SuccessionStackLegal

Data Retention & Erasure Policy

This policy describes how long SuccessionStack retains data and how customers exercise the right to erasure. It supports the Privacy Policy and DPA.

1. Retention schedule

  • Workforce and succession data: retained while the customer’s account is active, then deleted or returned on the customer’s instruction.
  • Audit log: retained for the life of the account as an integrity and security record (immutable; not editable in-product).
  • AI interaction records: retained for 90 days for budgeting, abuse monitoring, and incident investigation, then automatically purged. These records include the prompt text and the model’s response, which may contain employee names where a user asked about a specific person. They are readable only by workspace administrators.
  • Deletion archive: when a record is deleted in-product, a copy is kept for 90 days, then automatically purged. An administrator can put a deleted record back from Settings → Recently deleted within that window. Coverage is deliberate rather than universal: it spans employees, succession plans and their benches, succession and calibration sessions with their ratings and decisions, talent reviews, development plans, talent pools, and what-if scenarios. Restoring a person brings back that person and the bench positions they held; it does not rebuild every individual rating ever recorded about them. Full-workspace erasure removes archived copies immediately rather than waiting out this window.
  • Backups: daily encrypted snapshots are retained on a rolling 30-day cycle by our database platform; erased data ages out of backups within that cycle. Backups are not selectively edited, so erased records may persist in a snapshot until it rolls off.

2. Self-service export

A workspace administrator can download their data at any time from Settings → Data & Privacy — employees, plans, candidates, requirements, dimensions, weights, and audit history. A full-account archive is also built automatically each week and kept for 14 days, so a copy exists without anyone having to remember to ask for one. Your data is yours; there is no lock-in.

Every archive states whether it is complete. If a table was too large to include whole, or could not be read, the export says which table and how many rows are missing rather than presenting a partial file as a full copy.

3. Self-service erasure

From Settings → Data & Privacy, an administrator can request permanent erasure of the entire workspace. To guard against mistakes and account takeover, the request:

  • requires the administrator to type the workspace name to confirm;
  • enters a 30-day grace window during which any administrator can cancel it;
  • is recorded in the audit log at request, cancellation, and completion.

After the grace window, all personal and workforce data for the workspace is permanently and irreversibly deleted across every data store, and the workspace is deactivated. Export first if you may need the data.

4. Erasure SLA

  • Self-service request: a workspace administrator can request erasure in-product at any time. The request starts a 30-day grace window during which it can be cancelled. After the window closes, erasure is carried out by an operator and completed within 5 business days. We are automating this final step; until that automation has been validated against an isolated restore, it is performed manually and deliberately, and we describe it that way rather than implying it is instantaneous.
  • Controller instruction (via support): we action verified erasure instructions without undue delay, and in any event within 30 days of verifying the request.
  • Backups: erased data is purged from backups within the backup retention cycle noted above.

5. Legal holds

We may retain limited data where required by law or to resolve disputes; such data is isolated and not used for any other purpose.

6. Contact

Erasure questions: privacy@successionstack.com.