Data Retention Policy
Last updated 2 October 2026Effective 26 September 2026
Our approach
We keep personal data only for as long as we need it to provide the service, keep it secure and meet our legal obligations.
Retention schedule
| Data | Where it is kept | How long |
|---|---|---|
| Email messages and attachments | Our mail servers | Until you delete them, or your account is deleted |
| Contacts, calendars and tasks | Our mail servers (CalDAV/CardDAV) | Until you delete them, or your account is deleted |
| Notes | A "Notes" folder in your mailbox | Until you delete them, or your account is deleted |
| Chat messages | Our servers | Until deleted, or your account is deleted |
| Bookings made on your booking page (visitor's name, email address and answers) | Our servers | 90 days after the meeting, then deleted automatically |
| Leads and their history (encrypted) | Our servers | Until you delete them, or 12 or 24 months after their last activity (24 months by default), or your account is deleted |
| Vault items (end-to-end encrypted: we cannot read them) | Our servers | Until you delete them. Items in the Vault's Trash are deleted 30 days after you move them there. A record that a deleted item existed (with no content) is kept 90 days. Resetting your encryption keys erases the Vault |
| Account data, recovery email, profile | Our servers | For the life of your account |
| Mailbox sharing records and the log of what the other person did (no subjects or message text) | Our servers | While the access lasts, then 12 months after it ends. If an account is deleted, its address in these logs is replaced with a pseudonym |
| Shared mailboxes of a workspace (such as support@) and their mail | Our mail server | Until the workspace owner deletes them. If the workspace is deleted, they are kept, closed, until a workspace with the domain reconnects or deletes them |
| Session (including encrypted mailbox password) | Our servers | Until you sign out. Without "Keep me signed in", until you close your browser. A session unused for 400 days ends by itself |
| Sign-in security logs (time, IP, device, success/failure) | Our servers | 90 days, then deleted automatically |
| Password reset codes | Our servers | 15 minutes |
| Two-step verification secret, backup code hashes, passkeys, trusted devices | Our servers | Until you remove them or delete your account |
| OpenPGP keys | Our servers (private key encrypted by you) | Until you remove them or delete your account |
| Call media | Not stored | Calls are not recorded |
| Aggregate usage statistics | Our servers | Kept in aggregated form that does not identify you |
| Booking page statistics (daily counts only, nothing that identifies a visitor) | Our servers | 13 months (400 days), then deleted automatically |
| Support correspondence | Our mail systems | 2 years after the last message |
| Backups | None | We do not keep separate backups |
| Offline mail copy | Your browser (IndexedDB) | Until you sign out |
Deleting your account
You can delete your account at any time in Settings, Account. This permanently deletes your mailbox and its contents and cannot be undone. Residual copies in backups are overwritten on the normal backup cycle. Before deleting, you may want to download your mail using IMAP or "Show original", or ask us for an export at [email protected].
Exceptions
We may keep specific data for longer where we are legally required to, or where it is needed to establish, exercise or defend legal claims, for example evidence of serious abuse. We will keep only what is necessary and delete it when it is no longer needed.
Business accounts
Draft for legal review. This part describes Business Viremail and does not apply until it has been approved and published.
| Business data | How long |
|---|---|
| Business analytics: logged events | 12 months by default (the business can choose 1 to 84 months) |
| Presence | 6 months by default (1 to 24 months) |
| Daily and monthly totals | 25 months by default (13 to 84 months) |
| Location history, if used | 30 days by default (7 to 180 days) |
| One-time password links | Until used, or 72 hours |
| A suspended business | Kept until closure, 180 days after a failed payment or the end of the free month |
| Invoices and the business audit log | 7 years |
| Working time records in Rota: shifts, clock events, time off and timesheets | UK 6 years, US 3 years, Australia 7 years, EU 5 years by default; never less than the legal minimum |
| Clock-in location points, if the business checks them | 90 days, then removed from the clock event |
| Invoices a business issues in Billing (coming soon) | The end of the financial year plus the period tax law sets: UK 6 years, Australia 5 years, the US 7 years as a guide, India 8 years, and in the EU it varies by country. The default is 8 years |
| Review request link and open counts (coming soon) | 13 months |
| The business people book | Until the business deletes the person or closes |
| Reports about business pages, and our decisions | 3 years |
The full timeline for a business that stops paying is in our Business terms.