Data retention.
How long we keep your data, what happens when a subscription lapses, and how you get it out.
Retention is driven by statutory duties and a defined lifecycle. H&S records may carry legal retention and access obligations, so we retain by action family and never auto-purge notifiable incidents.
Retention by data type
| Data type | While active | After cancellation |
|---|---|---|
| Compliance records | Retained, full access | Kept per statutory family — incidents 7y, risk 10y, default 5y; notifiable incidents never auto-purged |
| Document attachments | Retained to storage quota | Follow the lifecycle below (grace → read-only → archive) |
| Audit & billing | Immutable, retained | Retained for legal and tax periods |
| Account identity | Retained | Removed after the retention window, subject to legal holds |
Subscription lifecycle
| Stage | Trigger | Access & duration |
|---|---|---|
| Active | Subscription current | Full read / write |
| Grace | Subscription lapses | 30 days, read / write |
| Read-only | After grace | 90 days, no writes (export still available) |
| Cool storage | After read-only | Archived to 365 days total |
| Archive | After cool storage | Retained to 730 days total |
| Purge notice | 30 days before purge | Email notice to administrators |
| Purge | After archive | Data permanently deleted |
Getting your data out
You can export your organisation's data at any time while active. On a lapse you keep a grace period, then read-only access with export — because locking you out of your own H&S records could put you in breach. There are no lock-in contracts.
Questions about retention or exporting your organisation's data? Contact us at info@havto.co.nz.