Bridgit

Data Retention Policy

Effective Date: April 30, 2026
Policy Version: 1.0
Policy Owner: Chief Information Security Officer (CISO)
Next Review Date: April 30, 2027

1. Overview: Our Commitment to Data Minimization

At our organization, we believe that protecting your privacy starts with keeping only the data we need, for only as long as we need it. This policy explains how long we retain different types of information and what happens when we no longer need it.

Why This Matters:

Our Core Principles:

  1. Collect Only What's Necessary – We don't gather data "just in case"
  2. Keep It Only As Long As Needed – Clear expiration dates for every data type
  3. Delete It Securely – Permanent, irreversible removal when retention periods expire
  4. Respect Your Rights – You can request deletion at any time (with some legal exceptions)

This policy applies to all personal data we process through our Google Cloud Platform infrastructure and integrated AI services (Anthropic Claude, OpenAI).

2. Retention Periods: What We Keep and For How Long

We've established specific retention periods based on legal requirements, security best practices, and operational needs. Here's a clear breakdown:

Data Category What It Includes Retention Period Deletion Method Why We Keep It
User Account Data Names, emails, passwords, profile information, authentication credentials 90 days after account deletion Hard Delete – Permanently removed from all systems GDPR Art. 17, PIPEDA Principle 4.5 (Right to Erasure)
Session Data Login timestamps, IP addresses, device information, session tokens 30 days after session ends Hard Delete – No recovery possible Security best practice for access monitoring
Basic Activity Logs Page views, feature usage, navigation patterns 30 days Hard Delete Operational troubleshooting and performance optimization
Authentication Logs Login attempts, password changes, multi-factor authentication events 90 days Hard Delete ISO 27001 A.8.15 (Security event logging)
Data Modification Logs Create/update/delete actions on projects, documents, activities 365 days (1 year) Hard Delete ISO 27001 A.8.15, SOC2 CC6.5 (Audit trail requirements)
Security Event Logs Failed login attempts, permission changes, security alerts, suspicious activity 730 days (2 years) Archive – Retained but access-restricted ISO 27001 A.8.15, Regulatory compliance for security investigations
Consent Records Privacy consent decisions, consent timestamps, withdrawal records 2,555 days (7 years) Archive – Anonymized after retention period GDPR Art. 7(1), PIPEDA Principle 4.3.8 (Accountability demonstration)

What "Hard Delete" Means

When we hard delete data, it's permanently and irreversibly removed from:

We use cryptographic erasure for cloud storage – by destroying the encryption keys, the data becomes mathematically unrecoverable even if residual bits remain on physical disks.

What "Archive" Means

Archived data is:

Automated Enforcement

We don't rely on manual processes. Our system automatically:

3. Legal Basis: Why These Retention Periods

Our retention schedule is designed to meet requirements from multiple regulatory frameworks that govern how we handle your data:

PIPEDA (Personal Information Protection and Electronic Documents Act)

Canada's federal privacy law

How we comply: We've defined specific purposes for each data category and set retention periods that match those purposes. For example, session data is only needed to maintain your login state, so we delete it after 30 days.

How we comply: We keep your privacy consent decisions for 7 years but anonymize identifying information (IP address, user agent) after the retention period to protect your privacy while maintaining compliance evidence.

GDPR (General Data Protection Regulation)

European Union privacy law (applies when we process EU residents' data)

How we comply: Our retention schedule explicitly defines "necessary" periods for each data type. User account data, for instance, is deleted 90 days after you close your account – enough time to handle accidental deletions, but not indefinite storage.

How we comply: You can request deletion of your data at any time (see Section 4 below). We've built a 30-day grace period for account deletions so you can cancel if you change your mind, then we permanently erase your data.

How we comply: We keep consent records for 7 years to prove compliance during audits, but we anonymize your IP address and user agent to minimize privacy risk.

ISO 27001 (Information Security Management)

International standard for information security

How we comply: We retain authentication logs for 90 days, data modification logs for 1 year, and security event logs for 2 years. These logs help us detect and investigate security incidents. After the retention period, they're permanently deleted (except where legal holds apply).

SOC 2 (Service Organization Control 2)

Security and privacy audit standard

How we comply: Our audit logs are immutable (cannot be altered or deleted manually) to maintain integrity. We retain them for periods appropriate to their purpose: operational logs for 30-90 days, compliance logs for 1-2 years.

