Retention and Deletion Policy
Version: 1.0 Effective from: 2026-10-09 Provider: Paul Bengart, Keplerstraße 4A, 39104 Magdeburg, Germany Related documents: This Policy is an annex to the Data Processing Agreement and forms part of the Terms of Service under Section 10. It supplements the Privacy Policy and the Data Act Exit and Switching Policy.
1. Principles
(1) For survey responses, designs, media and analysis results, the Provider is the processor; the Customer, as controller, decides on retention and deletion. For account, contract and security data and for the usage statistics of the application (account-related usage data, no longer than 90 days) and the consent for the Google Sheets connection, the Provider is itself the controller. The Provider does not delete spreadsheets that it creates in the Customer's Google Drive on the Customer's instruction; they stay at Google under the Customer's control, and the periods of this Policy do not apply to them.
(2) Survey responses are not deleted automatically during the contract. Complete and incomplete responses are treated alike. They remain stored until the Customer deletes them, deletes the project, deletes the account or the contract ends.
(3) The Customer can delete individual responses, entire projects and its account in the platform at any time. Deleted responses and projects are immediately excluded from analyses and exports and can be restored during the grace period stated in Section 2.
(4) After the end of the contract, deletion is governed by the Data Act Exit and Switching Policy: a data retrieval period of 30 calendar days, followed by deletion at the latest within 30 days.
(5) Statutory retention obligations, in particular under the German Fiscal Code (AO), take precedence over the periods in this Policy insofar as they cover the affected data.
(6) A legal hold (retention because of litigation, official proceedings or a preservation order) covers only the data actually affected and ends as soon as the ground ceases to apply. The Customer is informed to the extent legally permitted. The export of a copy to the Customer remains possible insofar as no order precludes it.
(7) The database is backed up through the database provider's point-in-time recovery (no longer than 10 days), the application server including the project files at the hosting provider (no longer than 14 days). In addition, the Provider creates its own backups of the database and the project files; on the application server they are retained for no longer than 30 days; copies on an encrypted external storage medium are replaced with each new copy and deleted after 45 days at the latest. Deleted data may therefore remain in backups for no longer than 45 days. After a restore, documented deletions are carried out again. This also applies to the deletion of an account's usage data after an objection in the profile.
(8) Periods are stated in calendar days. The start of each period is set out in Section 2.
2. Retention schedule
| Data category | Start | Active retention | Grace period | Final deletion | Residual retention in backups | Exceptions |
|---|---|---|---|---|---|---|
| Survey responses (complete and incomplete) | Receipt of the response | until deletion by the Customer, deletion of the project or account, or the end of the contract; no automatic deletion | none (see "responses deleted by the Customer") | after the end of the contract under the Exit Policy: 30 days retrieval, then at the latest within 30 days | no longer than 45 days | legal hold; statutory retention obligation; Customer instruction for earlier deletion |
| Responses deleted by the Customer | Deletion in the platform | none; the response is immediately excluded from analyses and exports | restorable in the project's bin until the Customer deletes them there or empties the bin; no automatic deletion from the bin; imported responses: none | once the Customer deletes them in the bin or empties the bin, otherwise as for survey responses; imported responses immediately | no longer than 45 days | legal hold |
| Project data (survey flow, configuration, designs, media) and saved analysis results (HB runs, Latent Class, TasteNet, simulations) | Creation | until deletion of the project or account or the end of the contract | projects deleted by the Customer restorable for at least 30 days | then final deletion, at the latest after 60 days; after the end of the contract under the Exit Policy | no longer than 45 days | legal hold; statutory retention obligation |
| Generated download files (exports, packages and reports requested by the Customer) | Generation | 30 days | none | after 30 days | no longer than 45 days | none; saved analysis results fall under project data |
| Account (deletion by the Customer) | Deletion request | account deactivated immediately, projects paused; a running subscription is cancelled beforehand at Polar with effect from the end of the billing period | 30 days with the option to revoke the request; none if immediate deletion is chosen | without undue delay after expiry of the grace period, at the latest within 30 days; in the case of immediate deletion at the latest 30 days after the request; in the process, the Provider asks Polar to delete the customer and to pseudonymise the customer data as far as Polar technically provides for this (notification under Article 19 GDPR) | no longer than 45 days | legal hold; statutory retention obligation; pending litigation; contract records, pseudonymised audit events, pseudonymised order data from Polar and the deletion record under the rows applicable to them |
