Data Retention.

Effective date: 2026-10-27.

This Data Retention Policy (this "Policy") explains how long wrxstack ("wrxstack", "we", "us") keeps personal data and other information, and what happens to it when the reason for keeping it ends. It applies to the wrxstack products, including Atlas at atlas.wrxstack.com and Folio, the portfolio and personal-site builder, at portfolio.wrxstack.com, and to the website at wrxstack.com (together, the "Service").

This Policy supplements our Privacy Policy, which describes what we collect and how we use it, and our Data Deletion Policy, which explains how to have your data deleted. Where we process data for an organization under our Data Processing Addendum (the "DPA"), the DPA also applies, and it controls if the two differ on a matter of processing for that organization.

1. Scope and roles

This Policy covers all information wrxstack holds in connection with the Service, in every system where we hold it: the live Service, uploaded file storage, operational logs, email, and backups kept by our hosting provider. It covers information about people who hold an account, people who are members of a workspace, people who visit our website or contact us, and people whose data a user places in the Service.

Where we decide. For accounts you open yourself, and for data we hold for our own purposes, such as billing records, messages you send us, and security records, wrxstack is the controller and sets the retention periods in this Policy.

Where an organization decides. Where you use the Service through a workspace that your employer or another organization (the "Customer") controls, the Customer decides how long the content in its workspace is kept, and we follow its instructions. Section 11 explains how this works.

Who operates wrxstack. wrxstack is an independent, privately owned product run by a small team. Every retention and deletion question is handled through contact@wrxstack.com.

2. Our retention principles

We aim to apply the following principles to every category of data, wherever you live:

• Purpose. We keep data only for a specific purpose that we have told you about, and we do not keep it in case it becomes useful later.
• Necessity. We keep data for no longer than that purpose requires. When the purpose ends, we delete the data or make it so that it can no longer identify you.
• Least data. Where we must keep a record for longer, for example to show that we honored a request, we keep the smallest record that serves the purpose, not the underlying content.
• No other use. Data kept for a legal, security, or record-keeping reason is used for that reason only. It is not used for marketing, product analysis, or any other purpose.
• Your control. Content you create is yours to keep or delete. We do not keep it after you delete it, except in backups for the period described in section 8 and in the cases in section 9.

These principles reflect the storage limitation and data minimization rules in Article 5(1)(c) and (e) of the EU General Data Protection Regulation and the UK General Data Protection Regulation (together, "GDPR"), the rule in the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), that a business may not keep personal information for longer than is reasonably necessary for each disclosed purpose, the Swiss Federal Act on Data Protection, and similar laws in other places. Where a law that applies to you sets a stricter rule, we follow that law.

3. How we set retention periods

Some periods in this Policy are fixed lengths of time. Others are set by an event, such as the deletion of your account, because the right length of time depends on how you use the Service. Where a period is set by an event, the law requires us to tell you the criteria we use, and we use these:

• whether the data is still needed to provide the Service you asked for;
• whether you can delete the data yourself in the product, in which case you control the period;
• whether a law requires us to keep the data for a set time, such as tax and accounting law;
• whether the data is needed to protect the Service, its users, or the public against fraud, abuse, or a security incident;
• whether the data is needed to establish, exercise, or defend a legal claim, or is subject to a legal hold under section 9;
• for data held by a service provider for us, the period that provider's systems allow and its terms set.

We do not state an exact number of days where the period depends on a service provider's systems, because we do not control those systems and will not state a figure we cannot stand behind. In those cases we say so plainly in the schedule.

4. Retention schedule

The tables below list every category of data we hold, what it includes, how long we keep it, and why. "Deleted from the live Service" means removed from the database and file storage that run the Service. Copies may then remain in backups for the period described in section 8. Cookies and similar technologies, with their individual lifetimes, are listed in our Cookie Policy.

4.1 Account and sign-in data

4.2 Content and product data

4.3 Billing, communications, and marketing

4.4 Technical, security, and analytics data

4.5 Records of privacy requests

4.6 Backups

5. Legal bases for keeping data

If you are in the European Economic Area, the United Kingdom, or Switzerland, each retention period in section 4 relies on one or more of the following legal bases under Article 6(1) of the GDPR:

For California residents, each category in section 4 corresponds to a category of personal information in our California Notice, and the periods in section 4 are our disclosure of how long we keep each category, as the CCPA requires.

