Data Retention Policy

This policy describes how long we keep each category of personal data and what justifies that period. It complies with the data minimization and storage limitation principles of GDPR (Art. 5).

1. Retention periods

Data category	Retention period	Reason
Call audio recordings	90 days	Quality assurance, dispute resolution, OpenAI/Telnyx sub-processors
Call text transcripts	12 months	Call history for customers, agent performance analysis
Call metadata (duration, time, direction)	24 months	Billing, statistical analyses, reporting
Contact data (name, phone, email)	Until deletion request	Continuous service, appointments, communication
Appointments created	5 years after date	Customer history, potential audits
Customer billing data	10 years	Legal tax obligation (Romanian Tax Code)
User account	Until deletion + 30 days	Allows recovery after cancellation
Application log data	24 months	Security, debugging, audit
Audit logs (sensitive data access)	5 years	GDPR Art. 32 compliance, security audit
Demo data on site (vocalyy.com)	30 days	Demo quality, then automatic deletion
Analytics cookies	13 months or consent withdrawal	Per ANSPDCP recommendations
Contact form submissions	24 months from last interaction	Prospect follow-up
DB backups	30 days	Recovery in case of incident

2. How we implement deletion

2.1 Automatic deletion

We have automatic jobs (cron jobs) running daily to delete data that has exceeded its retention period. Jobs are monitored and audited monthly.

2.2 Deletion on request

You can request deletion of your data at any time through:

• Email to privacy@vocalyy.ro
• "Delete account" button in dashboard
• Written request to our registered office

We respond within 30 days max (per GDPR Art. 12.3).

2.3 Deletion exceptions

Per GDPR Art. 17(3), we cannot delete data when there are legal obligations:

• Billing data — 10 years under Romanian Tax Code
• Data for legal defense — until expiration of statute of limitations
• Audit logs — required for security obligations

In these cases, we restrict access to authorized persons only and do not use the data for other purposes.

3. Physical deletion

Data deleted from active systems is also removed from:

• Primary database (Supabase) — instant
• Cache and logs — within 24 hours
• Backups — within max 30 days (backup rotation)
• Sub-processors — we request deletion per signed DPA

4. Audit and verification

The policy is verified annually through:

• Internal audit of deletion jobs
• Manual verification of a 5% sample of old records
• Internal compliance report

5. Policy changes

Changes to this policy are:

• Communicated to B2B customers with minimum 30 days notice
• Published on this page with the new version date
• Notified via email for significant changes

6. Contact

For questions about retention or data deletion:

• DPO: dpo@vocalyy.ro
• DSAR requests: privacy@vocalyy.ro

Related pages: Privacy Policy · Sub-processors · About the AI System