Data Retention & Deletion Policy
How long we keep each category of member data, what triggers deletion, and how quickly deletion completes across primary storage, derived data, backups and sub-processors.
Principles
- Purpose limitation. Member data is retained only while it serves tribe formation and facilitation.
- Behavioural signals only. Interests, goals, participation, engagement, connection depth — no medical or psychological assessment data.
- Customer as controller. You decide what to send and when it should be deleted. Hytribe acts on documented instructions.
- Derived data follows source data. Vector embeddings are deleted whenever the source profile is deleted.
- Deletion is real. Deactivation removes a member from matching. Erasure removes the record. Different operations, different treatment.
- Backups expire; they are not edited. Deleted records may persist in encrypted backups until the backup window rolls off. We disclose the window rather than hide it.
Retention schedule
Default retention by category. "Active" means for as long as your community remains a customer.
| Category | Retention | Notes |
|---|---|---|
| Member profile (name, interests, goals, availability, timezone) | Active + 30 days after termination | Deleted earlier on erasure request. |
| Platform user ID | Active + 30 days | Pseudonymous upsert key. |
| Vector embedding | Same as source profile | Deleted whenever the profile is deleted or materially changes. |
| Onboarding responses | Active + 30 days | Structured fields survive; raw text can be shortened on request. |
| Psychological profile / WHO-5 / UCLA-3 | Not processed (enterprise) | Disabled at tenant level. |
| Tribe records | Active + 30 days | Membership and formation metadata. |
| Health scores & survey outcomes | Active + 30 days | Retained only in aggregated form after tribe retires. |
| Audit logs | 12 months | Retained for security investigation; minimal personal data. |
| API keys | Until revoked | Stored hashed. Revocation is immediate. |
| Database backups | Rolling backup window | Deleted records persist until PITR window rolls off. |
| Application logs | 30 days | Profile content is not logged. |
| Sandbox — customer data | 30 days rolling | Purged regardless of contract status. |
| Sandbox — demo data | Permanent | Seeded synthetic profiles. No real personal data. |
Deletion triggers
DELETE /members/{platform_user_id}. The member is soft-deactivated and excluded from future matching. Profile and embedding are retained so they can be reinstated. This is not erasure.
On a right-to-erasure request, the member record, onboarding responses, derived profile, vector embedding and tribe membership references are permanently deleted.
On termination you elect export or deletion. All member data, embeddings, tribe records and community configuration for that community_id are deleted, and API keys revoked.
Categories with fixed windows — audit logs, application logs, backups — expire automatically on the schedule in Section 2.
Customer-created data in the sandbox environment is deleted on a rolling 30-day cycle, independent of any contract event. Seeded synthetic demo data is preserved.
Where deletion has to reach
| Location | Completes | Notes |
|---|---|---|
| Primary database (Neon) | Immediate | Record and embedding removed. |
| Database backups / PITR | Backup window | Cannot be selectively purged; window disclosed on request. |
| Application logs | Log retention window | Profile content is not logged in the first place. |
| OpenAI (embeddings) | Provider window | API inputs retained briefly for abuse monitoring per OpenAI's published policy. |
| Anthropic (enrichment / Anton) | Provider window | As above, per Anthropic's published policy. |
| Resend (email) | Provider window | Delivered email content and addresses. |
| Messaging platforms | Not applicable | Messages delivered into your own Slack, Discord or Telegram tenancy remain under your control. |
Summary of customer-facing commitments
| Commitment | Target |
|---|---|
| Member erasure request completed | 30 days |
| Full customer data deleted after termination | 30 days |
| Data export provided before termination | 14 days |
| API key revocation | Immediate |
| Residual copies in encrypted backups expire | Backup window |
| Customer-created sandbox data purged | 30 days |
| Notice before adding a sub-processor | 30 days |
Related: Security & Data Handling · Data Processing Agreement
Privacy review + pilot, in the same 30 days
DPA, retention appendix, sub-processor list and DPIA support — bundled with a scoped pilot for your privacy office.