Data Retention Policy

1. Introduction

This Data Retention Policy explains how Stack Up manages the lifecycle of data collected through our services. We are committed to retaining your data only for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements.

Our retention practices are designed to comply with applicable data protection laws, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other relevant regulations.

2. Data Retention Schedule

The following table outlines our standard retention periods for different categories of data:

3. Customer-Controlled Retention

Enterprise customers have the ability to configure certain data retention settings according to their needs:

• Analytics Data: Configurable retention period from 30 days to 24 months
• Scan History: Configurable retention from 90 days to unlimited
• Export Options: Ability to export data before deletion
• Custom Policies: Enterprise agreements may include custom retention terms

4. Account Termination

When you terminate your Stack Up account:

• Immediate: Your access to the service is terminated
• Within 30 days: Service data is deleted from active systems
• Within 90 days: Data is removed from backup systems
• Retained: Billing records and data required for legal compliance

You may request a full data export before account termination. Contact our support team to initiate an export.

5. Data Deletion Requests

You have the right to request deletion of your personal data, subject to certain exceptions. To submit a deletion request:

• Email us at [email protected]
• Use the data deletion feature in your account settings
• Submit a request through our Contact page

We will respond to your request within 30 days and complete the deletion within 90 days, unless we are required to retain the data for legal purposes.

6. Exceptions to Retention Periods

We may retain data beyond the standard retention periods in the following circumstances:

• Legal Hold: When data is subject to legal proceedings or investigations
• Regulatory Requirements: When required by law or regulatory bodies
• Contractual Obligations: When specific retention is agreed in customer contracts
• Dispute Resolution: When data is necessary to resolve disputes

7. Secure Deletion Methods

When data reaches the end of its retention period, we ensure secure deletion using:

• Cryptographic erasure for encrypted data
• Secure overwriting procedures for storage media
• Certificate of destruction for physical media
• Audit trails for all deletion activities

8. Backup Data

Data in backup systems follows a separate retention schedule:

• Daily backups: Retained for 7 days
• Weekly backups: Retained for 4 weeks
• Monthly backups: Retained for 12 months

When data is deleted from production systems, it will be removed from backup systems according to the backup retention schedule above.

9. Changes to This Policy

We may update this Data Retention Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date. We encourage you to review this policy periodically.