Data Retention Policy

This document maps every piece of personally identifiable information (PII) the platform stores to its purpose, lawful basis, and retention window. It satisfies the GDPR documentation obligation (Art. 5(1)(e) — storage limitation) and accompanies our Privacy Policy.

1. Data Categories & Retention Windows

Data	PII fields	Purpose	Lawful basis	Retention window
Business owner accountprofiles, businesses	email, name, phone, business details	Platform account management	Contract	Until account deletion + 30 days
Team member profilesstaff, staff_time_off	display name, photo, bio, role title, time-off reasons	Show bookable professionals; scheduling	Contract (with the business)	Until the business deletes the team member — then deleted, or, if they have appointment history, anonymised in place (see section 3)
Team member loginsbusiness_members, profiles	invited email; the person's own login (email, name)	Employee-portal access; after removal, telling the person their access was removed	Legitimate interest	While access is active or pending. A removed login keeps its email until the business deletes the team member or invites someone else in their place; after that only a record linking the person's account to the business is kept (no email), until they delete their mindyOne account or the business is deleted
Customer bookingsbookings	customer_name, customer_email, customer_phone, notes	Appointment record; owner operational need	Legitimate interest	24 months from appointment date, then anonymised
Chat conversationsconversations	customer_email	Session linking	Legitimate interest	12 months from last message
Chat messagesmessages	Full chat transcript text	AI context; owner insight	Legitimate interest	Deleted with their conversation — 12 months from that conversation's last activity
OTP verification codescustomer_otps	email, token_hash	One-time booking verification	Legitimate interest	24 hours from creation
Customer lookupcustomers	email, name, phone	CRM aggregation view	Legitimate interest	Derived from bookings — purged when all related bookings are anonymised
Paymentspayments	Stripe payment intent IDs	Financial record	Legal obligation	7 years (statutory accounting requirement)
Referral linksevent_referrals	referrer_name, referrer_contact (phone or email)	Deliver the referral reward	Contract (steps taken at the referrer's request)	12 months from creation
Referral offer claimsevent_leads	name, contact (phone or email), business_name, instagram	Contact the business about the offer it claimed	Contract (steps taken at the business's request)	12 months from submission
Knowledge baseknowledge_base_documents, knowledge_base_chunks	None (owner-uploaded business content)	RAG context for AI	Contract	Until owner deletes
Uploaded filesSupabase Storage knowledge-base bucket	None	Document source	Contract	Until owner deletes

2. Automated Purge Schedule

Two scheduled jobs enforce these windows automatically, both running once daily overnight (UTC). No manual step is required:

Chat conversations and all of their messages are deleted 12 months after the conversation's last activity, so an active session is never removed mid-conversation.
Bookings are anonymised 24 months after the appointment — customer name, email, phone, and notes are erased while the appointment record itself is preserved for the business. Bookings still awaiting confirmation are excluded, as they are not yet completed records.
The customer lookup record is deleted once every one of its bookings has been anonymised.
Referral links and referral offer claims are deleted 12 months after they are submitted.
One-time booking verification codes are cleared by a separate nightly sweep, 24 hours after they are created.

3. Right to Erasure (GDPR Art. 17)

Business owners can erase a specific customer's data on request from the dashboard Customers page → customer detail panel → "Erase customer data". This:

Hard-deletes all conversations and messages for that email and business
Hard-deletes all OTP codes for that email
Anonymises all bookings (PII fields set to a redacted placeholder)
Removes the customer lookup row

The action is access-controlled (owner only), audit-logged (a non-PII hash of the email and business ID), and applied immediately without waiting for the automated purge schedule.

Business owners can also permanently delete a team member from the dashboard Team page, once that team member has been deactivated:

A team member with appointment history is anonymised: their name is replaced with a placeholder and their photo, bio, role and time-off reasons are removed, so past appointments stay intact
A team member with no appointment history is deleted
Their login to the employee portal is removed. Only a record linking their account to the business is kept, with no email address, so that they are told their access was removed if they sign in again

That record is deleted when the person deletes their mindyOne account or the business is deleted.

4. Right of Access (GDPR Art. 15)

Data subjects may request a copy of their data by contacting the business they booked with. The business owner can generate a complete structured export — the customer record, every booking, and every chat transcript — from the dashboard Customers page → customer detail panel → "Export data (JSON)", and supply it to the requester.

Like erasure, this action is restricted to the business owner. mindyOne does not offer an unauthenticated self-service export: customers book without creating an account, so there is no login against which such a request could be verified.

5. Data Processors

Processor	Purpose	Region	DPA
Supabase	Database, auth, file storage	EU (Ireland)	Supabase DPA
OpenAI	AI chat, intent classification, embeddings	US	OpenAI DPA
Resend	Transactional email	US	Resend DPA
Vercel	Hosting, serverless functions	Edge (global)	Vercel DPA
Stripe	Payment processing	US/EU	Stripe DPA
Upstash	Redis rate limiting	EU	Upstash DPA
AgentaOS	Platform subscription billing (MoR)	US	AgentaOS Privacy

6. Changes to This Policy

This document is updated whenever:

A new table or data category is added to the schema
A retention window is changed
A new data processor is onboarded