6. What triggers deletion

Data is normally deleted from the live Service when the first of these events happens, subject to section 9:

• You delete it. You delete an item, a file, an integration, or a sign-in method in the product.
• You delete your account. Your account and the data you own are deleted, as set out in our Data Deletion Policy.
• A workspace is deleted. All content in that workspace is deleted for every member.
• A period ends. A fixed period in section 4 ends, such as the 400-day limit for Folio visit statistics or the 24-month limit for request records.
• The purpose ends. A session expires, an invitation is accepted or expires, or a matter in our mailbox is closed and has no continuing purpose.
• You withdraw consent or object. You unsubscribe from the newsletter or withdraw consent to analytics, or you object to processing based on legitimate interests and we have no overriding reason to continue.
• A Customer instructs us. An organization deletes content in its workspace, or asks us to delete or return its data when its agreement ends.
• We close the account. If we close an account under our Terms of Service, its data is deleted on the same basis as if you had deleted it, apart from the records in section 9.

7. How we delete data

• Live Service. Deleted records are removed from the database. Uploaded files are removed from file storage, not only hidden.
• Failures are retried. If a step fails for a technical reason, such as a storage service that is briefly unavailable, the Service is designed to record the failure and retry the step. A temporary failure does not cancel a deletion.
• Records we must keep. Where a record must be kept for a reason in section 9, we keep only that record, separate it from the rest of your account where possible, and restrict its use to that reason.
• Service providers. Where a service provider holds data for us, the data is deleted through that provider's own deletion process or under its data-handling terms.
• No recovery. Once data is deleted from the live Service, we cannot restore it for you. If you want a copy, export it or ask us for an export before you delete.

8. Backups

Our hosting provider makes encrypted backups of the database so that the Service can be restored after a failure. Backups are not edited record by record. When data is deleted from the live Service, copies of it remain in existing backups until the provider's ordinary backup rotation overwrites them, and are then gone. The length of that rotation is set by the hosting provider and the service plan in use. We do not control it, and we do not state a figure for it.

While data remains in a backup:

• it is encrypted at rest by the hosting provider and is not accessible through the Service;
• we use it only for disaster recovery, and we do not use backups to restore an individual account;
• if we have to restore the Service from a backup, we take reasonable steps to re-apply the deletions completed since that backup was made.

9. Legal holds and other exceptions

We may keep data beyond the periods in section 4, or after a deletion request, in cases such as the following, for as long as the case lasts and to the extent the case requires:

• Legal holds. Where we receive, or reasonably expect, a legal claim, a regulatory investigation, or a valid legal demand such as a court order, we may suspend the deletion of the data relevant to that matter. Held data is kept apart where possible, access to it is restricted, and it is used only for that matter. When the matter is finally resolved, the hold is lifted and the data is deleted under the normal schedule.
• Legal obligations. Where a law requires us to keep a record for a set time, such as tax and accounting records, we keep that record for that time.
• Security and abuse. Where data is needed to investigate a security incident or a confirmed breach of our Acceptable Use Policy, or to stop a banned user from returning, we keep the limited records in section 4.4.
• Legal claims. Where data is needed to establish, exercise, or defend a legal claim, we keep it until the claim is resolved or can no longer be brought.

These cases reflect the exceptions to the right to erasure in Article 17(3) of the GDPR and section 1798.105(d) of the California Civil Code. Where the law requires it, and where the law allows it, we tell you if a hold or exception applies to your data, and which categories of data it covers. Data under a hold may be restricted rather than deleted, which means we store it but do not otherwise use it.

10. De-identified and aggregated data

Instead of deleting some data, we may turn it into de-identified or aggregated information, such as a total number of accounts or the share of visits that reach a page. We do this only where the result can no longer reasonably be linked to you or to your device. Where we hold de-identified information, we:

• take reasonable technical and organizational measures so that it cannot be linked back to a person;
• publicly state, as the CCPA expects for de-identified information, that we hold and use it only in de-identified form and do not attempt to re-identify it, except to test that our de-identification works;
• where we share it, and where the law requires it, require the recipient to agree not to re-identify it.

Information that only has a name or email address replaced with an identifier, but could still be linked back to you with other information we hold, is not de-identified. We continue to treat it as personal data and apply this Policy to it. De-identified and aggregated information does not contain customer content and is not used to train models.

