records | Access control, work history, payroll or payout context, disputes, audits, and service continuity |
| Job and workflow records | Jobs, schedules, notes, status history, tasks, activity records | Job duration plus generally 7 years after completion or closure | Historical business records, support, tax and audit context, disputes |
| Contracts and signatures | Contract text, signature events, signed dates, status history, signed PDFs | Contract life plus generally 7 years after expiration, termination, or signing | Legal enforceability, recordkeeping, compliance, dispute resolution |
| Billing and payment records | Estimates, invoices, line items, payment records, subscription billing history | Generally 7 years from creation or payment | Tax, accounting support, audits, chargebacks, and disputes |
| Accounting and financial records | Manual transactions, categories, ledgers, expenses and receipts, imported transaction history | Generally 7 years from creation or import, unless shorter retention is required for a connected provider dataset | Historical reporting, reconciliation, compliance, and support |
| Texts, calls, and call notes | Texts sent and received on a business phone line, call records, notes made from calls | Kept with the client and job records they belong to, under the periods above. The spoken words of a call are erased as soon as its note is written | Customer history, support, and dispute handling |
| Contractor website and AI generation records | Generated website content and earlier versions, AI planning chat history, style and tone inputs, website publication status, subdomain assignment, custom domain connection and verification records, AI credit usage history | While the account is active; website content and version history generally up to 2 years after account closure or website deletion; chat history generally up to 1 year after last use or account closure | Allowing revert to previous versions, continuity of published websites, support, and generation quality |
| Plaid-connected data | Connected account metadata, synced transaction data, authorization-related records | Generally while the connection is active and for a limited period after disconnect, with some authorization or audit records kept up to 3 years | Feature operation, troubleshooting, security, partner and compliance expectations |
| Authentication and connected account records | Email and phone verification, Google sign-in identifiers, Google Play subscription references, session and device metadata | Generally while the account is active and up to 7 years where needed for account, billing, fraud, or legal records | Account access, billing support, security, fraud prevention, and dispute handling |
| Photos and annotations | Job photos, annotations, tags, before and after pairs, photo reports | Generally while the job is active and up to 2 years after last access or related workspace closure, unless deleted earlier and not needed for a legal hold | Project documentation, collaboration history, support, and user-requested continuity |
| Logs, audit, and security records | Authentication logs, request logs, analytics events, feedback messages, security events, support records, abuse investigations | Generally 12 to 24 months, and longer if needed for a security incident, dispute, or legal hold | Security monitoring, troubleshooting, fraud prevention, legal compliance |
How We Set Retention Periods
- The nature and sensitivity of the data.
- How long the data is needed to provide the service or preserve expected business records.
- Contractual, tax, accounting, audit, payment, and legal obligations.
- Security, abuse prevention, incident response, and dispute resolution needs.
- Third-party integration requirements and technical backup or archive cycles.
Deletion, De-Identification, and Backups
- When data is no longer required, we aim to delete it from active systems within a reasonable operational timeframe.
- Backups and archives may retain copies for a limited period until they age out under normal rotation.
- Where full deletion is not immediately practical, we may de-identify or securely isolate data until final disposal is feasible.
- Signed contracts, sent change orders, and the history of who did what cannot be changed or removed inside the product.
- Unpublishing a contractor website removes public access immediately, but underlying content and version history remain in the platform until the applicable retention period expires or a deletion request is processed.
Third-Party Providers
Some data is also handled by third-party providers such as Stripe, Plaid, Google, Twilio, Mailgun, Cloudflare, and Anthropic. Their own retention, compliance, and deletion practices may apply to data they process on our behalf or as independent providers. In particular, AI requests sent to Anthropic may be subject to that provider's own data handling and retention policies.
User Requests
Users may request access, correction, or deletion of data by emailing support@getprospace.com. We review requests in light of applicable law, technical feasibility, account ownership, fraud prevention, and records we need to keep for compliance, security, billing, or dispute handling. GetProSpace does not currently provide a self-serve in-app account deletion workflow, so these requests are processed manually.
Policy Changes
We may update this policy when our product, integrations, legal obligations, or operational practices change.