What is stored, and for how long
A nightly run removes whatever is past its retention period.
Selfdesk deletes on periods that are set in the software and match what the privacy policy states. A nightly run applies them; there is no setting for this.
| What | How long |
|---|---|
| Invoices, payments, bookings, kiosk purchases | eight years, the statutory retention for accounting records |
| Audit log | three years, then deleted |
| Data of an inactive space | six months, then deleted for good; the receipts stay locked until their eight years are over |
| Data of a space its owner deleted | 30 days, then deleted for good like an inactive space |
| Person link in the door log | 30 days, after that only the anonymous row remains |
| Evidence attached to a document acceptance | three years for IP address and user agent, the acceptance itself stays |
| Closed import rows | 90 days |
| Closed deletion requests | one year |
That includes:
- The eight years are a legal obligation, not a setting. Nothing in that group is deleted automatically, not even after an account deletion. The link to the person is cut instead. See When a member deletes their account.
- When a space has been inactive for six months, Selfdesk deletes everything without a retention duty: desks, rooms, plans, unbilled bookings, messages, photos, doors, invitations and settings. Invoices, payments, kiosk and guest receipts, contracts and billed bookings stay locked: nobody reaches them in the product any more, the operator gets them on request. Eight years after the end of the year of the newest receipt, the nightly sweep deletes them too. Members' accounts stay.
- When the owner deletes the space under Settings → Space, it is gone for everyone at once: the subscription ends and upcoming bookings are cancelled. 30 days later the nightly sweep deletes it for good, just like an inactive space after six months. Within those 30 days we can bring the space back if you write to hilfe@selfdesk.app; it is then inactive until you reactivate it on the web.
- The audit log is not covered by the eight years. It is a security record and is deleted after three years.
- Door events lose their link to a person after 30 days. What remains is statistics. See Door log: 30 days, not an attendance record.
- Crash reports are only collected if a member switches them on themselves. The default is off, and the web app collects none at all.
- Every rule runs on its own. If one fails, the others still run.