DRAFT — NOT LEGAL ADVICE — for review by a qualified Indian lawyer before adoption
Data retention and deletion policy
Applies to: personal data processed in Upkiva, both as data processor for Businesses (e.g. TV Palace) and as data fiduciary for Upkiva's own account data. Version: 0.2 (draft, October 2026) · Owner: [Upkiva data protection contact] [CONFIRM]
1. Principles (DPDP Act s.8(7); DPDP Rules, Rule 8)
- Keep personal data only as long as needed for the purpose it was collected for, or as long as a law requires.
- Erase it when consent is withdrawn or the purpose is served, unless a law requires us to keep it. Then use it only for that legal purpose.
- Make sure processors and sub-processors erase it too.
- Keep logs of processing for at least one year (DPDP Rules, Rule 8(3), from 13 May 2027) and server logs for 180 days (CERT-In directions, April 2022).
- Erasure means removal from live systems. Backups age out on their normal rotation, are encrypted, and are never restored for normal use. If a backup is ever restored, erasures made after it are done again.
2. Retention schedule
"Enforced" says whether the product deletes automatically today (October 2026 build). Periods marked [CONFIRM] are defaults the Business or the lawyer may change.
| # | Data | Retention | Reason / legal basis | Enforced today? |
|---|---|---|---|---|
| R1 | Technician GPS location points and derived journey segments, including imported Google Timeline data | 90 days (settings.location.historyDays) | Purpose limited to attendance, travel reconciliation and disputes; proportionate monitoring of workers | Yes: purged nightly |
| R2 | Job photos (before / after / old part / door / leak test / survey), readings, checklists | 2 years from job close (Settings: 1–10 years) | Warranty (parts, 90-day workmanship), disputes, audit | Built, off by default: runs nightly once the Business switches it on (Settings → Data & privacy) |
| R3 | Invoices, credit notes, payment records, and the job lines behind them | 7 years from the end of the financial year of the invoice (default); 8 years if the Business is a company [CONFIRM per Business]. Longer while a GST appeal or proceeding is pending | CGST Act s.36 and CGST Rules r.56 (72 months from the due date of the annual return, i.e. about 6 years 9 months after the FY ends; 7 years covers it); Companies Act s.128(5) (8 years); income-tax law | Built, off by default: after the period, the stored PDF is deleted and the bill-to is de-personalised; amounts and GST stay |
| R4 | Customer master (name, phone, addresses, units) | While the customer has an active AMC / open job, plus 3 years after the last service [CONFIRM] | Service history, warranty, renewals; limitation period for claims (Limitation Act, 1963: 3 years) | No (erasure on request is built) |
| R5 | AMC contracts and visit records | Contract end + 3 years [CONFIRM] (the invoice part follows R3) | Disputes, renewals, limitation period | No |
| R6 | Customer signatures, OTP verification records (hashed), approvals of parts / extras / quotations | Signature files: 7 years from upload (storage rule). Approvals: as the job (R2), or R3 where they support an invoice | Proof of consent to charges | Signature files: yes (bucket expiry). Rest: no |
| R7 | Call logs and call recordings (masked calling) | Recordings 1 year (365 days, storage rule) [CONFIRM: we recommend 90 days]; call logs as R2 | Disputes, QC | Recordings: yes (bucket expiry). Logs: no |
| R8 | Ratings, complaints, disputes, QC call-back outcomes | 2 years after closure; dispute photos 7 years (storage rule) [CONFIRM] | Quality, disputes | Dispute photos: yes (bucket expiry). Rest: no |
| R9 | Technician attendance selfies | 2 years from upload (storage rule) [CONFIRM: we recommend 1 year or less; the attendance record itself, with times, is kept as R10] | Attendance proof | Yes (bucket expiry) |
| R10 | Technician HR records: attendance and wage records, documents (ID, police verification, licence; numbers encrypted), incentives, cash ledger, expenses | Attendance, wage and overtime records: 5 years (rules under the Code on Wages, 2019) [CONFIRM]. ID documents: employment + 3 years [CONFIRM]; the storage rule deletes the files 7 years after upload. Financial ledgers and expense bills as R3 | Employment, labour and tax law | Document / bill files: bucket expiry at 7 years. Rest: no |