4. Your Rights: How to Request Data Deletion

You have the right to request deletion of your personal data at any time. Here's how it works:

How to Submit a Deletion Request

Option 1: Self-Service (Fastest)

  1. Log into your account
  2. Go to Account Settings → Privacy & Data
  3. Click "Request Account Deletion"
  4. Confirm your decision
  5. You'll receive an email confirmation with a 30-day cancellation window

Option 2: Email Request
If you can't access your account, email our Privacy Officer at hello@askbridgit.ca with:

Option 3: Through Your Organization Admin
If you're part of an organization on our platform, your admin can initiate deletion on your behalf (you'll still receive confirmation and cancellation rights).

What Happens After You Request Deletion

Timeline: 30 Days from Verified Request

Phase Days What Happens
Verification 1-3 We confirm your identity and check for any legal holds (see Section 5)
Grace Period 4-30 You can cancel anytime during this window – just click the link in your confirmation email
Anonymization Day 30 Your email becomes anon_[random]@deleted.local, passwords are erased, profile data is nullified
Hard Deletion Day 30 Your account, sessions, memberships, and permissions are permanently removed from all systems
Confirmation Day 30 You receive final confirmation that deletion is complete

What Gets Deleted

✅ Permanently Removed:

✅ Anonymized (Identity Removed, Data Preserved):

❌ Not Deleted (Legal Exceptions):

Verification Requirements

For Self-Service Requests:
Your logged-in session automatically verifies your identity.

For Email Requests:
To protect your privacy, we need to confirm you're the account owner. Please:

High-Risk Deletions:
If you're an organization admin or have large data volumes, we may require additional verification (video call or government-issued ID) to prevent unauthorized deletion.

Response Time

If We Can't Delete Your Data

Sometimes we legally cannot delete your data (see Section 5). If this applies, we'll:

  1. Email you within 15 days explaining the specific legal basis
  2. Provide a reference to the applicable law or regulation
  3. Estimate when the exception will expire (if known)
  4. Delete any non-essential data even if some must be retained

5. Legal Holds: When Retention Periods Are Extended

In certain situations, we're legally required to preserve data beyond normal retention periods. This is called a "legal hold" or "litigation hold."

What Is a Legal Hold?

A legal hold is a formal directive to preserve all relevant information when:

Important: Legal holds override your right to deletion. We cannot erase data subject to a hold, even if you request it, until the legal matter concludes.

Types of Legal Holds

Hold Type When Applied Example
Litigation Active lawsuit or credible threat of legal action Employment dispute, contract breach claim
Regulatory Government agency investigation or inquiry Privacy audit by Office of the Privacy Commissioner, securities investigation
Preservation Court order or preservation letter received Subpoena for records, discovery request
Audit Internal or external audit requires data retention ISO 27001 certification audit, SOC 2 examination

How Legal Holds Work

Automatic Blocking:
Our retention enforcement system checks every data item against active legal holds before deletion. If a hold applies, the system:

Hold Scopes:
Legal holds can target:

Hold Duration:
Holds remain active until:

GDPR Article 17(3) Exceptions

Even without a formal legal hold, we may refuse deletion requests under GDPR Article 17(3) when processing is necessary for:

Legal Claims (Art. 17(3)(e)):

Compliance with Legal Obligations (Art. 17(3)(b)):

Public Interest & Research (Art. 17(3)(d)):

What This Means for You

If your deletion request is blocked by a legal hold:

  1. We'll notify you within 15 days with:

  1. Your request stays on file – Once the hold is released, deletion proceeds automatically

  2. We'll minimize retention – We only keep data directly relevant to the legal matter

  3. You can appeal – Contact our Privacy Officer if you believe the hold is inappropriate

Compliance Alignment

PIPEDA Principle 4.5:
Permits retention beyond normal schedules when "required by law" (e.g., subpoena, court order) or "necessary for legal proceedings."

Quebec Law 25 (Section 12):
Allows retention for "serious and legitimate interest" including fraud investigation, security breach response, and contractual dispute resolution.

ISO 27001 A.18.1.3 (Protection of Records):
Requires records be protected from loss or falsification when needed for statutory, regulatory, or contractual requirements.

