Data Retention Policy

Last updated: May 24, 2026

Overview

This Data Retention Policy describes how long VantaWeb LLC retains different categories of personal data, why we retain it, and how you can request deletion. This policy supplements our Privacy Policy and Data Processing Agreement.

Retention Schedule

Account Data

  • Active accounts: retained for the lifetime of the account.
  • Cancelled accounts: retained for 90 days post-cancellation, then deleted.
  • Legal hold: if required by law or litigation, data may be retained longer with notice to the customer.

Call Records and Transcripts

  • Call metadata (duration, timestamp, caller region): 12 months, then automatically purged.
  • Call transcripts (if recording enabled): 90 days by default, or per customer configuration (minimum 30 days for support purposes).
  • Call audio recordings (if enabled): 90 days, then automatically purged unless customer extends.

Billing Records

Transaction records are retained for 7 years to comply with financial and tax regulations. Payment card data is never stored by VantaWeb — this is handled exclusively by Stripe (PCI DSS Level 1).

Support and Communications

Support tickets and email communications are retained for 3 years from last activity to support future inquiries and quality improvement.

Analytics and Logs

  • Server access logs: 90 days.
  • Security logs (authentication, access control events): 12 months.
  • Aggregated usage analytics: retained indefinitely (anonymized, no personal data).

Deletion Requests

You may request deletion of your personal data at any time by emailing privacy@vantaweb.io. We will:

  • Acknowledge your request within 5 business days.
  • Complete deletion within 30 days (or notify you if a legal hold applies).
  • Provide written confirmation of deletion upon request.

Note: deletion of account data is permanent and will terminate access to the Service.

Deletion Enforcement

Records past their retention period are deleted on request and via periodic manual review. Automated, scheduled enforcement of these retention periods is in progress and not yet live; until it ships, deletion is not guaranteed to happen automatically on the exact day a retention period lapses.

Backups

Database backups are retained for 30 days. Deleted data may persist in backups for up to 30 additional days before being overwritten. Backup restoration is only performed in disaster recovery scenarios.

Sub-processor Retention

Data shared with sub-processors (Anthropic, Telnyx, LiveKit, Netcup, Hetzner, Cloudflare R2, Backblaze B2, Stripe) is governed by each sub-processor's data processing agreement with VantaWeb. VantaWeb contractually requires sub-processors to delete data within 90 days of our deletion or upon contract termination.

Contact

Questions about this policy or to make a deletion request: privacy@vantaweb.io

VantaWeb LLC | Subject line: "Data Retention"