1. The principle
We keep personal data for as long as it is doing a job, and then we stop. Where the law requires us to keep something for a fixed period, we keep it for that period and no longer. We do not retain data because it might one day be interesting.
2. What we keep, and for how long
- Account details (name, email, phone, country) — while your account is open, then 90 days.
- Business profile (trade, size, goals) — while your account is open. Deleted immediately on request; it only exists to personalise what you are shown.
- Verification records (identity details, extracted document text, screening results, the audit trail) — while your account is open and five years afterwards, in line with Indian anti-money-laundering practice for records of this kind.
- Invoices, payments, wallet ledger and GST records — eight years, as Indian tax and companies legislation requires. These cannot be deleted on request.
- Firm data (clients, matters, documents, books) — while the firm account exists. Deleted with it, permanently and immediately, when you or we delete the firm.
- AI request records (what was asked, what was produced) — 12 months, so we can answer “what did it tell me in March”.
- Grievance records — three years from closure.
- Server and security logs — 180 days.
- Marketing consent and unsubscribe records — kept after you unsubscribe, precisely so that we do not write to you again.
3. Documents: we keep the text, not the file
When you upload a document — a contract, a notice, an identity document — we extract the text, mask sensitive numbers, store the text, and discard the original file. We do not hold a library of your PDFs and scans. It is enough for the work, and it means a breach of our systems does not put your original documents into anybody’s hands.
4. Asking us to delete
Write to grievance@cehpoint.co.in from the address on your account. We will confirm within 30 days what we have deleted and what we are required to keep. You can also delete most things yourself from inside the product — a document, a client, a matter, a ledger entry, a saved message — and those deletions are immediate and permanent.
5. What survives a deletion request
Financial records we are required by law to retain; records of a grievance while it is open; and anything needed to establish, exercise or defend a legal claim. Where we keep something after you have asked us not to, we will tell you what it is and which obligation requires it — we will not simply refuse.
6. Backups
Deleted data disappears from our live systems at once and ages out of encrypted backups within 35 days. Backups are never mined, searched or restored selectively to recover something you deleted.
7. If you close your account
Tell us and we will close it. Your workspace data is deleted; the statutory records above are retained for their periods and then destroyed. A closed account cannot be reopened, so export anything you want to keep first.
Write to grievance@cehpoint.co.in about anything in this document, or support@cehpoint.co.in for day-to-day help.