Distinct-app
Data Retention Schedule
Last updated: 17 August 2026
This schedule describes how long we intend to keep different categories of records, and why. Rows marked LEGAL/ACCOUNTING CONFIRMATION REQUIRED have not had a specific number of years or months confirmed against South African accounting/tax law or a signed-off internal policy — we've stated the principle honestly instead of inventing a figure. We do not automatically delete legally-required accounting or transaction records, even on request.
| Record type | Purpose | Trigger | Retention period | Basis |
|---|---|---|---|---|
| User accounts | Provide login and app access | Account closure or deletion request | Deleted or anonymised within a reasonable period after closure, subject to the rows below | Contract; POPIA minimality |
| Business accounts | Operate a business's subscription | Subscription cancellation | Retained while active; archived, not deleted, after cancellation (see platform-wide soft-archive pattern) | Contract; accounting obligations below |
| Customer profiles (contacts) | Bookings, rentals, communications | No activity / deletion request | LEGAL/ACCOUNTING CONFIRMATION REQUIRED — no confirmed statutory period identified for this category | Contract; consent (marketing fields only) |
| Booking / rental / event / ticket records | Deliver the booked service, resolve disputes | Booking completion | LEGAL/ACCOUNTING CONFIRMATION REQUIRED | Contract |
| Invoices and transaction references | Accounting, tax, dispute evidence | Invoice issue date | LEGAL/ACCOUNTING CONFIRMATION REQUIRED — South African accounting/tax records are typically kept 5+ years; confirm the exact period with an accountant before publishing a number | Legal obligation |
| Payment status/reference (not card data) | Reconcile payments, refunds, chargebacks | Transaction date | Same as invoices, above | Legal obligation; contract |
| Support requests | Resolve the enquiry | Ticket closure | LEGAL/ACCOUNTING CONFIRMATION REQUIRED | Contract; legitimate interest |
| Marketing consent (active) | Send permitted marketing | N/A — kept while consent stands | Until withdrawn | Consent |
| Withdrawn consent / opt-outs | Evidence you opted out, so we don't re-contact you | Withdrawal event | Kept indefinitely as evidence, separate from other marketing data | Legal obligation (proof of compliance); legitimate interest |
| Security / access logs | Detect and investigate incidents | Log creation | LEGAL/ACCOUNTING CONFIRMATION REQUIRED — a shorter operational window (weeks–months) is typical but not yet formally set | Legitimate interest; legal obligation |
| Audit / consent-event logs | Compliance evidence trail | N/A | Retained as long as the record they document could still be disputed | Legal obligation |
| Deleted account remnants | N/A | Deletion request processed | Removed from active systems immediately; may persist briefly in backups until backup rotation (see Data Processing Locations note) | POPIA minimality |
| Backups | Disaster recovery | Backup creation | Follows the hosting provider's backup rotation window — TO BE CONFIRMED against Supabase's configured retention | Legitimate interest |
| Privacy/data-subject requests | Evidence we responded to your request | Request submission | Retained indefinitely as compliance evidence; never auto-deleted | Legal obligation |