Data Retention and Security Schedule
Version 1.0 · 21 October 2026
This schedule forms part of ACTERA LIMITED’s free alpha agreement. Company number 17528640; registered in England and Wales; registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Contact hello@actera.dev.
Retention policy
Retention is based on the purpose of the information. Cleanup and requests may be handled manually during the alpha; this schedule does not promise an automated deletion system or an exact time-of-day purge.
Information | Retention and treatment |
|---|---|
Decision, action and policy-change activity history | A rolling 90-day retention period from when each record is recorded. Detailed records are removed or irreversibly anonymised through periodic cleanup. This is not a guaranteed 90-day archive; retain your own essential source records. |
Saved policies, published versions and explicitly saved test examples | Kept while needed as workspace configuration, including version/publisher information needed to understand it. These can be separate copies of data from history. Discarding a draft does not itself delete its activity records or previously published versions. |
Minimal live-operation and replay-prevention records | Kept only as needed to resolve pending or uncertain work, maintain live accounting or prevent duplicate execution. This exception does not permit a full archive of expired payloads. Necessity is reviewed periodically, and closure includes these records unless a lawful exception applies. |
Account, membership, session and connection information | Kept while needed for access and service administration. Expired access records and credentials no longer needed are removed. Closure starts the removal process. |
Notification diagnostics | Delivery diagnostics normally use a 90-day retention period and provider-event deduplication records a seven-day period. Cleanup is periodic. Independently retained email or Slack messages follow the recipient/provider’s settings. |
Operational and security logs | Kept for the period needed to operate, investigate faults and protect the service. Relevant records may be retained longer for a specific incident or legal claim, with restricted access. |
Support and business correspondence | Kept while needed to handle the enquiry, support the relationship or resolve a dispute, then deleted. We consider the issue’s status, last meaningful contact and any applicable legal requirement. |
Minimal agreement and legal records | Kept for applicable statutory requirements and relevant claim limitation periods. This does not justify retaining the whole workspace. |
Opt-out records | Minimal contact/preference information is retained as needed to honour an objection or withdrawal of marketing consent. |
We do not keep personal data indefinitely merely because it is an audit record. A valid earlier deletion request or a specific legal requirement may change the applicable treatment. Identifiers and hashes are not automatically anonymous.
Requests and workspace closure
Email hello@actera.dev to request export, correction, deletion or closure. We verify identity or authority proportionately and agree the scope where needed. Export is provided in an available commonly used electronic format, subject to other people’s rights. Requests can be handled directly by the founder without a self-service interface.
On closure, we disable relevant access and dispatch, revoke credentials and remove the workspace’s active data and applicable provider copies. We aim to complete ordinary active-system closure deletion within 30 days. This is an operational target, not permission to delay a valid request or override applicable legal deadlines. We explain material delays and lawful exceptions.
Return/deletion requests cover separately saved examples and policy records as appropriate. Customers remain responsible for exports and independently retained copies in their own systems.
Backups
Deleted data may remain in restricted backups until overwritten or expired through the normal recovery rotation. Backup retention is limited to what is needed for recovery; copies awaiting expiry are kept out of ordinary use. We can explain the applicable rotation and expected expiry when handling a request. We do not promise immediate deletion from every backup.
If a backup is restored, relevant deletions and access revocations must be reapplied before the restored information becomes available for ordinary use. A limited deletion record may be retained for this purpose without retaining the deleted payload itself. A specific legal retention requirement is handled separately and explained where lawful.
Security measures
Actera will maintain measures appropriate to the risks of this non-critical alpha, including:
Authenticated, workspace-scoped access and role-based permissions; operator access limited to service, support, security or legal needs.
Protected administrative accounts, including MFA where supported, secure credential storage and encrypted public connections.
Protection of production storage and backups against unauthorised access, with encryption at rest where provided by the hosting services.
Controlled application changes, dependency review and proportionate remediation of security problems.
Separation of ordinary development/test activity from customer data; no unrelated reuse of customer payloads for development.
Direct handling of privacy requests and security incidents through hello@actera.dev, with notices where required.
The alpha is not certified as a compliance product, is not end-to-end encrypted against its operator, and carries no guarantee of zero data loss or a fixed recovery time. Customers must maintain independent safeguards for their own systems.
Changes to this schedule follow the Terms and DPA. Mandatory duties and the protection agreed for Customer Personal Data cannot be removed by changing this page alone.