Data Retention Policy - Simply Asking

Overview

This policy explains how long Simply Asking retains your data and how you can request deletion. We believe in transparency about your data and your control over it.

Data Retention Periods

Active Account Data

While your account is active, we retain:

Data Type	Retention Period	Purpose
Account information	Duration of account	Service delivery
Documents & content	Until you delete them	Knowledge base functionality
Chat history	Until you delete it	Conversation continuity
Search queries	90 days	Service improvement
Activity logs	90 days	Security & troubleshooting

Task Runs & Automations

When you or a scheduled automation asks the assistant to carry out a piece of work, we keep a record of what it did so you can review it afterwards.

Data Type	Retention Period	Purpose
Task threads	Until you delete them	Keep a task's history in one place
Task run records	180 days	Review what ran, what it cost, and when
Step-by-step activity timeline	Deleted with its task run	Show how an answer was reached
Record of actions taken	Deleted with its task run	Show which actions ran and which you approved
Your instructions during a run	Deleted with its task run	Apply a mid-run instruction or a stop
Approval decisions	Deleted with its task run	Prove an action was approved before it ran
Automation definitions	Until you delete the automation	Run the schedule you set up

Everything in a task run's history is deleted together with the run itself. Deleting an automation removes its schedule; task runs it already produced follow the 180-day period above. Daily spending counters are aggregate numbers per organization and contain no task content.

Antivirus Quarantine

Files flagged by antivirus scanning are quarantined and retained for 30 days for investigation, then permanently deleted. Quarantine events are logged via security event tracking for audit purposes.

After Document Deletion

When you delete a document:

Stage	Timeline	What Happens
Soft delete	Immediate	Document hidden, recoverable for 30 days
Hard delete	30 days	Document permanently removed from production
Backup removal	Up to 90 days	Removed as backups naturally expire

Derived knowledge: When a document is deleted, the search index entries, extracted entities, and pending (unconfirmed) fact candidates derived from it are removed along with it. Confirmed business facts (statements that a person in your organization explicitly reviewed and approved) are organization-level records that carry their own human approval, so they are retained even if the source document is later deleted. You can retract any confirmed fact at any time, and all confirmed facts are permanently deleted when your organization's account is deleted.

After Account Cancellation

When you cancel your subscription:

Stage	Timeline	What Happens
Grace period	30 days	Data preserved, can reactivate
Data deletion	After grace period	All data queued for destruction
Complete removal	Up to 60 days total	Removed from all systems including backups

Trial Accounts

If you don't convert after your trial:

30 days after trial expiration: All trial data is deleted
No backup retention: Trial data is not preserved in long-term backups

Data We Must Retain

Some data must be retained for legal or regulatory reasons:

Data Type	Retention Period	Reason
Financial transaction records	7 years	Tax and accounting requirements
Security incident logs	3 years	Legal compliance
Consent records	7 years	GDPR/regulatory proof

This data is retained in secure, access-restricted systems and is not used for any other purpose.

How to Delete Your Data

Delete Individual Items

Documents:

Navigate to your Document Library
Select the document(s) you want to delete
Click "Delete" and confirm
Documents are recoverable for 30 days, then permanently deleted

Chat History:

Go to the chat interface
Click on chat settings
Select "Clear chat history"
Chat history is immediately removed

Delete Your Entire Account

Self-Service:

Go to Account Settings
Navigate to Privacy section
Click "Delete My Account"
Confirm your password
Your account and all data will be scheduled for deletion

By Request: Email legal@simplyasking.io with subject "Account Deletion Request" and we'll process it within 30 days.

Export Your Data First

Before deleting your account, you can export all your data:

Go to Account Settings → Privacy
Click "Export My Data"
Select what to include (documents, chat history, activity logs)
Download your data package (ZIP file)
Link valid for 7 days

Export includes:

All your documents in original formats
Document metadata (JSON/CSV)
Chat history (JSON)
Activity logs (CSV)

If you're in the EU/EEA, you have the right to erasure under GDPR Article 17. To exercise this right:

Self-service: Use the GDPR Data Management page at /gdpr-data-management
By request: Email legal@simplyasking.io

We will:

Confirm your identity
Process your request within 30 days
Notify you when deletion is complete
Provide a deletion confirmation upon request

California (CCPA/CPRA) Rights

California residents can request deletion of personal information. We will:

Process requests within 45 days (extendable to 90 days with notice)
Not discriminate against you for exercising your rights
Confirm what was deleted

What We Cannot Delete

In certain circumstances, we may not be able to delete some data:

Legal holds: Data subject to litigation or investigation
Regulatory requirements: Financial records, security logs
Fraud prevention: Records needed to prevent abuse
Technical limitations: Data already in distributed backups (removed upon natural expiration)

We'll inform you if any exceptions apply to your request.

Verification of Deletion

Standard Verification

After deletion, you'll receive an email confirmation that your data has been removed.

Enterprise Customers

Enterprise customers can request a formal Certificate of Destruction containing:

Confirmation of deletion
Date and time of destruction
Categories of data deleted
Authorized signatory

Contact legal@simplyasking.io to request a certificate.

Third-Party Data

Our Subprocessors

When you delete data, we also ensure deletion from our service providers:

Supabase: Database records deleted immediately; backups expire within 30 days
OpenAI: API data automatically deleted within 30 days (not used for training)
Google Cloud: Deleted per our data processing agreement
Stripe: Financial records retained per legal requirements

See our full Subprocessor List for details.

Data You've Shared

We cannot delete:

Data you've exported and stored elsewhere
Data shared with third-party integrations you've connected
Data other users have copied or downloaded

Questions?

Data Deletion Requests: legal@simplyasking.io

Deletion Certificates (Enterprise): legal@simplyasking.io

General Questions: legal@simplyasking.io

This policy is reviewed and updated annually or when significant changes occur to our data retention practices.