Data Retention Policy
Effective: June 21, 2026 · Armorstack, LLC
This policy describes how long ArmorDraft retains different categories of data and the basis for each retention period. It is supplementary to our Privacy Policy.
Retention Schedule
| Data Category | Retention Period | Basis |
|---|---|---|
| Active project data (project, design, estimate records) | While account is active + 90 days after termination | Service delivery |
| Uploaded drawings and files | 2 years after project status set to 'archived' | Dispute resolution; design reference |
| Estimate runs and BOM exports | 7 years | Contract dispute resolution; standard construction records retention |
| Audit events (immutable log) | 7 years | Security, compliance, and legal hold |
| Account and user profile data | 30 days after account deletion request | Legal minimum; backup purge window |
| Billing records and invoices | 7 years | Tax and financial records requirements |
| Terms of Service acceptance records | 7 years or life of account (whichever is longer) | Contract enforcement |
| Authentication logs (sign-in/out events) | 90 days | Security investigation window |
| Error and performance logs (Sentry) | 90 days | Debugging and reliability |
| Analytics data (Vercel) | 13 months aggregated | Product improvement; Vercel Analytics default |
Deletion Procedures
When a retention period expires, data is deleted automatically by scheduled maintenance jobs. Deleted data is permanently removed from primary storage within 30 days and from backups within 90 days.
Account deletion requests are processed within 30 days. We will retain the minimum data required by law (e.g., billing records, audit logs) for the periods specified above.
Backups
Database backups are retained for 7 days (daily) and 30 days (weekly). Backups are encrypted at rest and subject to the same data protection controls as primary storage.
Audit Logs
Audit logs are append-only and tamper-evident (Merkle-chain protected). They cannot be deleted before their retention period expires, even by Armorstack employees. This is by design to preserve dispute-resolution records and comply with applicable security standards.