Data Retention, Backups & Recovery

1. Access expiry and the live ledger

Promotion, valid trial/paid/sponsored access and lifetime grants are evaluated before expiry. When a scope becomes inactive, paid changes stop. Sign-in and billing remain open unless separately restricted for abuse/security. Personal and Owner scopes have separate deadlines.

The normal inactive-ledger period is 30 days from the recorded expiry/inactivity point. Where permitted by the existing access policy, retained records can be read/exported during that period. Rent-only tenants do not acquire free Personal Ledger access through retention. Existing expired accounts first observed during rollout receive a fresh notice period rather than immediate deletion.

Renewing or receiving a valid grant cancels the scope’s retention deadline. After the period ends, ledger access closes and records can become eligible for scoped cleanup. A hold, dispute, applicable obligation, lack of a current verified backup or disabled cleanup can delay deletion. Current policy acknowledgement/notice safeguards also apply to rollout.

2. What routine cleanup covers

Personal cleanup covers that account’s ledger entries, plan rows/templates, income/expense categories and saved salary/expense-report settings. Owner cleanup covers that Owner’s Property Ledger income, expenses, templates/categories and saved property share/area report settings.

It does not delete user accounts/Login IDs, properties, apartments, tenancies, submeter readings, shared rent bills/receipts, subscription invoices/payments, feedback history or audit history. Shared/transaction/support records are assessed separately because other people, disputes or applicable obligations may be involved. A data hold preserves data, not paid access.

We review the necessity of retained shared/payment/support records and consider proportionate minimisation or erasure requests. They are not declared permanently exempt from privacy rights simply because they are excluded from the routine ledger job.

Payment screenshots and feedback screenshots have their own availability and cleanup rules, described in the Privacy Notice. Closing a feedback report does not currently trigger automatic screenshot deletion.

3. Backups and realistic limits

Operator-managed backup tooling creates encrypted logical MongoDB archives. The intended schedule is daily when the configured runner, internet and database are available. It is not an uninterrupted hosted-backup or point-in-time recovery guarantee; a switched-off laptop cannot take a snapshot. Users should keep important exports and original documents.

Normal archive rotation is 60 days and happens after a new verified backup succeeds. The newest valid backup and files affected by a failed rotation can remain longer to avoid losing the only recovery copy, subject to review and applicable obligations.

A snapshot made just before day-30 ledger cleanup can contain those old records for roughly another 60 days. Ordinary physical persistence can therefore approach 90 days from inactivity, or longer where a safety/hold/rotation exception applies. We do not advertise deletion of every copy exactly 60 days after inactivity.

4. Recovery requests

The normal service-support window for asking about inactive-ledger recovery is 60 days from inactivity. Recovery is subject to a usable backup, identity/authority checks and protection of other users’ records; it is not guaranteed. Renewal does not automatically restore previously cleared entries.

Restoration is first assessed in an isolated environment. An approved recovery must not expose other accounts or reintroduce records already subject to an approved correction/erasure. Contact support for availability and any separately disclosed work/fee before agreeing to it.

This support window does not limit your legal rights to request information, correction, erasure or complaint after 60 days.

5. Erasure requests and rollout

Account closure, consent withdrawal and a lawful erasure request are different from simply not renewing. Contact support for individual assessment. Where deletion/correction must be propagated to archives, test copies or providers, we will address those copies under applicable requirements rather than treating ordinary rotation as an automatic exemption.

During UAT or a policy rollout, automatic cleanup can be disabled. This notice describes the implemented retention process and its safeguards, not a claim that scheduled deletion or daily backups have already run successfully for your account. Check the account’s displayed access/deadline and contact support if unclear.