6. Third-Party Obligations: How Our Vendors Handle Your Data

We use trusted third-party services to operate our platform. These vendors are contractually bound to follow the same data retention and deletion standards we do.

Our Primary Vendors

Google Cloud Platform (GCP)

Anthropic (Claude API)

OpenAI (API Services)

Vendor Requirements

All our data processors must:

✅ Sign a Data Processing Agreement (DPA) covering:

✅ Implement equivalent security measures:

✅ Support data subject rights:

✅ Notify us of breaches within 24 hours

✅ Submit to audits:

✅ Delete data upon termination:

Sub-Processor Management

Our vendors may use their own sub-processors (e.g., Google Cloud uses underlying infrastructure providers). When this happens:

Data Location & International Transfers

Primary Processing Location: Canada (Google Cloud North America regions)

International Transfers:
When we process data of EU residents, we use:

We do not transfer data to new jurisdictions without explicit authorization and updated SCCs.

How to Verify Vendor Compliance

You can request:

Contact our Privacy Officer at hello@askbridgit.ca for these documents.

7. Contact: Questions About This Policy

We're here to help. If you have questions about data retention, deletion, or your privacy rights:

Privacy Officer

Email: hello@askbridgit.ca
Response Time: Within 5 business days for general inquiries, 30 days for formal data subject requests

For General Questions:

For Formal Requests:

Chief Information Security Officer (CISO)

Email: hello@askbridgit.ca
For Technical Questions:

Filing a Complaint

If you believe we've violated your privacy rights, you can file a complaint:

Internal Process:

  1. Email our Privacy Officer (response within 5 business days)
  2. We'll investigate and respond within 30 days
  3. If you're unsatisfied, request escalation to Legal Counsel or CISO

External Authorities:

Canada (PIPEDA):

Quebec (Law 25):

European Union (GDPR):

8. Policy Review and Updates

This policy is reviewed annually (next review: February 19, 2027) or when:

How You'll Be Notified:

Your Options:

Appendix: Retention Schedule Summary

This table summarizes our complete retention schedule for quick reference:

Data Category Retention Period Deletion Strategy Legal Basis
User data 90 days post-deletion Hard delete GDPR Art. 17, PIPEDA Principle 4.5
Session data 30 days Hard delete Security best practice
Basic activity logs 30 days Hard delete Operational requirement
Authentication logs 90 days Hard delete ISO 27001 A.8.15
Data modification logs 365 days Hard delete ISO 27001 A.8.15, SOC2 CC6.5
Security event logs 730 days Archive ISO 27001 A.8.15, Regulatory compliance
Consent records 2,555 days (7 years) Archive GDPR Art. 7(1), PIPEDA Principle 4.3.8

Last Updated: February 19, 2026
Approved By: Matthew Bromwich, CISO

Sources:

Bridgit Platform (askbridgit.ca)
Version 1.2 | Effective: April 30, 2026 | Next Review: October 30, 2026
Regulatory Mapping: ISO 27001 (A.8.2, A.8.3, A.18.1), GDPR (Art. 5, 17, 28), PIPEDA (P5)

1. Purpose

This policy defines data retention periods, deletion procedures, media disposal practices, and data subject erasure rights for all personal data processed through the Bridgit platform. It ensures compliance with GDPR Art. 5(1)(e) (storage limitation), PIPEDA Principle 4.5 (limiting retention), and ISO 27001 A.8.2/A.8.3 (data classification and media handling).

The organization is committed to retaining personal data only as long as necessary for its stated purpose, and to disposing of data and media securely when retention periods expire.

2. Scope

This policy applies to all personal data stored in Cloud SQL (PostgreSQL 15), Redis, Google Cloud Storage, and any local development environments. It covers all data categories: user account data, activity instance data (JSONB), session data, audit logs, consent records, AI conversation logs, and uploaded files. It applies to all personnel with access to platform data and all third-party processors (GCP, OpenAI, Anthropic, Google AI, Cohere, Stripe, Tavily, Apify).

3. Retention Schedule

User Account Data: 90 days post-account deletion. Hard delete. Legal basis: GDPR Art. 17, PIPEDA Principle 4.5.

Session Data: 30 days. Hard delete. Legal basis: security best practice.

View Audit Logs: 30 days. Hard delete. Legal basis: operational requirement.

