Data Retention and Deletion Policy

Version 1.2 — effective 1 October 2026.

This policy explains how long {{COMPANY_LEGAL_NAME}} (company number {{COMPANY_NUMBER}}), trading as Commercial Intelligence Partners ("CIP", "we"), keeps data and how we delete it. It forms part of the instructions you give us under our Data Processing Agreement (/legal/dpa) ("DPA").

1. The short version

• While you subscribe, we keep your data so the service works.

• When your subscription ends, you can export your data.

• We keep your account for 12 months after cancellation or closure, so you can export or come back.

• Then we permanently delete it. Backups roll off automatically when the database provider's point-in-time-restore window ends.

• You can ask us to delete earlier.

• We keep our own billing and invoice records for 6 years, as a controller, to meet our tax obligations.

2. Who decides

For the data you put into CIP (your "Client Data"), you are the controller and we follow your instructions. This policy is our standard instruction; you can shorten it by asking for earlier deletion (section 5).

For our own records (your account with us, billing, security logs), we are the controller and set retention ourselves, as shown in section 3.

3. Retention by category

• Financial and operational data (sales, costs, ledger entries, budgets, CSV/API imports, venue/site data). Our role: processor. Kept while subscribed: yes. After cancellation or closure: kept 12 months for export, then deleted.

• Invoices you issue and your customers' details (customer names, emails, addresses, invoice lines, payment status). Our role: processor. Kept while subscribed: yes. After cancellation or closure: kept 12 months, then deleted — you must keep your own copies for your own tax records (export them before deletion).

• Emails sent on your behalf (invoice and reminder emails, delivery status). Our role: processor. Kept while subscribed: yes, in your account. After cancellation or closure: deleted with your account — our email provider keeps delivery logs only for its own short log-retention period.

• Expenses and supplier bills (expense entries, supplier details, receipt images). Our role: processor. Kept while subscribed: yes. After cancellation or closure: kept 12 months, then deleted.

• Staff records (staff names, emails, roles, reporting lines, holiday requests). Our role: processor. Kept while subscribed: yes — you can delete a staff record at any time, for example when someone leaves. After cancellation or closure: kept 12 months, then deleted.

• Uploaded files (logos, receipts, attachments). Our role: processor. Kept while subscribed: yes. After cancellation or closure: kept 12 months, then deleted.

• AI commentary (narrative insights, only if AI is enabled). Our role: processor. Kept while subscribed: yes. After cancellation or closure: kept 12 months, then deleted — our AI provider keeps inputs and outputs only for the limited period in its commercial terms and does not train on them.

• Connector credentials and API keys (encrypted third-party credentials, hashed API keys). Our role: processor. Kept while subscribed: yes, until you disconnect or revoke them. After cancellation or closure: deleted at closure (not kept for the 12 months).

• User accounts (login email, name, authentication records, including staff users' logins). Our role: controller. Kept while subscribed: yes. After cancellation or closure: kept until the person deletes their account (Account settings, then Delete account) or asks us to delete it; being removed from a business does not delete their login. Security activity (their sign-in history) is kept while the account exists, and sessions expire after 7 days without use and after 30 days at most.

• CIP's billing records (our invoices to you, payments, VAT records, Stripe transaction records). Our role: controller. Kept while subscribed: yes. After cancellation or closure: 6 years from the end of the accounting period they relate to.

• Contract records (DPA and Terms acceptance records, notices). Our role: controller. Kept while subscribed: yes. After cancellation or closure: 6 years after the contract ends.

• Admin audit log (records of CIP staff actions, including "view as customer" sessions). Our role: controller. Kept while subscribed: yes. After cancellation or closure: 6 years — a security and accountability record; contains no Client Data beyond identifiers. Rows are never deleted; when a prospect's details reach their retention limit, or an organisation is erased, we blank the email addresses and file names those rows mention.

• Website analytics events (pages viewed, time on page, rough location, device and browser, referring website; no IP address or user agent stored). Our role: controller. Kept while subscribed: not linked to your account. After cancellation or closure: not applicable. Deleted automatically after 13 months. For visitors who have not accepted analytics, the daily secret behind the visitor identifier is destroyed within 48 hours, which makes older events permanently anonymous; for visitors who have accepted, events stay linked to their cip_vid code until they are deleted.

