Retention policy for the Clientflow portal
Published 5 September 2026. Last updated 6 September 2026.
One row per class of data in the portal: where it is, how long we keep it, why that long, and what happens to it if you ask us to delete your data. "Project end" is the date a project's last phase completes or a care plan is cancelled; "deal closed" is the date a deal is marked won, lost, parked or expired.
| Data | Where | Kept for | Why | On an erasure request |
|---|---|---|---|---|
| Your account: name, email, phone number, role, company and its address | Portal database (London) | While your company is a client, then 24 months after project end | So you can come back to your files and receipts, and so a second project uses the same sign-in | Deleted, subject to the two rows marked † |
| Sessions: the IP address and browser of each session | Supabase Auth (London) | Until the session ends: when you sign out, when a device comes back after 30 days without a visit and is signed out, or when we end it; the row is deleted 24 hours after that. On the Pro database plan (Phase 4) sessions also expire by themselves after 30 days idle | Security | Ended immediately |
| Sign-in audit events (time, action, IP address, browser) | Supabase project logs | 1 day on the current plan, 7 days on the Pro plan. The database copy of this log (auth.audit_log_entries) held no rows when we checked on 2 Sep 2026, after sign-ins had happened, so the write to it is off; if we turn it on, this row says so and gives its retention | Diagnosing sign-in problems | Expires on its own |
| Unsent discussion drafts | Your browser tab, scoped to your account | Restore for up to 24 hours; removed on send/discard, the next draft save after expiry, or when the browser discards the tab session | Recover interrupted writing | Not collected by us until submitted |
| Scoping answers, comments, feedback items and attachments, uploaded files, approvals | Portal database and file storage (London) | Project end plus 24 months | They are the working record of your project and the basis of support | Deleted, except approvals, which are part of the activity log † |
| Signing evidence † : typed name, email, version and hash signed, UTC time, IP address, browser | Portal database (London) | Six years after the contract ends | It is the evidence of what was agreed, for as long as a claim under the contract could be brought | Kept. This is the record of a contract you signed |
| The activity log † : who did what in the portal, and when | Portal database (London), append-only | Six years after the contract ends | It is the contract log: approvals, signatures, phase changes. The portal cannot edit or delete an entry; only a database migration can, and those are recorded in our source history | Kept; the link from your entries to your account is removed, so they no longer identify you |
| Executed proposals and certificates of completion (from Phase 4), receipts (from Phase 5) | Portal file storage (London) | Six years after the end of the financial year they belong to | Company records we must keep | Kept |
| Payment records (amount, method, reference, receipt number, status) | Portal database, and Stripe once card payments start | Six years after the end of the financial year | Accounting records we must keep | Kept |
| Proposal views (contact, version, time, phone or desktop) (from Phase 4) | Portal database (London), internal only | Deal closed plus 12 months; kept with the project record if the deal is won | Timing our follow-up while a proposal is live; a case-study metric afterwards | Deleted |
| The pre-call note, call notes and correspondence attached to a deal (deals from Phase 4; today, notes on a project visible only to Clientflow) | Portal database (London) | Deal closed plus 12 months if no project follows; otherwise with the project (today: project end plus 24 months) | Context for the proposal and the build | Deleted, or your name removed where the note is about your company rather than you |
| Emails we send you (magic links, notifications) | Resend (United States) | 30 days | Delivery and bounce diagnostics; Resend's fixed retention | Expires on its own |
| Error reports (page, technical detail, no cookies, no IP address) | Sentry (EU region, Frankfurt) | 30 days on the current plan, 90 on the Team plan | Fixing faults | Expires on its own |
| Request logs (IP address, browser, URL) | Vercel (London functions; edge for the session refresh) | 1 day | Running the service | Expires on its own |
| Database backups | Supabase | None on the current plan. On the Pro plan, daily backups kept 7 days, so deleted rows can persist in a backup for up to 7 days | Disaster recovery | Cleared as backups roll off |
† Kept after an erasure request. Both are needed to establish, exercise or defend a legal claim under the contract you signed, which is one of the cases where the right to erasure does not apply.
How erasure works
Write to hello@clientflow.ai. We confirm who you are, act within one month, and tell you what was deleted and what was kept and why. Until the portal's own erasure control ships (Phase 8 item 8.8), deletion is carried out by hand by Clientflow against the database, from a local machine under a documented procedure, and never through a deployed route; the signing record is the one thing that stops an account being removed outright today, which is why the log detaches your name rather than deleting the entry.
Review
This policy is reviewed when the portal starts keeping a new class of data, and in full before launch (Phase 8 item 8.7).