11. Workspaces controlled by an organization

Where a Customer controls a workspace, the Customer decides how long its workspace content is kept, and can delete content directly in the product. When the Customer's agreement ends, or earlier at its written request, we delete or return the Customer's personal data as section 11 of the DPA provides. Copies in backups follow section 8.

If you are a member of a Customer's workspace and want content in that workspace deleted, ask the Customer's administrator. If you ask us, we may forward your request to the Customer and help it respond, to the extent the DPA provides. Data we hold about you for our own purposes, such as messages you sent us, is ours to delete, and we handle that part of your request directly.

12. Inactive accounts

We do not currently delete accounts automatically because they have not been used for a period of time. Your account and content stay available until you or, for an organization's workspace, the Customer delete them. If we introduce a rule for deleting inactive accounts, we will update this Policy before applying it, and we aim to give affected account holders reasonable notice by email so that they can sign in or export their data.

13. Asking for earlier deletion

You do not have to wait for a period in this Policy to end. You may ask us to delete your personal data at any time, wherever you live, and you do not need to give a reason. Depending on where you live, the law may also give you a right to erasure, including under Article 17 of the GDPR and section 1798.105 of the California Civil Code.

• In the product. Delete individual items, files, or your whole account in account settings. Deletion in the product is immediate.
• By email. Email contact@wrxstack.com with the subject "Data deletion request". We aim to complete a verified request within 30 days. In any case we complete a verified request within the period the law that applies to you requires: under the GDPR, one month from receipt, which may be extended by two further months for complex or numerous requests, and under the CCPA, 45 days, which may be extended by a further 45 days. Where we extend the period, we tell you, with the reason, as the law requires.

Step-by-step instructions, including for accounts created with a sign-in provider, how we verify a request, and what we may need to keep, are in our Data Deletion Policy. If an exception in section 9 applies, we tell you which data we kept and why where the law requires it. We will not deny you the Service, charge you differently, or treat you less favorably because you asked us to delete data.

14. Service providers and sign-in providers

We use a small number of service providers to run the Service, listed on our sub-processor list. Each one holds data for us only for the purpose we use it for, and keeps or deletes it in line with its own data-handling terms. Where a provider's period is set by the provider, such as our hosting provider's log and backup schedules or our analytics tools' retention settings, this Policy says so.

Sign-in providers such as Google, Apple, Microsoft, and Meta are independent companies. They keep their own records about you, including the fact that you connected wrxstack, under their own privacy policies. We cannot set or change how long they keep that data. Our Data Deletion Policy explains how to disconnect wrxstack at each provider.

15. No fees and no compensation

We do not charge any fee for deleting data, for answering a question about retention, or for providing a copy of your data before deletion. Nothing in this Policy, including any retention period, deletion, delay, or exception, creates any right to a payment, credit, reimbursement, or compensation of any kind, for you or for us. This Policy describes how we keep and delete data. It does not change any other right or obligation under the Terms of Service.

16. Children

The Service is intended for people aged 16 and over. We do not knowingly collect personal data from anyone younger. If you believe that a child under 16 has given us personal data, email contact@wrxstack.com and we will take reasonable steps to delete it promptly.

17. Changes to this Policy

We may review and update this Policy from time to time, for example when we add a new kind of data, a new service provider, or a new product feature that stores data, or when the law changes. We will give notice where the law or the Terms require it, and the effective date at the top shows the current version.

18. Legal effect of this Policy

This Policy explains our practices. It is not a contract, and it does not create any contractual obligation, warranty, guarantee, or right for you or for any other person. The only agreements between you and wrxstack are the Terms of Service and, where it applies, the Data Processing Addendum.

Timelines and targets in this Policy are goals we aim to meet, not guarantees, except where a law that applies to us sets a deadline, in which case we follow that law. Nothing in this Policy increases wrxstack's liability. The disclaimers, the limitation of liability, and the other protections in the Terms of Service apply to everything this Policy describes. Nothing in this Policy limits a right you have under a law that cannot be limited by agreement.

19. Contact and complaints

For any question about how long we keep your data, or to ask for earlier deletion, email contact@wrxstack.com. If you are not satisfied with our answer, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work, or where you believe an infringement took place. In California, you may contact the California Privacy Protection Agency. You do not have to contact us before going to an authority.

Related documents: Privacy Policy, Data Deletion Policy, Cookie Policy, Data Processing Addendum, GDPR Statement, California Notice, Sub-processor List, and Data handling.