Data Retention Automation Status
Last Updated: November 3, 2026
This page tracks the implementation status of automated data retention enforcement as described in our DPA (Section 10) and Records of Processing Activities (ROPA), in compliance with the GDPR storage limitation principle (Article 5(1)(e)).
Under Art. 5(1)(e), personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data is processed. The retention periods below reflect this principle.
| Data Category | Stated Retention | Legal Basis for Retention | Automation Status | TTL Mechanism |
|---|---|---|---|---|
| AI usage events | 24 months (kept for the same 24 months after account deletion as billing records, no longer linked to any identifying profile) | Legitimate interest (Art. 6(1)(f)) — service optimization | Automated | DynamoDB TTL (expiresAt) |
| Activity logs | 90 days | Legitimate interest (Art. 6(1)(f)) — security monitoring | Automated | DynamoDB TTL (ttl) |
| Sessions | 24 hours | Contract (Art. 6(1)(b)) — authentication | Automated | DynamoDB TTL (expiresAt) |
| Email events | 180 days | Legitimate interest (Art. 6(1)(f)) — deliverability analytics | Automated | DynamoDB TTL (expiresAt) |
| Messages/threads | 730 days | Contract (Art. 6(1)(b)) — service delivery | Planned | Scheduled cleanup job (in development) |
| Agent executions | 365 days | Contract (Art. 6(1)(b)) — audit trail | Planned | Scheduled cleanup job (in development) |
| Email campaign jobs | 365 days | Legitimate interest (Art. 6(1)(f)) — campaign analytics | Planned | Scheduled cleanup job (in development) |
| Snapshots | 365 days | Legitimate interest (Art. 6(1)(f)) — business intelligence | Planned | Scheduled cleanup job (in development) |
| Voice-clone reference audio | 30 days (deleted immediately on account deletion, or when you withdraw voice-cloning consent) | Consent (Art. 6(1)(a)) — recorded voice-owner attestation before any reference is created | Automated | S3 lifecycle rule (ExpireVoiceReferences, tag-scoped) |
| Billing records | 7 years | Legal obligation (Art. 6(1)(c)) — tax/financial law | Manual review | Legal retention requirement |
Voice Recordings
When you use voice cloning in the voiceover studio, we extract a short audio sample from your video to use as a voice reference. Because a recording of a person's voice is sensitive, it is handled more strictly than other media:
- It is only created after you confirm that you own the voice or have the voice owner's permission, and that confirmation is stored with the recording.
- It is automatically deleted 30 days after it is created. Nothing is lost — a new reference can be extracted from your source video whenever you need one, and doing so asks for your confirmation again.
- Withdrawing consent deletes the recording immediately, as does deleting your account.
- Video you publish that was made with a cloned voice is labelled as containing an AI-generated voice.
Data Subject Rights Override
Regardless of the retention periods above, data subjects may exercise their right to erasure (Art. 17 GDPR) at any time via the in-application deletion mechanism (Settings > Delete Account) or by contacting dpo@aibizlutions.com. A valid erasure request overrides all retention periods except where legal obligations require continued retention (e.g., billing records under tax law).
Methodology
Automated: Data is automatically and irreversibly deleted by DynamoDB's built-in Time-to-Live (TTL) feature, which checks the specified timestamp attribute and removes expired items within 48 hours of expiration. No human intervention is required.
Planned: Retention targets are documented and scheduled cleanup mechanisms are under active development. Until automated, periodic manual review may be conducted.
Manual review: Data is subject to legal retention requirements and will be purged only after the legal retention period expires, following manual verification that no active legal hold applies.
Data Protection Officer
Email: dpo@aibizlutions.com
AI Bizlutions, LLC, PO Box 717, Queen Creek, AZ 85142, USA