Retention & deletion

Version: 1.0
Last updated: 1 August 2026

This page describes the retention, deletion, and anonymisation rules applied by Kraken Labs, publisher of neuronxcrm.

It complements the Privacy Policy and the Data Processing Agreement (DPA) concluded with professional customers.

1. General principles

Kraken Labs applies the following principles:

• retain personal data only for the time needed for the purposes pursued and applicable legal obligations;
• limit technical retention (logs, backups) to what is strictly necessary for security, diagnosis, and continuity;
• at the end of stated periods or the contractual relationship, delete, anonymise, or return data in accordance with the DPA and customer instructions.

2. Retention by data type

2.1. User accounts and profiles

Paid accounts
Account, identity, contact, and settings data are retained for the contractual relationship, then archived for up to five (5) years for evidence, claims management, dispute prevention, and contractual follow-up, subject to longer legal duties.

Inactive free accounts
Absent login for twenty-four (24) consecutive months, Kraken Labs may delete or anonymise the free account and associated account data, subject to legal retention duties (notably billing).

2.2. Contractual and billing data

Billing data and supporting documents are retained for the period required by applicable accounting and tax rules, which may be up to ten (10) years for certain documents.

2.3. Tenant CRM data (processor role)

CRM records, metadata, files, and related customer content are retained for the duration defined by the customer as controller, then deleted or returned on request or at contract end under DPA reversibility clauses.

2.4. Connected Gmail mailbox data

When a Gmail integration connection is deleted/disconnected:

• associated mail_accounts, threads, messages, attachments, and CRM-message links for that connection are cascaded and removed from production systems;
• OAuth tokens for that connection cease to be used and are removed with the credentials reference.

Until disconnect, synced mailbox data is retained to provide the mail features configured by the customer/user, subject to product sync windows and customer instructions.

2.5. Technical and security logs

Technical and security logs are retained only as needed for security, diagnosis, and incident management, up to a maximum of six (6) months, unless a longer legal duty applies.

2.6. Backups

Technical backups needed for restoration are retained for a maximum of thirty (30) calendar days, then deleted automatically via object-storage lifecycle rules. They are used only for continuity or incident management.

2.7. Support and communications

Support exchanges, including emails, tickets, and attachments, are retained for the time needed to handle requests, then archived for up to five (5) years for customer-relationship follow-up, evidence, claims management, and defence of Kraken Labs’ rights, subject to specific legal duties.

2.8. Prospecting data

Prospecting data is retained until consent withdrawal, exercise of the right to object, or, absent interaction, for a maximum of three (3) years from the data subject’s last contact.

3. Return of data and export formats

At contract end or on request, Kraken Labs enables the customer to retrieve data in natively usable formats without complex conversion on the customer’s side, for example:

• CRM/tabular exports: CSV and similar formats supported by the product;
• metadata packages and configurations: structured JSON or documented equivalents;
• other generated artefacts: in native formats when supported.

Practical modalities (scope, schedule, transfer channel) are set out in the DPA or product documentation.

4. Deletion, anonymisation, and contract end

4.1. After retention periods

At the end of defined periods, data are deleted from production systems or irreversibly anonymised where relevant for exclusively statistical, improvement, or evidential uses without re-identification.

Retention beyond announced periods is permitted only for legal obligation, express customer instruction (as controller), or duly justified evidential necessity (for example litigation).

4.2. Contract end and reversibility

When the contract ends or is terminated:

• the Customer may request return of data in standard formats supported by the service;
• standard return covers only natively available exports; additional migration assistance may be billed unless expressly agreed otherwise;
• after the applicable reversibility period, Kraken Labs deletes remaining personal data from production systems within a maximum of thirty (30) calendar days, subject to legal retention duties, normal technical purge constraints, and the normal backup overwrite cycle.

Residual data in backups follow only their normal expiry cycle (maximum thirty (30) days) and are not restored for other purposes than continuity or incident management.

5. Impact of backups on complete erasure

Erasure is performed first in production systems.

Because backups are copies for business continuity:

• backups containing deleted data are not re-injected into production except in exceptional major-incident necessity;
• lifecycle rules ensure automatic deletion beyond the retention window.

Even if immediate erasure from all backups is not technically possible, data become progressively inaccessible (not restored) and then permanently deleted.

6. Specific erasure requests

When you exercise a right to erasure or request deletion of certain data:

• Kraken Labs applies erasures in the relevant systems, as controller or processor as applicable, within reasonable regulatory timeframes;
• where legal duties require retention of certain data (for example accounting documents), those data are archived with restricted access until the corresponding periods expire.

Practical modalities for exercising rights are detailed in the Privacy Policy.