Data Retention & Deletion Policy

Last updated: June 3, 2026

1. Purpose and Scope

This Data Retention and Deletion Policy (“Policy”) describes how Orange Sky Software Inc. (“Orange Sky,” “we,” “us,” or “our”) collects, retains, and deletes data in connection with the Echosaw Media Intelligence product (“Echosaw” or “the Product”).

Echosaw is a cloud-based media intelligence platform where Users upload, submit, or connect media sources (e.g., links, files, search queries, monitored feeds) and generate outputs such as reports, alerts, summaries, analytics, and insights (“User Content” and “Generated Content”).

We are committed to data minimization, storage limitation, and secure deletion practices in compliance with applicable privacy laws, including but not limited to the General Data Protection Regulation (GDPR), California Consumer Privacy Act as amended by the California Privacy Rights Act (CPRA/CCPA), and other relevant regulations. This Policy supplements our Privacy Policy, AI Use and Disclosure Policy, Terms of Service, and any applicable agreements.

This Policy applies to all data processed through Echosaw, including User Content, Generated Content, metadata, logs, and any derived or processed data.

2. Data Retention Principles

We retain data only for as long as necessary to fulfill the purposes for which it was collected or processed, including:

  • Providing and maintaining the Product services
  • Processing User requests and generating outputs
  • Supporting account management, billing, and customer support
  • Ensuring platform security, fraud prevention, and abuse detection
  • Complying with legal obligations (e.g., audit trails, dispute resolution)
  • Improving the Product (aggregated/anonymized usage analytics only; no training of external models on User Content without explicit opt-in consent)

Retention periods are determined based on operational needs, legal requirements, and the principle that personal data and sensitive User Content should not be kept longer than reasonably necessary.

3. Specific Retention Periods

The following outlines standard retention for key categories of data in Echosaw:

  • User-Submitted Media and Content: Retained until the User or an authorized organization administrator requests deletion, or until the User’s account is cancelled. Data persists indefinitely while the account remains active — there is no automatic tier-based expiration.
  • Generated Reports, Summaries, Insights, Alerts, and Other Outputs: Retained until the User requests deletion or the associated media is deleted. Users may export/save outputs locally at any time.
  • Account Metadata and Profile Information: Retained for the duration of the active subscription/account plus a 30-day grace period after cancellation/termination to allow for reactivation or data export requests. Thereafter, deleted unless required for legal/compliance reasons.
  • Usage Logs and Analytics Data: Retained for up to 12 months to support product improvement, troubleshooting, and billing reconciliation.
  • Security and Audit Logs: Retained for 90 days (or longer if required by law or for active incident response).
  • Billing and Payment Records: Retained for 7 years to comply with tax, accounting, and financial regulations.
  • Data Subject to Legal Hold: If we receive a valid legal request (e.g., subpoena, court order, preservation notice), relevant data may be retained beyond standard periods until the legal matter is resolved.
4. Automatic Deletion Process
  • When a User or authorized administrator requests deletion, the data enters a 30-day soft-delete window. During this period, the data is no longer accessible in the Product but can be restored upon request.
  • After the 30-day soft-delete window, data is permanently and irreversibly removed through automated enforcement routines.
  • Permanent deletion includes removal from primary storage (S3 objects), database records (DynamoDB), vector embeddings, search indexes, access tokens, and any derived indexes/caches.
  • We use secure deletion methods to prevent recovery after permanent deletion.
  • A legal hold on specific data may prevent deletion even if requested. Legal holds are applied when required by law, regulation, or binding legal process.
5. User Rights and Requests
  • Access and Export: Users may access, download, or export their User Content and Generated Content at any time via the Product interface or authorized API endpoints.
  • Deletion Requests: Users may request deletion of their data directly through the Product interface or API. Deletion initiates a 30-day soft-delete window, after which data is permanently removed. Organization administrators may also initiate deletion for organization-owned media. Deletion requests are processed immediately upon submission.
  • Undelete / Restore: During the 30-day soft-delete window, Users or authorized administrators may restore deleted data to its original state.
  • We honor data subject rights requests consistent with our Privacy Policy.
6. Exceptions and Compliance
  • We may retain data longer than stated if required by law, regulation, or binding legal process.
  • Necessary to protect our rights, safety, or property (or that of Users/third parties).
  • Pursuant to a User’s explicit consent for extended retention.

We regularly review retention practices to align with evolving legal requirements (e.g., EU AI Act traceability obligations, CPRA disclosure rules) and technological best practices.

7. Updates and Contact

This Policy may be updated periodically to reflect changes in law, Product features, or our practices. Material updates will be communicated via email, in-app notification, or posting on our website.

Questions, requests, or concerns?

By using Echosaw, you acknowledge and agree to this Policy.