Data Retention Policy
Effective date: June 8, 2026 · Last updated: June 8, 2026
1. Purpose
inSpring TalentOS stores credentials, work authorization documents, communications, and financial records. Indefinite retention enlarges the breach impact surface, violates data-minimization principles under applicable privacy laws, and serves no operational purpose past the candidate’s placement window.
This policy defines how long each category of data is kept, when it is deleted or de-identified, and how the periods are enforced.
2. Retention periods by category
| Category | Period | Trigger event | Notes |
|---|---|---|---|
| Active account profile | While the account exists | Account closure or 24 months of inactivity | Active = any login or staff-side update in the last 24 months |
| Communications history | 2 years post-placement | Final pipeline stage = placed or withdrawn | Includes email, WhatsApp, SMS bodies and metadata |
| Documents — active | While the candidate is active | Account closure | Most credentials stay relevant for the duration of the engagement |
| Documents — expired credentials | 90 days past expiry | Document marked expired | Test scores, certifications, visa stamps, etc. |
| Documents — visa/immigration filings | 7 years post-filing | Filing date | Required for I-9 / immigration audit response |
| Audit logs | 1 year | Log entry timestamp | Long enough to investigate incidents within a reasonable detection window |
| Authentication logs | 90 days | Event timestamp | Login / logout / password reset events |
| Course progress | While active + 90 days | Account closure | Helps re-onboarding if a candidate returns |
| Payment records | 7 years | Transaction date | US tax / financial record-keeping requirement |
| AI resume-parsing outputs | Lifetime of the parsed document | Document deletion | Stored as structured fields on the candidate profile |
| AI report queries | 1 year | Query timestamp | Audit trail for prompt-injection investigation |
| Staff internal notes | 2 years post-placement | Same as communications | Treated as part of the candidate’s record |
| Stage history | 2 years post-placement | Same as communications | Used for funnel analytics; can be de-identified before deletion |
| Backups and snapshots | 7 days PITR; 30 days daily | Backup creation | Supabase Pro defaults |
Where two categories conflict (e.g., a document is both an audit artifact and an active credential), the longer period applies.
3. Account deletion
When a user requests deletion of their account, we:
- Mark the profile inactive within 24 hours.
- Within 30 days, delete or de-identify: profile, candidate profile, communications, documents, course progress, internal notes, reminders, and scheduled meetings.
- Retain only the categories that have a longer required period:
- Payment records (7 years) — kept for tax and audit.
- Visa/immigration filings (7 years) — kept for I-9 / immigration audit.
- Audit logs (1 year from query, not from deletion).
- Backups containing the deleted data persist up to 30 days after deletion before being overwritten on the standard rotation.
4. Legal holds
If we are required by law to preserve specific records — subpoena, litigation hold, regulatory investigation — those records are exempt from this policy until the hold is lifted. Holds are tracked and reviewed quarterly by the operations team.
5. Disposal procedures
When a record reaches its retention limit:
- Soft delete is not sufficient on its own. Cleanup jobs hard-delete rows from primary tables and remove associated files from storage.
- Backups are not actively cleaned — they age out on the standard rotation (point-in-time recovery: 7 days; daily backups: 30 days). After 30 days no backup contains the deleted data.
- De-identification is preferred over deletion for analytics-only data (e.g., stage history aggregations) — names, emails, and document paths are nulled while ID-typed columns are retained for funnel reporting.
6. Review cadence
This policy is reviewed:
- Annually for content (effective date update; period adjustments based on operational learning)
- Whenever a new data category is added to the Platform
- Whenever a regulatory change affects retention (e.g., new state privacy law, federal immigration record-keeping change)