Data Retention & Deletion Policy

LeakIQ follows the data-minimisation and storage-limitation principles of the UK GDPR:

• we collect and retain only the data needed to detect and recover revenue leakage for the customer;
• data is retained only for as long as it serves that purpose or is required by law;
• when data is no longer needed, it is deleted or irreversibly de-identified;
• customers remain the data controllers and can request export or deletion of their data at any time.

Certain records (for example those needed to meet legal, tax or accounting obligations, or to resolve disputes) may be retained for longer where the law requires it.

• Removing a connector from the Connected Systems page deletes its encrypted credential immediately, and LeakIQ makes no further calls to that system. There is one exception, and it exists to protect you rather than us: where a stored credential cannot be decrypted, it is retained rather than deleted, because it is the only material that could ever close your authorisation at the provider. Deleting it would strand the access you granted, with no way for either of us to withdraw it. It is never used for anything else, and it is removed when you clear workspace data from Settings, Security, or on your written deletion request.
• On termination of the subscription, LeakIQ makes customer data available for export for 30 days, and deletes it on written request within 30 days of that request. Deletion is not automatic, so ask for it and we will confirm when it is done.
• You can delete workspace data yourself at any time from Settings, Security. That removes issues, recovery actions and approvals, outcomes, recommendations, metrics, raw integration events, sync history and connector connections from the primary data store.
• The audit log is retained rather than deleted. It is a tamper-evident hash chain in which each entry is linked to the one before it, so removing entries would break the integrity of everything after them. It records actions taken rather than your billing or customer data, and personal identifiers are pseudonymised when a user is erased.
• Workspaces are archived rather than deleted, so they can be restored if a customer returns. Archiving removes access; deleting the data inside is the separate step above.
• Residual copies age out of backups within the backup retention window, which is 7 days.

Deleted data may persist temporarily in encrypted database backups until those backups age out of the rolling backup window. Backup copies are not restored into live service except as part of a genuine disaster-recovery event, and are themselves subject to deletion as they expire. This approach balances the right to erasure with the need to be able to recover from data loss. Backup and recovery are governed by the Business Continuity & Disaster Recovery Plan.

Customers, and data subjects via the relevant customer (as data controller), may request erasure of personal data. Requests can be sent to support@leakiq.io. LeakIQ actions valid requests without undue delay, subject to any overriding legal retention obligation, and confirms once complete.

For a user account this means the account record, including name, email address and credentials, is deleted, along with workspace memberships and any API keys that user issued. Audit entries recording what happened are retained, because they are needed to evidence compliance and financial activity. The personal detail attached to those entries is removed, and the reference to the person is left as an identifier that no longer resolves to them, so the record of the event survives without identifying anyone. Workspace data such as recovery cases belongs to the customer rather than the individual and is covered by workspace closure instead.

This policy is reviewed at least annually and updated when retention practices or legal requirements change. Next scheduled review: October 2027.