Data Retention & Deletion
What happens to your content and account data when you delete it, and how long each category of data is kept.
Asset deletion lifecycle#
When you delete an asset — a product version, generated model, or uploaded file — it follows a two-stage lifecycle:
- Soft delete (day 0). The asset is immediately removed from your storefronts, rooms, and catalog. It is no longer served to visitors or reachable through signed links, but the underlying files remain recoverable in case of accidental deletion.
- Permanent purge (day 30). A scheduled job permanently erases the underlying files from storage 30 days after soft deletion. Purged assets cannot be recovered.
Expedited erasure#
If you need deleted assets erased before the 30-day window elapses — for example, to satisfy a data subject erasure request or a contractual obligation — contact privacy@freakout.ai. Our team can run an immediate, verified erasure of all soft-deleted assets for your shop. The erasure itself is recorded in the audit trail as evidence.
Retention summary#
| Data category | Retention |
|---|---|
| Active assets and catalog data | Kept while your account is active |
| Soft-deleted assets | Purged permanently after 30 days |
| Audit logs | 365 days, then deleted |
| Storage access logs | 400 days, then deleted automatically |
| Account data after account deletion | Removed per our data deletion process, except records we must keep for legal, billing, or security purposes |
Backups#
Deleted data may persist in encrypted MongoDB Atlas backups until those backups rotate out of the backup retention window. The default backup retention target is 24 hours unless contracted otherwise. Backups are never used to restore data that a customer has deliberately deleted, except at that customer's own request during the recovery window.
Security-log exception#
Deleting an account or asset does not remove its entries from the audit trail before the 365-day retention window expires. Retaining security logs for a fixed period is required for incident investigation and is a recognized exception to erasure rights under GDPR. See Compliance & GDPR.