| Inactive free accounts | Last use (login, project or survey activity) | no fixed period; the Provider may terminate free accounts that have not been used for at least 6 months by e-mail with a notice period of 30 days | notice period of 30 days; if the Customer logs in within the notice period, the termination lapses; before expiry the Customer can export its data | after expiry of the notice period the account is deleted, at the latest within 30 days | no longer than 45 days | paid contract; legal hold; pending litigation; statutory retention obligation |
| Contract records (accepted versions of the Terms of Service, Data Processing Agreement and Privacy Policy, time of acceptance, classification as consumer or business customer) | End of the calendar year in which the contract ended | term of the contract and thereafter until 3 years after the end of the calendar year in which the contract ended (Sections 195 and 199 BGB) | none | after expiry of the 3 years at the annual deletion date in January | no longer than 45 days | in the event of litigation until its conclusion |
| Audit and security events (logins, changes, exports, security incidents) | End of the calendar year of the event | 3 years (Sections 195 and 199 BGB); IP addresses are truncated automatically 90 days after the event (IPv4 to /24, IPv6 to /48); on account deletion, direct account identifiers are pseudonymised | none | after expiry of the 3 years | no longer than 45 days | legal hold |
| Usage statistics of the application (raw events with account identifier: time, function or page, question type, analysis family, task type, export format or tab, response time; without content, responses, project identifier, IP address and device details) | Event | 90 days; evaluations read only events of the last 90 days | none | by a nightly job as soon as an event is older than 90 days; on objection via the switch in the profile immediately for all events of the account | no longer than 45 days; after a restore, deletions following an objection are carried out again | none; aggregated figures are not stored permanently but calculated on retrieval from the raw events of the last 90 days |
| Answer "How did you hear about us?" on the account (voluntary) | creation of the account | 90 days | none | by a nightly job after 90 days; on objection via the switch in the profile immediately | no longer than 45 days | total per answer without account reference, no fixed period |
| Daily totals of the website and the registration (per day and coarse value, without visitor or account reference) | day of counting | no fixed period, because without personal reference | none | no automatic deletion | no longer than 45 days | this row describes the totals themselves |
| Application logs | Log entry | at most 14 days (daily rotation) | none | at the latest after 14 days | no longer than 45 days | none |
| Error reports (failed operations, for troubleshooting) | Creation | 90 days | none | automatically after 90 days | no longer than 45 days | legal hold |
| Container logs | Log entry | rotated on a size basis, at most 30 MB per service; no fixed age limit | none | with the rotation | no longer than 45 days | none |
| Provider logs (Netcup, Ubicloud, coolLabs, do.de) | Log entry at the service provider | according to the periods of the respective service provider | none | by the service provider | according to the rules of the service provider | security and legal obligations of the service provider |
| Contact enquiries (contact form, e-mail) | Receipt | until completion, at most 15 months | none | after completion, at the latest after 15 months | none; mailbox at the e-mail service provider, not in the application database | enquiries related to a contract: according to the periods for legal requests; legal hold |
| Legal requests (DSA notices, terminations, withdrawals, data protection requests) | End of the calendar year of receipt | 3 years | none | after expiry of the 3 years at the annual deletion date in January | no longer than 45 days | legal hold |
| Order data from Polar (order and invoice number, reason, status, whether it is paid, amounts with currency, times of order and payment, identifiers of customer, subscription, checkout and product, e-mail address, account and workspace reference) | End of the calendar year of the last change of the order (at Polar), otherwise of the order | 3 years (limitation period, Sections 195 and 199 BGB); on account deletion, the e-mail address, the account and workspace reference and the Polar identifiers of customer, subscription and checkout are removed; order and invoice number, plan, amounts, status and times remain (pseudonymised, not anonymised, because they can be attributed through Polar) | none | automatically by a daily job as soon as the 3 years have expired; older orders are not imported again during the reconciliation with Polar | no longer than 45 days | legal hold; pending litigation. Account deletion does not change exports already downloaded by the Provider and does not cover orders that were placed with an earlier e-mail address and a different Polar customer identifier and were never linked to an account |
| Results of the reconciliation with Polar (time, counters, findings with account, workspace and subscription identifiers, plan and status details; no e-mail addresses) | Start of the reconciliation run | 90 days; on account deletion, the findings concerning that account are removed immediately | none | automatically by the daily job after 90 days | no longer than 45 days | none |
| Google Sheets consent (identifier and e-mail address of the Google account, granted permissions, encrypted refresh token; access tokens are not stored) | Connection of the Google account | until the user disconnects Google Sheets in the profile or connects another Google account, until a security event (password change, password reset, "Sign out everywhere") or until account deletion | none | immediately with the event; the token passes to the revocation request to Google | no longer than 45 days | none |
