Removing is not deleting

Removing a member from your space is an access decision. It is not a deletion, and it cannot be one: invoices are accounting records and have to be kept.

What removing does:

• The running contract ends today, and so does a successor already queued behind it.
• Future desk and room bookings are cancelled.
• Door permissions and that person's door logs in your space are deleted.
• An admin role is revoked.

What stays:

• Invoices, payments, bookings and kiosk purchases are kept for eight years. That is the statutory retention period for accounting records.
• The billing address stays, because it is the recipient block of those retained documents.
• Name and address on old invoices are frozen at the time of issue. They do not change even when the profile is anonymised later.

Real deletion only happens through account deletion, and the person drives that themselves:

1. They request it and confirm by a link in an email.
2. A platform admin reviews and processes it. Credentials and sessions are gone afterwards, and running contracts are ended at the end of the month. Name and address stay visible until then, so you can still wind the running contract down.
3. Anonymisation runs at night. Once no contract is running any more, name, email and picture are removed. From that moment the profile drops out of your member lists.

The one hard block: whoever is the sole owner of a space cannot have their account deleted before ownership has been transferred.

What is kept for how long is in What is kept and for how long.