Data retention schedule

§1 · Our principles

This schedule explains the operational retention periods Tradelynx applies across production systems. Read alongside the Privacy Notice.

We may retain data for longer where a legal hold, active dispute, fraud investigation, security incident, regulatory inquiry, chargeback, or other legitimate need applies.

• Minimisation: we don't ask for, or store, data we don't need to operate the platform.
• Storage limitation: every category has a maximum lifetime tied to a clear lawful basis.
• Auditability: every retention decision is logged and reviewed annually.

§2 · Headline schedule

A visual summary of the main retention categories. The full row-by-row schedule is in section 3.

§3 · Detailed schedule

Each row of the schedule below is the operational retention applied to that data category, the rationale, and what we do at the end of the period.

Account and trader records

• Customer account records. Active life of the account plus 6 years after closure (UK Limitation Act). Then deleted or irreversibly anonymised unless a legal hold or open dispute applies.
• Trader account, onboarding, and compliance records. Active life plus 6 years after closure. Non-essential records deleted; only what is needed for legal/compliance reasons is retained.

Jobs and communications

• Customer enquiries, routed leads, jobs, and timelines. 6 years from job closure, cancellation, expiry, or last substantive activity. Then deleted or anonymised where feasible, while preserving necessary finance/audit references.
• Customer / trader messages and standard job attachments. 3 years from the last message or attachment activity, unless linked to an active dispute or legal hold. Then content is deleted or anonymised and storage objects expired.
• Job completion photos and review photos. 6 years from job completion or review submission. Then deleted unless still needed for disputes, property-history entitlements, or legal defence.
• Quote records and acceptance signatures. 6 years from quote acceptance, expiry, or closure (UK Limitation Act). Covers the quote, its line items, the append-only event log, and, where the customer chose to sign, the signature image and the signing IP / device captured as evidence of acceptance. Then deleted or anonymised unless a dispute or legal hold applies.
• Support tickets and attachments. 3 years from ticket closure, or 6 years for tickets relating to a payment dispute, legal claim, or serious complaint. Routine tickets deleted or anonymised; escalated matters retained for the longer period.

Payments and entitlements

• Payment, subscription, refund, billing-portal, and accounting records. 6 years from the end of the relevant financial year, or longer if tax/accounting law requires (HMRC).
• Property-history purchases, entitlements, and report access logs. 6 years from expiry of the entitlement / subscription or the last report-access event.

Trader verification (DiDit-backed)

• Property-owner verification requests and evidence links. Current request lifecycle plus 6 years from final decision or revocation.
• Property documents uploaded by customers. Until deleted by the user or 6 years after the related property record becomes inactive (whichever is later), subject to legal hold.
• Trader verification evidence processed through DiDit. Verification status / audit trail: active life plus 7 years after closure. Raw third-party verification evidence, meaning the identity payload DiDit returns to us: active life plus 3 months after closure, then deleted. This is deliberately much shorter than the surrounding periods: it is the most sensitive material we hold about a person, it evidences who they are rather than what they did, and nothing we may later be asked about depends on keeping the raw payload once the decision it supported has been recorded. DiDit retains its own records per its data-processing agreement.
• Trader-uploaded insurance / certification documents and AI-extracted metadata. Active life of the document plus 7 years after replacement, expiry, or account closure (whichever is later). Then raw files and extracted metadata are deleted; a minimal audit trail (document type, expiry date, decision, provider reference) is preserved.

Security, telephony, and audit

• OTP, magic-link, session, and auth-security records. OTP codes and ephemeral auth artefacts: until expiry / consumption plus up to 30 days in operational tables or logs. Session and security logs: up to 12 months.
• Telephony and SMS logs. 12 months for routine operational logs. Longer where needed for a complaint, security issue, or billing dispute.
• Audit events, routing audit, payments audit, telephony audit, security logs. 12 months for routine operational logs; 6 years for high-value audit trails tied to payments, disputes, verification, or enterprise access.
• Property-access audit trail. When someone is shown property data about a home, we record who looked, what they were shown, and which property it was about. That property reference is kept even if the property record is later deleted, because an audit trail that forgets what it was about cannot show what happened. It is a reference to a property, not to a person: the person is recorded separately and is removed on erasure in the normal way.

