# Retention Policy

How long docuinked keeps each kind of data, what happens when you delete a document or close your account, and why completed documents and their evidence are treated as records you control. This policy forms part of our [Data Processing Terms](/legal/dpa).

## Why evidence is different

A completed document's value is that it can be checked later. Its evidence record (who was sent what, when they viewed it, when they signed, from where, and the seal and timestamp that bind it) exists to answer a dispute that may arise years later. So we treat completed documents and their evidence as records the **customer** controls, not as data we expire on our own schedule.

The evidence log is a hash chain: every entry includes a fingerprint of the one before it, and we publish checkpoints of the chain to an outside timestamp service. That is what makes the record tamper-evident, and it also means an entry can never be removed once written. When a document is deleted, its file, field values and signature images are destroyed; its log entries remain. Those entries carry the signer's name and email today. We intend to store those personal fields as one-way hashes so that a deleted document leaves no readable personal data in the log; until that change ships, this policy tells you plainly that they remain.

## What we keep and for how long

| Data | Retention |
|---|---|
| Drafts, templates and pending documents | While the account is open. You can delete them at any time. Expired or voided documents are deleted 90 days after expiry or void unless you keep them. |
| Completed and declined documents | While the account is open, until you delete them. Deleting a document removes the PDF, the field values and the signature images from our systems. The entries in the evidence log for that document (that a step happened, when, and from which address) are kept, because each entry is part of a hash chain that protects every other document and cannot be removed without breaking it. A signer who kept their copy keeps it. |
| Signer personal data inside a document (name, email, IP, browser, signature image) | Same as the document it belongs to, except the evidence-log entries described above. We don't keep signer profiles outside documents. |
| Public evidence checkpoints (hashes published to the timestamp log) | Indefinitely. They contain hashes only, no content or personal data. |
| Account data (name, email, organization, password hash, 2FA) | While the account is open, then 30 days. |
| API key hashes, webhook configuration | While they exist, then 30 days. |
| Security and access logs | 12 months. |
| Billing records (when fees apply) | 7 years. |
| Website server logs | 90 days. |
| Email delivery records at our mail provider | Per the provider's terms; subject, recipient and body for a short period; no document content is in the email. |

## Backups

Encrypted hourly backups expire within 35 days. Data deleted from the live system disappears from backups within that window. We don't restore deleted documents from backups except to recover from a failure on our side.

## When you close your account

Export first; the export includes every PDF and evidence record. After you close the account we delete everything within 30 days, except billing records and the public hash checkpoints. If we ever shut the service down, we give at least 60 days' notice and keep export working for that whole period.

## Signer requests

A signer may ask us to delete their data. Because the evidence record protects every party to a document, we send the request to the customer who holds the document and act on the customer's instruction, unless the law requires otherwise. We will tell the signer who the customer is so they can ask directly.

## Legal holds

If a law or valid legal process requires us to keep something longer, we keep only what is required, only for as long as required.