• PostHog product analytics and session recordings (only for visitors and users who accept analytics; held by PostHog, EU cloud). Our role: controller. Kept while subscribed: not linked to your account beyond a coded user id and your business's account id. After cancellation or closure: session recordings are deleted 30 days after they are made; other PostHog analytics events are deleted after 12 months. Withdrawing consent stops collection at once and removes PostHog's cookies and storage from your browser.

• Records of your cookie choices (an anonymous random consent id, your choice, the policy version and the date; no name, email address or IP address). Our role: controller. Kept while subscribed: not linked to your account. After cancellation or closure: not applicable. Kept 25 months, so we can show the choice that applied at any time during its 12-month life.

• Website enquiries ("book a review" form: name, email, business name, phone number if given, number of sites, message). Our role: controller. Kept while subscribed: not linked to your account. After cancellation or closure: not applicable. Kept until 24 months after our last contact, then deleted automatically.

• Calculator results requests and waitlist entries (email, name and business name if given, and for calculators the figures entered and the results; a marketing-consent flag). Our role: controller. Kept while subscribed: not linked to your account. After cancellation or closure: not applicable. Deleted automatically after 24 months with no activity, or sooner on request.

• Files sent through a secure upload link (sales or cost exports, and similar). Our role: processor. Kept while subscribed: used to prepare your analysis. After cancellation or closure: deleted with your account, with the other uploaded files above.

• Support correspondence (emails with our support team). Our role: controller. Kept while subscribed: yes. After cancellation or closure: 2 years after the last message, unless linked to a dispute.

• Templates shop orders (order, payment and download records for shop purchases). Our role: controller. After cancellation or closure: 6 years from the end of the accounting period.

4. Backups

Our database provider keeps continuous backups for point-in-time recovery, over a rolling restore window of 6 hours. Before each software release we also take a snapshot copy of the database, which we delete within 30 days.

We cannot pick out and delete one client's data from those backups. Instead, deleted data drops out automatically as the restore window passes and release snapshots are deleted — in all cases within 30 days.

If we ever had to restore a backup, we would re-apply every deletion made since that backup, before putting the system back into use.

Test and user-acceptance environments use scrubbed data, not copies of live Client Data.

5. Deleting data earlier

Inside the product: owners and managers can delete individual records (for example a staff member, a customer or an upload) at any time.

Whole account: an owner can ask us to delete the whole account early by emailing info@commercialintelligencepartners.co.uk from the owner's address. We will confirm the request, remind you to export first, and delete within 30 days. The early deletion cannot be undone.

Individuals' requests: if one of your staff or customers asks us to delete their data, we will pass the request to you (you are the controller) and help you act on it.

What we still keep: early deletion does not cover the records we keep as controller in section 3 (for example our billing records for 6 years).

6. Legal holds

We will pause deletion of specific data, and keep it only as long as needed, if: a court order, regulator or law enforcement body lawfully requires us to keep it; it is reasonably needed to establish, exercise or defend a legal claim (for example an unpaid-fees dispute, within the 6-year limitation period); or we are investigating a security incident that involves it.

Where the law allows, we will tell you when a hold applies to your data. We lift the hold as soon as the reason ends, and the data is then deleted under this policy.

7. How deletion works

Deletion removes the data from the live database and file storage so it can no longer be accessed through the service. Backups then roll off as described in section 4. We delete encrypted credentials and hashed API keys immediately at closure. We may keep aggregated statistics that do not identify any individual or client. If you ask, we will confirm in writing when deletion is complete.

8. Reviews

We review this policy at least once a year and when the law or our providers change. We give account owners at least 30 days' notice of material changes.

Questions: info@commercialintelligencepartners.co.uk.

Legal basis

UK GDPR Art. 5(1)(e) (storage limitation) and 5(1)(f) (security); Art. 17 (erasure); Art. 28(3)(g) (processor deletes or returns data at the end of services); Art. 32 (security, including backup and restore). Controller retention periods: Finance Act 1998 Sch. 18 para. 21 (company tax records, 6 years from end of accounting period); Value Added Tax Act 1994 Sch. 11 para. 6 and VAT Regulations 1995 reg. 31 (VAT records, up to 6 years); Companies Act 2006 ss.386–388 (accounting records); Limitation Act 1980 s.5 (6-year limitation period for contract claims), which also justifies the legal hold and contract-record periods. ICO guidance: Storage limitation and Right to erasure.