Data Retention and Deletion Policy

This Policy describes how long DuruVault retains categories of data and how deletion works. It should be read with the Privacy Policy, Data Deletion Policy, and Data Processing Agreement.

1. Principles

We retain personal data only as long as necessary for the purposes described in the Privacy Policy, to provide the Services, to comply with legal obligations, to resolve disputes, and to enforce agreements and protect security.

2. Retention by Category

Indicative retention (subject to change and legal requirements):

• Account data: for the life of the account, then deleted on account closure (subject to legal/backup exceptions).
• Documents & files and their metadata: until you delete them or close your account.
• Authentication sessions: session tokens expire 7 days after issue.
• One-time codes (email verification, 2FA, login challenges): short-lived (typically 10–15 minutes).
• Password-reset tokens: typically valid for 1 hour.
• Security & audit logs: retained as needed for security, fraud prevention, and compliance.
• Subscription & payment-transaction records: retained as needed for billing, tax, and legal obligations; card data is held by the payment processor, not DuruVault.
• Encrypted disaster-recovery backups: retained for a limited rotation window on the independent off-site archive (Backblaze B2) and by the managed-database provider.

3. User-Initiated Deletion

You can delete documents in-product and can delete your entire account (password confirmation required; administrator accounts cannot self-delete). Account deletion purges documents and their stored objects, folders, shares, verifications, sessions, one-time codes, password-reset tokens, subscriptions, payment-transaction records, identity-verification records, notifications, and passkeys, and removes the account record.

4. Data Export

Before deletion you can export a metadata copy of your documents, folders, shares, and verifications; document files can be downloaded individually from your vault.

5. Backups & Residual Copies

Deleted data may persist in encrypted backups until those backups are rotated out of retention. Backups are encrypted and access-controlled, and restored data is subject to the same deletion rules on restoration.

6. Legal Holds

We may retain specific data beyond standard periods where required by law, for legal claims, or to investigate security or abuse.