Data retention
How long CookieHub keeps consent log entries, account data and DSAR files, and what happens when a service agreement ends.
| Data | Retained | Then |
|---|---|---|
| Consent log entries | 12 months from the consent action | Deleted automatically |
| Customer account and configuration data | For the duration of the service agreement | Deleted or returned on termination, subject to technical constraints, backup retention cycles and legal obligations |
| DSAR disclosure files | The file retention period set in DSAR settings | Purged from storage automatically |
| Encrypted backups | Up to 90 days after the data is deleted from the live systems | Expire |
Personal data is retained for the duration of the service agreement and in accordance with documented retention settings. Consent log entries older than 12 months are discarded automatically; the retention period is the same for every subscription and cannot be extended or shortened.
Data deleted from the live systems remains in encrypted backups for at most 90 days, which is the "backup retention cycle" the data processing agreement refers to.
To delete an account and its data, see How can I close my account?; the account must have no active domains, and deletion follows within 24 hours of the request.
Related: the data processing agreement sets out the deletion and return commitments; Security and data protection practices describes what data CookieHub holds.