1. Status of the retention schedule
Personal data should be kept only as long as needed for the stated purpose or a specific applicable legal requirement. A final record-by-record schedule, provider/backup lifetimes and deletion runbook still require business and legal approval. The current application has no universal automatic purge schedule.
A single retention period does not suit every booking or identity record. This draft describes the decision criteria and the browser durations currently configured; a deletion request is complete only when its outcome is confirmed.
2. Server-record decisions
| Category | Purpose and review trigger |
|---|---|
| Account and profile | Needed for an active service relationship. Review on closure, withdrawal or inactivity; distinguish public-profile removal from deletion of required records. |
| Bookings and payments | Needed for active care, reconciliation, refunds and disputes. Retain only the fields required by an identified accounting, tax or claims obligation; care notes should not automatically inherit a financial-record period. |
| Verification evidence | Review after verification, rejection or closure. Separate raw documents/identifiers from a minimal verification outcome; keep additional evidence only for a documented need. |
| Support, reports and location events | Review when the issue or journey ends and when any justified investigation or claim hold expires. Sensitive content needs a particularly limited scope. |
| Audit logs and backups | Security and recovery need defined access, retention and expiry. Production/provider settings and backup cycles require confirmation; a restored backup must not silently undo a completed deletion. |
3. Browser storage lifetimes
- Account cookie: 7 days, or cleared from that browser on sign-out.
- Administrator cookie: 4 hours, or cleared on administrator sign-out.
- Cookie-choice record: valid for 180 days from saving and tied to the cookie-policy revision. An expired local-storage record may remain on disk, but no longer authorises optional features.
- Optional city/view preference: used only while permission remains valid; removal is attempted on refusal or expiry. Browser restrictions may prevent storage removal.
Third-party chat records and storage have separate provider lifetimes that require confirmation. Turning chat off stops the active widget, but is not a request to erase earlier messages held by the provider. See Cookie Policy.
4. Deletion and account closure
Email privacy@auntynow.com or follow Privacy Requests & Account Deletion. Requests need identity/authority verification and manual review. There is no instant account-closure button; signing out or clearing a browser does not close an account or erase server records.
Open bookings, unsettled balances, a specific legal duty or a justified legal claim may require limited retention. The response should explain which records remain, why, and the review/expiry criteria. Only the necessary data should be retained, with use restricted to the justified purpose.
5. Anonymisation and provider copies
Removing a name alone is not necessarily anonymisation. Information is outside personal-data retention only where a person can no longer reasonably be identified. Deletion planning must include processors, exports and backups; this policy does not claim that all provider copies disappear immediately after a request.