Data Retention Policy

Overview

This Data Retention Policy describes how long VantaWeb, Inc. retains different categories of personal data, why we retain it, and how you can request deletion. This policy supplements our Privacy Policy and Data Processing Agreement.

Retention Schedule

Account Data

• Active accounts: retained for the lifetime of the account.
• Cancelled accounts: retained for 90 days post-cancellation, then deleted.
• Legal hold: if required by law or litigation, data may be retained longer with notice to the customer.

Call Records and Transcripts

• Call metadata (duration, timestamp, caller region): 12 months, then automatically purged.
• Call transcripts (if recording enabled): 12 months, or per customer configuration (minimum 30 days for support purposes).
• Call audio recordings (if enabled): 90 days, then automatically purged unless customer extends.

Billing Records

Transaction records are retained for 7 years to comply with financial and tax regulations. Payment card data is never stored by VantaWeb — this is handled exclusively by Stripe (PCI DSS Level 1).

Support and Communications

Support tickets and email communications are retained for 3 years from last activity to support future inquiries and quality improvement.

Analytics and Logs

• Server access logs: 90 days.
• Security logs (authentication, access control events): 12 months.
• Aggregated usage analytics: retained indefinitely (anonymized, no personal data).

Deletion Requests

You may request deletion of your personal data at any time by emailing privacy@vantaweb.io. We will:

• Acknowledge your request within 5 business days.
• Complete deletion within 30 days (or notify you if a legal hold applies).
• Provide written confirmation of deletion upon request.

Note: deletion of account data is permanent and will terminate access to the Service.

Automated Deletion

VantaWeb runs automated deletion jobs for expired data categories. Call records past their retention window are purged nightly. Cancelled account data is queued for deletion at the 90-day mark. You do not need to take any action for automated deletions to occur.

Backups

Database backups are retained for 30 days. Deleted data may persist in backups for up to 30 additional days before being overwritten. Backup restoration is only performed in disaster recovery scenarios.

Sub-processor Retention

Data shared with sub-processors (Anthropic, Telnyx, LiveKit, AWS, Stripe) is governed by each sub-processor's data processing agreement with VantaWeb. VantaWeb contractually requires sub-processors to delete data within 90 days of our deletion or upon contract termination.

Contact

Questions about this policy or to make a deletion request: privacy@vantaweb.io

VantaWeb, Inc. | Subject line: "Data Retention"