| Connection data per project (Google Sheets: identifiers of the spreadsheet and its sheets, variant, status, times of the last update and of the last attempt, error codes without content, time and text version of the confirmation) | Setup of the connection | until the user ends the connection with "Stop updating", the project is deleted or the account is finally deleted; after the consent ends, the connection is kept in paused state | none | with the respective event | no longer than 45 days | none |
| Revocation request to Google (encrypted refresh token, number of attempts, error code) | End of the consent | until Google confirms the revocation or a new consent for the same Google account replaces the old consent | none | automatically afterwards; if the same Google account is connected again, open requests for that Google account are discarded, because the new consent replaces the old token | no longer than 45 days | none |
| Spreadsheet in the Customer's Google Drive (Google Sheets connection) | Creation by the Provider on the Customer's instruction | at the Customer, as the Customer decides | not applicable | no deletion by the Provider, not even when the connection ends or the project or account is deleted | not applicable | the spreadsheet is subject to the terms of the Customer's Google account |
| Deletion record of an account deletion (numeric identifier of the deleted account, hash of the e-mail address formed with a secret key, times, state and operator of the deletion, identifiers of deleted projects; until the deletion at Polar has succeeded, additionally the Polar customer identifier) | Account deletion | no fixed period, no automatic deletion; the record serves to resume and evidence the deletion and prevents orders of a deleted account that are later imported from Polar from being stored again with an account identifier or e-mail address; the Polar customer identifier is removed once the deletion at Polar has succeeded | none | no automatic deletion | no longer than 45 days | if an interrupted deletion is rolled back, its record does not count for this check |
| Accounting records of the Provider | End of the calendar year in which the record arose (Section 147(4) AO) | accounting vouchers and invoices 8 years; books and records (such as the cash-basis income statement, EÜR) 10 years; other documents relevant for taxation 6 years (Section 147(3) AO) | none | after expiry of the statutory period at the annual deletion date in January | in the Provider's accounting system | invoices to Customers are issued by Polar as seller under its own periods |
| Backups (point-in-time recovery of the database, backup of the application server at the hosting provider, the Provider's own backups) | Creation of the backup | point-in-time recovery no longer than 10 days; backup of the application server at the hosting provider no longer than 14 days; own backups on the application server no longer than 30 days; encrypted external copies are replaced with each new copy and deleted after 45 days at the latest | none | on expiry of the respective period by deletion or overwriting | not applicable | no use for restoring individual deleted Customer data; after a restore, documented deletions are carried out again |
3. Customer instructions and shorter periods
(1) The Customer implements shorter periods first itself: by deleting individual responses, entire projects or the account in the platform. These deletions take effect immediately on analyses and exports and become final after expiry of the grace period.
(2) In addition, the Customer may give the Provider instructions on retention or deletion in text form (for example by e-mail) to info@choicery.ai or privacy@choicery.ai, such as the deletion of a project after the end of a study or the deletion of specific data categories. The Provider carries them out without undue delay.
(3) A project-specific automatic deletion period cannot be configured in the platform. The Customer implements shorter periods by deleting data itself or by instruction under paragraph 2.
(4) Instructions cannot override statutory retention obligations or a legal hold. In that case the Provider informs the Customer of the scope and reason for the continued retention.
(5) Requests from survey participants concerning their rights are directed to the Customer as controller. The Provider forwards such requests without undue delay and supports the Customer in accordance with the Data Processing Agreement.
4. Relationship to the Exit Policy and the Data Processing Agreement
(1) Upon the end of the contract, the Data Act Exit and Switching Policy takes precedence over this Policy. It governs the data retrieval period and deletion after the end of the contract.
(2) This Policy specifies the deletion and return of data under Article 28(3)(g) GDPR and is an annex to the Data Processing Agreement. For survey responses, designs, media and analysis results, the Customer's instructions take precedence over the periods in this Policy insofar as no statutory obligation or legal hold precludes them.
(3) For account, contract, security and accounting data, the periods in this Policy apply directly. The details of the processing are set out in the Privacy Policy.
(4) In the event of conflicts, the order of precedence under Section 1 of the Terms of Service applies.
5. Changes to this Policy
(1) The Provider announces changes to this Policy in accordance with Section 17 of the Terms of Service.