1. Principle
OptimReach retains personal data only for as long as necessary to fulfil the purposes for which it was collected, to provide the Services under our agreement with you, and to comply with legal obligations. When data is no longer required, it is securely and permanently deleted.
2. Retention Schedule
| Data Category | Retention Period | Basis / Notes |
|---|---|---|
| Customer account data (name, email, workspace config) | Duration of subscription + 90 days | Contract - 90-day grace period allows account recovery |
| WhatsApp conversation messages | Configurable by Customer (default: 12 months) | Customer instruction - Customer may reduce this in Settings |
| WhatsApp end user profiles (Customer contacts) | Duration of subscription + 90 days | Contract |
| Order, appointment, and lead records | Duration of subscription + 90 days | Contract |
| Payment transaction records | 7 years from transaction date | Indian Companies Act / GST compliance |
| Invoices and billing records | 7 years | Indian accounting and tax law |
| Email communications (support, sales) | 3 years from last interaction | Legitimate interests |
| Support tickets | 2 years from ticket resolution | Legitimate interests |
| Website visitor events (analytics) | 13 months rolling | Legitimate interests - standard analytics period |
| Automated database backups | 30 days | Backups rotate on a 30-day cycle |
| Audit logs (security events) | 12 months | Security and fraud prevention |
| API keys (hashed) | Until revoked by Customer | Contract |
| Staff invitation tokens | 7 days from issue (then expired) | Security |
| Password reset tokens | 1 hour from issue (then expired) | Security |
3. Deletion Process
When data reaches the end of its retention period:
- Customer-facing data is soft-deleted first, then hard-deleted after a 30-day confirmation period.
- Backups containing the data are allowed to expire on their normal 30-day rotation schedule.
- Media files stored in Cloudflare R2 are deleted from storage and the CDN edge cache is purged.
- We do not retain "deleted" data for analytics or product improvement. Deletion is permanent.
4. Customer-Requested Deletion
Customers may request deletion of their workspace data at any time by emailing privacy@optimreach.in. We will action the deletion within 30 days and confirm by email.
5. Data Subject Erasure Requests (GDPR / DPDP)
Where an End User of a Customer exercises their right to erasure, the Customer (as Data Controller) should instruct OptimReach via privacy@optimreach.in. We will process the erasure within 30 days and confirm. We will not action direct erasure requests from End Users without Customer instruction, as the Customer is the Data Controller for End User data.
6. After Account Termination
On termination of a Customer's subscription:
- All workspace data is retained for 90 days to allow account recovery or data export.
- After 90 days, all workspace data - including customer contacts, conversations, orders, and flows - is permanently deleted.
- Financial records (invoices, payment history) are retained for 7 years as required by law.
- You will receive an email reminder 14 days before permanent deletion occurs.