Data Retention

We keep personal data only for as long as the purpose we collected it for still applies, and then we delete it. Where Indian law requires us to keep something for longer — tax and accounting records, mainly — we keep that, and nothing more.

This page sets out what that means in practice, category by category, so you do not have to take the principle on trust.

• Your account details— email address, name, company, phone number, connected-account usernames. Kept while your account is open. Removed when you delete it.
• Connected-account tokens— your GitHub or GitLab access token, and any autopay mandate. Kept until you disconnect the account or delete yours. We revoke these with the provider before removing them, so a revoked token cannot be reused even in principle.
• Environment variables, database credentials and SSL private keys— deleted when the environment they belong to is torn down. These are the most sensitive things we hold and they do not outlive the environment.
• Project and deployment details— repository URL, commit information, environment names, regions and resource configuration. Kept while your account is open.
• Build history and build logs — kept for 12 months, then deleted.
• Application logsfrom your running applications — kept for 7 days.
• Support chatbot sessions — kept for 30 days.
• Support conversations with our team— kept indefinitely, as the record of what was asked and what we did about it.
• Invoices and payment records — kept for 8 years. See section 3.
• Analytics and usage data— IP address, device information, pages visited and product interactions. Held by our product analytics provider and removed when you delete your account.

Some records we are not free to delete, however much we or you would prefer to. Indian company, tax and GST law require a business to keep its books of account and supporting documents for a fixed period.

For us that means invoices, order and transaction records, amounts, tax and currency are kept for 8 years from the end of the financial year they belong to. We apply the longest of the applicable periods rather than the shortest.

This obligation attaches to the financial record itself. It is not a reason to keep your phone number, your access tokens, or your deployment history, and we do not use it as one.

Separately, certain system logs are subject to a minimum retention period under India’s CERT-In directions. Where that applies, the minimum is shorter than the periods listed in section 2.

You cannot delete your account while resources are still running — stop them first. Once you do delete it, we:

• terminate the cloud infrastructure running your applications, and delete your storage buckets, container images and custom domains;
• revoke your connected-account tokens with the provider, and cancel any autopay mandate, before removing them from our systems;
• remove your account details — email address, name, company, phone number, connected-account usernames and any marketing attribution data;
• ask the providers listed on our Subprocessors page to delete the copies they hold;
• keep the invoices and payment records described in section 3, for as long as the law requires and no longer.

We may also keep a one-way, non-reversible record of your email address for the sole purpose of preventing the same identifier being re-registered abusively. It cannot be turned back into your email address and is not used for anything else.

Some of the providers listed on our Subprocessorspage hold their own copy of some of your data — our email provider holds your address, our support tools hold your conversations, our analytics provider holds usage events.

When you ask us to delete your data, passing that request on to those providers is our responsibility, not something we leave to you to chase. We do it as part of handling your request.

You do not have to wait for a retention period to expire. You can ask us at any time to delete data we hold about you, and you can ask what we hold in the first place.

Write to [email protected]. We respond within 30 days. Where we cannot delete something because a legal retention period applies, we will tell you specifically what is being kept and why, rather than refusing the request as a whole.

Your full set of rights, and how to exercise them, are set out in our Privacy Policy.