Version 1.1 · Last updated 1 September 2026 · Effective 1 September 2026
Data retention schedule
How long each kind of data is kept, and why. When the period ends, data is deleted or anonymised within 30 days.
Schedule
| Data | Kept for | Reason |
|---|---|---|
| User ID profile and settings | While open, then 30 days after deletion is confirmed | Contract; lets you change your mind |
| Content, files and mail | While open; 30 days in backups after deletion | Contract |
| Invoices, payments, payout records | 6 years from the end of the financial year (7 where US tax rules require) | HMRC and company law |
| Business verification documents | 5 years after the business closes | Anti-money-laundering and fraud prevention |
| Security logs (sign-ins, IPs) | 180 days | Security and fraud prevention |
| Enforcement cases and reviews | 3 years after the case closes | Consistency, appeals and legal claims |
| Support tickets | 3 years after closing | Service quality and legal claims |
| Marketing consent records | For as long as consent is active, plus 3 years | To prove consent |
| ID and selfie for account recovery | 30 days after the decision | Only needed to decide |
| Backups | 30 days, rolling | Disaster recovery |
Legal holds
If data is needed for a legal claim, an investigation or a request from an authority, we keep it until that is resolved, and only that data.
Questions about this document? Write to [email protected], or use the Help Center.