Data Retention

What is data retention?

Data retention is how long a vendor keeps information after it collects it. That includes the records and files you put into the product, the details of your users' accounts, and the logs of how your team uses the service.

Each vendor sets its own retention periods. One vendor can have several clocks running at once: one for your content, one for billing records, one for logs, and one for backups.

Privacy laws push vendors to set limits. The GDPR, the EU privacy law, says personal data should be kept "no longer than is necessary" for the reason it was collected. California's privacy law, the CCPA, requires a business to tell people how long it intends to keep each category of personal information, or how it decides. It also bars keeping that information longer than is reasonably necessary for the purpose it disclosed.

The kinds of data a vendor keeps

• Your content: the customer data you and your team upload or create, such as records, files, messages and recordings.
• Account and billing data: names, email addresses, invoices and payment history for your users.
• Usage data and logs: records of logins, clicks and system events, often called usage data.
• Backups: copies kept so the vendor can recover from an outage or a mistake. See backup retention below.
• De-identified data: data with names and other identifiers removed. Some policies say data is deleted or de-identified when its period ends, as Atlassian's privacy policy does. Once data is de-identified, ask what the vendor does with that version.

Retention while you are still a customer

Retention is not only about leaving. Two rules can affect you while your account is still open.

The first is inactivity. Some vendors delete data from accounts nobody uses. Vidyard says free accounts become inactive one year after the last sign-in, and it sends a notice 90 days before deletion. If a rarely used tool holds records you need, check for a rule like this.

The second is your own deletions. When someone on your team deletes an item, the vendor may not be able to bring it back. Atlassian says its backups "are not used to revert customer-initiated destructive changes" and recommends that customers take regular backups of their own. The vendor's backups protect the vendor's service, not always your mistakes.

Where to find the retention period

Retention rules are spread across documents. Look in these places, in this order:

1. The privacy policy, usually in a section called "How long we keep your information" or "Retention."
2. The data processing agreement (DPA), in the clause on deleting or returning data when the contract ends.
3. The main terms or product terms, in the sections on termination and retrieving your data.
4. Help center or trust center articles, which often give the actual number of days.

The number is often in the help article, not the contract. For example, Atlassian's DPA says it deletes customer personal data "in accordance with the Documentation." Its support documentation then gives a 60 day retention period for its Free, Standard, Premium and Enterprise cloud plans after a subscription ends.

What it looks like in a vendor's terms

A typical clause reads like this:

We keep Customer Data while your subscription is active. After your subscription ends, you have 30 days to export it. We then delete Customer Data from our production systems within 90 days. Copies in backups are removed on our normal backup cycle. We may keep account and billing records for as long as the law requires, and we may keep aggregated or de-identified data.

• "While your subscription is active": the vendor holds your data for the whole contract. Deleting items inside the product may follow a different rule.
• "30 days to export": your window to download your data before it goes. Miss it and you may lose it.
• "Within 90 days": the deadline for removing data from the live service. Some vendors give a number; others say "a reasonable period."
• "Normal backup cycle": backups keep copies for an extra stretch of time.
• "As long as the law requires": tax and billing records can be kept for years, and this part has no fixed end date.
• "Aggregated or de-identified data": a version of your data without names that the vendor may keep and use.

Retention clocks do not always start when you cancel. Some count from your last use of the service, as the StreamYard example below shows.

A real change we caught

Venpo flagged this change: StreamYard can now keep personal data for three years after you leave. On October 1, 2026, StreamYard replaced its terms, data processing addendum and privacy policy. The old addendum tied deletion to the customer's written direction when the contract ended. The new one deletes personal data "three years after the last use of the Services or the expiration of the subscription."

The new privacy policy also lengthened other periods: marketing data from two years to three, support data from three years to five, and compliance data from seven years to ten.

Leaving the product did not end the clock. A team that canceled could still have personal data held by the vendor for years.

Why it matters to you

• Longer exposure: data a vendor still holds can still leak. Every extra month of retention is another month your customers' data sits outside your control.
• Your own promises: your customers may ask how long their data lives with your vendors. If your contract with them promises deletion within a set time, a vendor that keeps data longer can put you in breach. Matching your vendors' terms to your own is called back-to-back terms.
• Deletion requests: when a person asks you to delete their data under the CCPA, the regulations require you to notify your service providers so they delete it too. You need to know which vendors hold it and for how long.
• Legal and government requests: data that still exists can be demanded in a lawsuit or by an authority. See government data requests.
• Losing your own data: short retention after cancellation cuts the other way. Many vendors give a window of 30 to 90 days, and some give none. HubSpot's product terms let some Marketing Hub customers request their data within 30 days after termination, but give no access after termination for its free tools and Smart CRM. Vidyard deletes paid account data 90 days after termination. After that, your records may be gone for good.

What to check

• Find the retention period for each kind of data: your content, account data, logs and backups. Note which ones have a number of days and which say "a reasonable period."
• Check when each clock starts: when you cancel, when the contract ends, or from your last login.
• Check the export window after termination and put the date in your offboarding plan. See data export.
• Read the exceptions: records kept "as required by law," de-identified data, and data kept for legal claims.
• Ask for a fixed deletion deadline in the DPA if the vendor only says "in accordance with our documentation."
• Ask whether the vendor confirms deletion in writing when you leave. See data deletion after termination.

Backup Retention

Backup retention is how long copies of your data stay in a vendor's backups after the live version is deleted. Vendors keep backups to recover from outages, attacks or mistakes. So "deleted" often means removed from the live product first, and from backups later.

Some vendors give a number. Vidyard says deleted data stays in automated backups "for an archive cycle of up to seven (7) days." Others do not. Atlassian's DPA lets it keep data under its standard backup or record retention policies, without stating a period. HubSpot's DPA says it will isolate and protect backup data until it is deleted under its deletion practices.

California's CCPA regulations allow this delay. A business or service provider may wait to delete data on backup systems until that backup is restored, accessed or used again.

Ask the vendor three things: how many days backups are kept, whether backups are encrypted, and whether deletions are applied again if a backup is ever restored.

How Venpo helps

The Fine Print Scan answers one question for each of your vendors: how long does it keep your data. Venpo also watches vendors' privacy policies, DPAs and other public legal pages, and emails you a plain-English alert when a retention period changes, with what changed and why it matters.