Data Retention and Deletion
How long everything is kept, including backups, and what deletion actually means.
Version 1.2 · Effective 10 September 2026 · Last updated 10 September 2026
Retention periods for data we hold as controller, and our position on data held as processor.
1. Data we hold as processor
The customer sets the retention. We hold their content for the subscription and for 30 days after access ends, then delete it, unless they instruct return or earlier deletion. Customers can export everything from their account at any time.
Our own policy library includes a retention schedule module to help customers set periods for care records, safeguarding, personnel, incidents and complaints. Those periods are theirs to determine; we do not impose them.
2. Data we hold as controller
| Record | Period | Why |
|---|---|---|
| Account and profile | Subscription + 30 days | Contract |
| Invoices, payments, accounting records | 6 years from end of accounting period | Companies Act 2006, HMRC |
| Sign-in and session records | 12 months | Security investigation |
| Export logs and licence references | 24 months | Protecting intellectual property |
| Support and complaint correspondence | 24 months after closure | Service quality, dispute record |
| Sales enquiries that did not convert | 24 months from last contact | Legitimate interests |
| Marketing suppression list | Indefinite | So we never contact someone who opted out again |
| Application error records | 90 days | Diagnosis |
| AI prompts and generated answers | 90 days | Abuse detection and fault diagnosis |
| Support access records (who viewed which account, when) | 24 months | Accountability to the customer |
| Failed sign-in attempts, blocked email addresses, blocked IP addresses | 12 months, longer while an investigation is open | Detecting and stopping attacks; evidence if one is reported |
| Administrative console audit log | 6 years | Governance, and evidence of who changed what |
| Prospect and cold-calling records | 24 months from last contact | Legitimate interests; see the Privacy Policy, section 4 |
3. Backups — said plainly
Deleting a record removes it from the live system immediately. It may persist in an encrypted backup for up to 35 days until that backup expires on its rotation. We do not surgically edit backups; doing so would compromise their integrity as a recovery mechanism. If a backup is restored, deletions are re-applied. This is the standard position and we state it rather than imply that deletion is instantaneous everywhere.
4. Deletion on request
Account deletion is available from within the Service and removes the account, its content and its files, subject to the financial records we must keep by law. To ask us to delete something else, email hello@careshieldcompliance.co.uk.
Care Shield Compliance is a division of Africa Procurement Group Ltd, registered in England and Wales, company number 10553435. Registered office: Devonshire House, One Mayfair Place, London, England, W1J 8AJ. Questions about this document: hello@careshieldcompliance.co.uk.