| R11 | Device-audit data (clock offset, mock-location flag, app version) attached to job events | As the job (R2) | Fraud prevention | No |
| R12 | Staff / user accounts | Active, plus 12 months after deactivation [CONFIRM] | Security, audit | No |
| R13 | Audit logs (who did what) and records of consent, data requests, exports and erasures | At least 1 year; consent and request records for 3 years after they end [CONFIRM] | DPDP Rules, Rule 8(3); proof of consent and of handling requests | No (kept indefinitely today) |
| R14 | Server logs (API file log, nginx access / error logs) | 180 days | CERT-In directions (April 2022) | Yes (deploy/logrotate/upkiva) |
| R15 | WhatsApp / SMS message logs and inbound messages | 1 year [CONFIRM] | Delivery proof, support | No |
| R16 | Import files (Excel uploads) and report exports | Imports 30 days; exports 7 days (served by 1-hour links) | Troubleshooting | Yes (bucket expiry); Timeline imports with R1 |
| R17 | "Request access" / sign-up requests not approved | 6 months [CONFIRM] | Follow-up | No |
| R18 | Backups (restic, encrypted, Cloudflare R2) | Rolling: 7 daily, 4 weekly, 12 monthly, so erased data can remain in encrypted backups for up to about 12 months (deploy/backup.sh) [CONFIRM acceptable, or shorten to 3 months] | Disaster recovery | Yes (rotation) |
Note on R1 and the one-year log rule. DPDP Rule 8(3) (from 13 May 2027) asks fiduciaries to keep "personal data, associated traffic data and other logs" of processing for at least one year for the purposes in the Seventh Schedule. Whether this requires keeping the GPS points themselves for a year, or only a log that they were collected and purged, is unsettled. We treat 90 days as the default and will keep a durable log of each nightly purge (today only the last run's counts are kept; product item) [LAWYER: confirm before 13 May 2027].
Storage rules are the Cloudflare R2 lifecycle rules in deploy/r2/media-lifecycle.mjs; they count from the upload date. The large business classes (Third Schedule of the DPDP Rules: e-commerce, gaming and social-media platforms with 2 crore or more users) and their 48-hour warning before erasure do not apply to Upkiva or its Businesses.
3. Deletion triggers
| Trigger | What happens |
|---|---|
| Retention period ends (R1 nightly; R2 and R3 nightly once switched on; storage rules daily; others by a manual quarterly review until a job exists) | Delete, or de-personalise where totals are kept |
| A customer asks for erasure (portal or office; data-principal-rights-procedure.md) | The office erases in Settings → Data & privacy: profile, addresses, portal login, job notes, signatures, photos, dispute texts, message bodies and call recordings are erased; GST invoices are kept with a frozen bill-to until R3 ends |
| A technician asks for erasure | Manual, by Upkiva support on the Business's instruction (no tool yet; see §4) |
| Technician deletes an imported Google Timeline (Me → Import Google Timeline) | Deleted immediately (built) |
| Business leaves Upkiva | Export offered for 30 days → workspace deleted from live systems within 30 days → backups age out within about 12 months (R18) |
| Technician withdraws the location notice | Tracking stops at the next check-out. Existing points age out under R1 (or are erased on request, unless needed for an open dispute) |
4. How technician and staff erasure is performed (until a tool exists)
Customer erasure has a built tool (above). For technicians and staff, Upkiva support performs erasure on a ticket from the Business:
- Verify the request came from the Business's authorised admin (signed email / ticket).
- Identify the records (technician by mobile / code).
- Check legal holds: wage and attendance records (R10), cash ledgers and expense bills (R3), open disputes, police / court requests.
- Erase or de-personalise: replace the name, phones, email and address with "Erased [date]", delete selfies and location points, delete ID-document files once their hold ends, deactivate the login.
- Record the action in the audit log (who, when, what, which legal hold kept what).
- Confirm to the Business within 7 working days.
5. Review
This policy is reviewed every 12 months, and whenever a new data category or sub-processor is added.
Source: docs/launch/legal/data-retention-and-deletion.md