Data Retention Policy

Last Updated: September 26, 2026

This Data Retention Policy explains how long kvelpo retains your personal information and the criteria we use for deletion.

1. Data Retention Principles

We follow these principles for data retention:

  • Minimization: We collect only data necessary for our services
  • Necessity: We retain data only as long as needed for its purpose
  • Security: Data is securely deleted when retention period ends
  • Transparency: Clear retention periods for different data types

2. Retention Periods by Data Type

Account and Profile Information

Retention Period: While your account is active

Purpose: Account management and service provision

Deletion: Permanently and immediately deleted the moment you delete your account. There is no grace period

Project Data

Retention Period: While the project exists

Purpose: Project collaboration and management

Deletion: Deleted immediately when you delete the project or your account

Messages and Applications

Retention Period: Until account deletion, then indefinitely in anonymized form

Purpose: Preserving the other party's conversation or application history

Deletion: Immediately disassociated from your identity when you delete your account. The message or application text remains, but is no longer linked to you

Payment and Billing Data

Retention Period: 7 years (financial regulations)

Purpose: Payment processing, fraud prevention, legal compliance

Deletion: Held by our payment processor, Stripe, as required by financial regulations; we do not store your card details ourselves

Consent Records

Retention Period: While your account exists

Purpose: GDPR compliance and consent management

Deletion: Deleted immediately when you delete your account

We do not currently collect analytics or usage-tracking data, so no separate analytics retention period applies. If that changes, we will update this policy first.

3. Early Deletion Criteria

We may delete data earlier than the stated retention periods when:

  • The data is no longer needed for its original purpose
  • You withdraw your consent for processing (where applicable)
  • We receive a deletion request from you
  • The data is inaccurate, incomplete, or irrelevant
  • Retaining the data poses an unacceptable security risk
  • Required by applicable law or regulation

4. Data Deletion Process

When data is deleted, we:

  • Remove it from active databases and production systems
  • Delete it from backups within the retention period
  • Erase it from any third-party services where feasible
  • Securely wipe storage media when physical media is disposed

For certain data types like payment records, we may retain anonymized/aggregated data for business intelligence and compliance purposes.

5. Your Right to Deletion

Under GDPR, you have the right to request deletion of your personal data ("Right to be Forgotten"). You can:

  • Delete your entire account through profile settings
  • Request specific data deletion through privacy@kvelpo.com
  • Withdraw consent to stop further processing

We will respond to deletion requests within 30 days, subject to any legal obligations we may have to retain certain data.

6. Exceptions to Deletion

We may retain data beyond the stated periods when:

  • Legal Requirements: Required by law, court order, or government regulation
  • Security Purposes: Necessary for fraud prevention, security threats, or technical issues
  • Business Operations: Essential for legitimate business interests where deletion would impair our ability to provide services
  • Contractual Obligations: Required to fulfill our contractual obligations to you
  • Dispute Resolution: Needed to establish, exercise, or defend legal claims

7. Data Anonymization

Where possible, we anonymize or pseudonymize data before long-term retention. This means:

  • Removing personally identifiable information
  • Using unique identifiers instead of personal data
  • Aggregating data to prevent identification of individuals
  • Applying statistical techniques to prevent re-identification

8. Updates to This Policy

We may update this Data Retention Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the "Last Updated" date.

9. Contact Information

Company: Kvelpo SIA

Email: privacy@kvelpo.com

Address: "Melnāji", Suntažu pagasts, Ogres novads, LV-5060, Latvia

Data Retention Policy | kvelpo