Legal ยท Draft
Data Handling and Deletion
1. Overview
This Data Handling and Deletion Schedule ('Schedule') is maintained by Vital Webmaster LLC and forms part of our Privacy Policy and Terms of Service. It specifies how long we retain each category of personal data, the legal basis for that retention, and the secure deletion or anonymization methods applied upon expiry or upon a verified deletion request. This Schedule is reviewed and updated at least annually and whenever material changes to our data practices occur.
2. Retention Periods by Data Category
The table below sets out the retention period, deletion trigger, and deletion method for each category of data we process:
| Data Category | Retention Period | Deletion / Anonymization Method | Retention Purpose |
|---|---|---|---|
| Contact & Identity Information | Account duration + 2 years | Secure erasure on verified request or 2 years post-close | Account management, support, legal compliance |
| Account & Profile Data | Account duration + 2 years | Secure erasure on verified request or 2 years post-close | Account security, personalization |
| Billing & Payment Data | 7 years after transaction | Anonymization after tax-retention period | Tax, accounting, regulatory compliance |
| Usage & Activity Data | 2 years from collection | Rolling deletion; anonymized after 2 years | Analytics, security, service improvement |
| Uploaded Content / Files | Account duration + 30 days post-close | Secure multi-pass overwrite + third-party confirmation | Service delivery, user access |
| Support / Communications | 2 years after last interaction | Secure erasure; anonymized summaries retained | Support, dispute resolution, quality assurance |
| AI-Generated Outputs | Account duration + 90 days | Secure erasure on account close | Service delivery, output history |
| Marketing & Preferences | Until opt-out or 2 years inactivity | Immediate erasure on opt-out | Marketing, preference management |
| Cookies & Analytics Data | 13 months (analytics); session (essential) | Auto-expired; browser deletion on consent withdrawal | Site performance, analytics |
| Third-Party Integration Data | Integration duration + 1 year | Coordinated with third-party provider; confirmation obtained | Workflow automation, integrations |
| Legal & Compliance Data | 7 years or as required by law | Legal hold review before any deletion | Legal, audit, regulatory compliance |
| Data Subject Requests | 2 years from request resolution | Secure erasure after retention period | Compliance documentation, audit trail |
3. Deletion Methods
We apply the following methods depending on the data type and storage medium:
- Electronic data: multi-pass overwriting (DoD 5220.22-M) or cryptographic erasure
- Database records: secure SQL DELETE with audit log entry; backups rotated on schedule
- Cloud storage: provider secure-delete API (the storage provider's secure-delete function)
- Backups: retention period aligned with primary data; overwritten on next backup cycle
- Physical media: not applicable (we do not store data on physical removable media)
- Third-party processors: deletion coordinated via DPA; written confirmation obtained
4. Third-Party Processor Deletion Coordination
When data is deleted from our systems, we also initiate deletion from our third-party processors. The table below identifies each processor and our coordination procedure:
| Category | What they receive | Why |
|---|---|---|
| Hosting (our own servers) | Account data, watchlists, portfolio records | Running the service |
| Network edge and DNS provider | IP address and request metadata | Delivering the site and protecting it from abuse |
| Domain registries and registrar | The domain names you check (never your identity) | Answering availability and price |
| Transactional email provider | Your email address and the message | Account and report emails |
| Payment processor (when paid plans start) | Billing details | Taking payment; not active today |
The named list of providers is given in the signed DPA and on request to [email protected].
5. Data Subject Deletion Requests
To request deletion of your personal data, contact [email protected]. We will: (1) verify your identity; (2) delete or anonymize all applicable data within 30 days (GDPR) or 45 days (CCPA); (3) notify relevant sub-processors; (4) provide written confirmation of deletion. Certain data may be retained longer if required by law (e.g. billing records for tax compliance).
6. Audit and Review
Deletion and anonymization actions are logged in our compliance audit trail. This Schedule is reviewed annually, after any material change to our data practices, and after any data breach or regulatory inquiry. Last reviewed: see document version. Contact [email protected] with questions.
Machine-drafted from the CloviTek base terms (9 October 2026) and edited for ZoneVouch. Not legal advice.