Public-facing and enterprise

• Launch-interest, contact-form, and labour-interest submissions. 24 months from submission unless converted into an active account, support ticket, or ongoing relationship.
• Public trader profile data and public listing records. While publication is enabled, plus up to 12 months after depublication (backups, logs, search-engine propagation).
• Enterprise / org accounts, webhooks, and API keys. Active relationship plus 6 years after termination.
• Game leaderboard entries (handle + score). This includes both the all-time board and the daily board (your best score for a given day). Kept only while you choose to appear: deleted the moment you use "Remove my score" (which clears both boards) and automatically when you delete your account. No fixed minimum.
• Tradie IQ usage counts (event name, page, game mode, share method, the game's random id only with analytics consent; no IP, no handle, nothing typed). Kept 90 days, then deleted by the nightly sweep.
• Tradie IQ signup records (a player who signed up as a tradesperson or customer within 30 days of playing: the random game id, dates, how they first came to the game, what they last played; no name, email or account id; only with analytics consent). Kept 12 months, then deleted by the nightly sweep.
• National waitlist signups (email, optional name, role, trade, outward postcode, optional feedback). Kept until we launch in your area plus a reasonable follow-up window, or until you ask to be removed / unsubscribe, whichever is sooner. No indefinite retention.
• Marketing consent. Until withdrawn.
• First-party website analytics (page, referrer host, country/region, device type, daily anonymous visitor hash, with no IP and no cookies). Raw events are kept for 90 days, then rolled into a non-identifying daily aggregate (counts by channel/source/country/device) retained indefinitely. No personal data is held in either, so the aggregate is not time-limited.

§4 · Deletion, suppression, anonymisation

Where possible, we prefer deletion of no-longer-needed personal data. Where deletion would undermine accounting, auditability, dispute handling, or legal compliance, we may instead suppress access, minimise fields, or irreversibly anonymise the data.

When data reaches the end of its retention period it is cryptographically erased from primary storage on the daily retention sweep, and from analytics warehouses within 7 days. Backups may persist for a limited operational period after live deletion and are overwritten on the normal backup cycle.

If data is subject to a legal hold or active dispute, deletion may be delayed until that matter ends.

§5 · Supplementary notes

The following decisions have been confirmed by founder review:

• Raw trader verification evidence (the identity payload from DiDit) is retained in Tradelynx for the active period plus 3 months after closure, then deleted. The verification decision and its audit trail are kept for 7 years; the raw identity material is not. DiDit retains its own records per its DPA.
• Uploaded trader compliance documents (insurance certificates, Gas Safe cards, etc.) are retained in full for the active life of the document plus 7 years, then raw files and extracted metadata are deleted. A minimal audit trail (document type, expiry, decision) is preserved. This period is longer than the one for identity evidence on purpose: a certificate is the evidence that cover was in force when a particular job was done, and a claim about that work can be brought years afterwards.
• Enterprise contracts may specify longer retention periods. Where they do, the enterprise-specific terms take precedence for data processed under that contract.
• Property-history records are not retained indefinitely. They follow the 6-year post-inactivity schedule and are then anonymised or deleted.
• Call recording, where a trader has switched it on. Most calls are not recorded, and telephony data is event logs (call start, duration, outcome) only. A trader can enable recording for calls connected through Tradelynx. Where they have, every caller hears an announcement and can decline by pressing 9. The recording is transcribed and the audio is deleted immediately afterwards; it is never stored on Tradelynx systems. Only the transcript is kept, and only for 30 days, after which it is deleted automatically. The Privacy Notice sets out the lawful basis and the full detail.

You can request earlier deletion of personal data ahead of the schedule using your right to erasure. We will comply unless we have an overriding legal obligation. Submit a request from Account → Privacy → Erase my data, or email privacy@tradelynx.co.uk.