Data retention policy
Effective date: 14 October 2026
This policy sets out how long SunLicense keeps each kind of data and how it is deleted. It applies to account data (about you and your staff) and to Customer Data (about your customers) as described in the Privacy policy.
Principles
- We keep data only as long as it is needed to provide the Service, keep it secure, or meet legal obligations.
- You control Customer Data. We keep it, change it and delete it on your instructions.
- We don't collect what we don't need: validation calls are stored with an approximate location only, never with an IP address.
Retention schedule
| Data | Kept for | Notes |
|---|---|---|
| Organization, products, policies | While your organization exists | Deleted when the organization is closed, or earlier on request |
| Licenses, including the customer name and email on them | While your organization exists | Revoked and suspended licenses are kept so they keep failing validation; individual licenses are deleted on request |
| Machine activations (fingerprint, hostname, activation and last-seen times) | As long as the license is kept | Deactivated machines are kept with the license so the history is visible to you |
| Validation history (license key, fingerprint, result, approximate location, time) | While your organization exists, during the alpha | See Validation history below |
| Staff accounts (email, role, password hash) | While your organization exists | Disabled members are kept so you can see who had access; they are deleted on request or when the organization is closed |
| API keys (hash and prefix) | Until revoked; revoked keys are kept as a record | The full key is shown once at creation and never stored |
| Dashboard sign-in token | Expires automatically, at most 12 hours | Stored in your browser, removed on sign-out |
| IP addresses for rate limiting | Minutes, in memory only | Never written to our databases |
| Server access and error logs | Up to 30 days | Used for security and debugging only |
| Support emails | Up to 3 years after the conversation ends | Kept so we can follow up on past issues |
| Bug reports (text, optional email and screenshot, page, browser) | Up to 2 years after the report | Kept with the task on our project board so we can follow up; deleted earlier on request |
| Usage analytics (page views and clicks, no cookies or IP addresses) | Up to 2 years | Anonymous counts on our self-hosted Umami; the visitor identifier changes every month |
| Billing records and invoices (once paid plans start) | As long as tax and accounting law requires, normally 7 years | Kept even after the organization is closed |
| Backups | Up to 30 days | Deleted data leaves backups when they roll over |
Validation history
During the open alpha, validation history is kept for the life of your organization so the dashboard can show long-term trends. Before the alpha ends we will introduce a fixed retention window for validation history, after which older entries are deleted automatically. We will publish the window on this page and give at least 30 days' notice before it takes effect.
Closing your organization
The Owner can ask us to close the organization by emailing [email protected] from the Owner's address. We will:
- confirm the request with the Owner;
- disable the organization straight away, so sign-in and API access stop;
- permanently delete its account data and Customer Data from our live databases within 30 days. From then on its license keys no longer validate;
- let backups roll over, so the data is gone from backups within a further 30 days.
We keep only what we must for legal reasons, such as billing records, and a minimal record that the organization existed and was closed.
Before closing, export anything you need with the Management API.
Deleting individual records
- A license or machine: revoke or suspend a license, or deactivate a machine, in the dashboard at any time. To have specific licenses, products or customer details permanently deleted, the Owner or an Admin can email [email protected]; we act within 30 days. Self-service deletion is coming to the dashboard.
- A staff member: the Owner or an Admin can disable them under Team straight away; email us to have the account deleted.
- Your own data as an individual: email [email protected] with "Privacy" in the subject. If your data is Customer Data held for a software vendor, we forward the request to that vendor.
Legal holds
If we are legally required to keep data (for example by a court order or an ongoing investigation), we keep only the data concerned, only for as long as required, and delete it afterwards.
Changes
We review this policy at least once a year and when the Service changes. Changes are posted here with a new effective date.