Authentication Logs: 90 days. Hard delete. Legal basis: ISO 27001 A.8.15.

CRUD Operation Logs: 365 days. Hard delete. Legal basis: ISO 27001 A.8.15, SOC 2 CC6.5.

Security Event Logs: 730 days (2 years). Archive. Legal basis: ISO 27001 A.8.15, regulatory compliance.

Consent Records: 2,555 days (7 years). Archive. Legal basis: GDPR Art. 7(1), PIPEDA Principle 4.3.8.

Activity instance data, AI conversation logs, and uploaded files are retained per organization-configured settings and the retention schedule above.

Retention is enforced through automated Cloud Scheduler jobs (process-deletions, deletion-reminders) running daily in production.

4. Deletion Procedures

Hard Delete: Data is permanently removed from Cloud SQL via SQL DELETE commands. GCP handles physical media sanitization using cryptographic erasure (NIST 800-88 compliant). All data at rest is encrypted with AES-256 (Google-managed keys); deletion of encrypted data combined with key lifecycle management ensures unrecoverability. Deletion is logged in the audit trail with timestamp, data category, and authorization.

Anonymization: Where data is retained for statistical purposes, personally identifiable fields are replaced with salted hashes or removed entirely. Anonymization is verified to be irreversible per GDPR Recital 26.

Verification: Deletion is verified by confirming the data is no longer retrievable via application queries. Deletion logs are retained for audit purposes.

Documentation: All deletion activities are recorded with: what was deleted, when, who authorized, deletion method, and verification result.

5. Legal Holds

A legal hold suspends normal retention schedules when data must be preserved for litigation, regulatory investigation, internal investigation, audit requirement, or legal counsel directive.

Legal holds are initiated by the Platform Administrator. Affected data is flagged and excluded from automated deletion. Holds remain in place until released by the initiating authority. All hold events (initiation, scope, release) are documented in the audit trail.

Exceptions to the right of erasure under GDPR Art. 17(3) include: compliance with legal obligations, establishment or defense of legal claims, and archiving in the public interest.

6. Third-Party and Vendor Data Handling

All third-party processors are required to comply with data retention and deletion obligations per their Data Processing Agreements:

Vendor deletion is verified through review of DPA terms and vendor compliance documentation (SOC 2 reports). Data return procedures are defined in the Vendor Management Policy.

Backup and recovery specifications: Cloud SQL automated daily backups (7-day retention, GCP-managed). Manual pg_dump before each production deployment. Recovery Time Objective (RTO): 1 hour for database, 15 minutes for application. Recovery Point Objective (RPO): 24 hours (daily backup) or deployment-time (manual pg_dump). GCS provides regional redundancy with zero RPO for file storage.

7. Data Subject Rights

Users may request erasure of their personal data by contacting hello@askbridgit.ca or through the platform's account deletion feature. Requests are processed within 30 days of receipt of a verified request.

Erasure is carried out where: data is no longer necessary, consent has been withdrawn, the user objects and no overriding grounds exist, or data was unlawfully processed.

Exceptions: legal retention requirements, active legal holds, ongoing contractual obligations, and compliance with legal claims.

The platform provides a pre-deletion impact assessment and 90-day grace period with a 7-day warning email before permanent deletion.

8. Media Handling and Asset Disposal (ISO 27001 A.8.3)

Bridgit is cloud-native with no physical data center infrastructure. Media disposal is handled at two levels:

Cloud assets (GCP-managed):

Developer machines:

Media reuse: Cloud Run containers are rebuilt from source on each deployment. Cloud SQL is single-tenant. Developer machines require data cleanup before reassignment (delete backups, .env files, git clones, Docker volumes).

Disposal verification: cloud asset disposal logged in GCP audit logs (timestamp, actor, resource). Internal verification and sign-off for developer machine offboarding.

No paper records containing personal data are maintained in standard operations. GCP maintains certificates of media destruction per their compliance program.

9. Complaint Procedure

Complaints about data retention practices may be submitted to hello@askbridgit.ca. Internal complaints are investigated and responded to within 30 days.

If unsatisfied with the response, individuals may lodge a complaint with:

10. Policy Administration

This policy is maintained alongside the platform source code and is subject to version control. Changes require review and re-approval.