Data Retention Schedule

Last updated: 21 August 2026

This schedule describes how long we keep different categories of records, and why. We do not automatically delete legally required accounting or transaction records, even on request.

Record type	Purpose	Trigger	Retention period	Basis
User accounts	Provide login and app access	Account closure or deletion request	Deleted or anonymised within a reasonable period after closure, subject to the rows below	Contract; POPIA minimality
Business accounts	Operate a business's subscription	Subscription cancellation	Retained while active; archived, not deleted, after cancellation	Contract; accounting obligations below
Customer profiles (contacts)	Bookings, rentals, communications	No activity / deletion request	Retained for the duration of the business relationship, and up to 2 years after the last activity	Contract; consent (marketing fields only)
Booking / rental / event / ticket records	Deliver the booked service, resolve disputes	Booking completion	5 years from booking completion	Contract
Invoices and transaction references	Accounting, tax, dispute evidence	Invoice issue date	7 years from the invoice date, per the Companies Act 71 of 2008	Legal obligation
Payment status/reference (not card data)	Reconcile payments, refunds, chargebacks	Transaction date	Same as invoices, above	Legal obligation; contract
Support requests	Resolve the enquiry	Ticket closure	3 years from ticket closure	Contract; legitimate interest
Marketing consent (active)	Send permitted marketing	Kept while consent stands	Until withdrawn	Consent
Withdrawn consent / opt-outs	Evidence you opted out, so we don't re-contact you	Withdrawal event	Kept indefinitely as evidence, separate from other marketing data	Legal obligation (proof of compliance); legitimate interest
Security / access logs	Detect and investigate incidents	Log creation	90 days from log creation, unless retained longer as part of an active investigation	Legitimate interest; legal obligation
Audit / consent-event logs	Compliance evidence trail	N/A	Retained as long as the record they document could still be disputed	Legal obligation
Deleted account remnants	N/A	Deletion request processed	Removed from active systems immediately; may persist briefly in backups until rotation	POPIA minimality
Backups	Disaster recovery	Backup creation	Retained on a rolling basis and overwritten after 30 days	Legitimate interest
Privacy/data-subject requests	Evidence we responded to your request	Request submission	Retained indefinitely as compliance evidence; never auto-deleted	Legal obligation