DRAFT — pending legal review, not yet in force. This document has not been reviewed by qualified legal counsel and does not constitute a binding agreement or legal advice.
Data retention policy
How long we keep each kind of data, and why.
Company data (while your account is active)
Your fleet, crew, certificate, maintenance, and document records are kept for as long as your account is active, so the service works. When you request erasure or close your account, this data is deleted through our guarded erasure process. We do not run an automatic purge a fixed number of days after cancellation — deletion happens on request or on account closure.
Regulatory records (kept for the life of the account)
Seafarer hours-of-rest records and crew certificate records are kept for the life of the account. These are statutory maritime records under MLC 2006 and STCW that a flag state or port-state control inspector can require, so we do not age them out on a rolling window. They are removed only when the account is erased.
Operational data (time-boxed)
Some operational data is transient and is purged automatically once it is no longer needed:
| Data | Kept for | Why |
|---|---|---|
| Transactional email send log | 90 days | Records that a compliance-alert email was sent; not useful afterwards. |
| Billing idempotency records | 180 days | Prevents duplicate processing of a payment webhook; expires well after any retry window. |
| Unconverted prospect enquiries (contact form) | 365 days | Enquiry details from people who did not become customers, kept briefly for follow-up then erased. |
Backups & erasure
When you request erasure, your live (production) data is deleted immediately. As is standard, copies of your data also exist in backups, which cannot be edited row-by-row:
- Database backups are retained on a rolling window configured in our database provider (Supabase). The exact retention length is confirmed by the account owner; it is on the order of a week for the managed daily backups. Personal data in these backups ages out automatically as the window rolls forward.
- Off-site document backups. Uploaded document files are additionally copied to an off-site backup on a nightly, incremental basis for disaster recovery.
- If a backup is ever restored, we re-apply any erasure that had already been carried out, so restoring a backup does not resurrect data you asked us to delete.
This is the standard GDPR position: erasure removes your live data at once, and backup copies fall away as the backup window rolls or are re-erased on restore.
Related documents
For the processing terms behind this policy, see the Data Processing Agreement. To exercise your rights, see Your data protection rights or email support@pivotscanner.com.
Last updated: 2026-07-12