Data Retention and Disposal Policy
Last updated: October 2026
Greymill keeps data only as long as it is needed to provide the service or to meet a legal obligation, then deletes or anonymises it, mostly through an automated job that runs every day. This policy supports our Information Security Policy and matches section 12 of our Privacy Policy.
1. Purpose, scope and principles
- Scope: all personal and customer data held by Greymill Limited, in our production database, file storage, backups, logs, subprocessors and staff devices, including financial data received through Plaid and accounting integrations.
- Owner: the founder, as Information Security Owner, owns this policy and the retention schedule.
- Principles: storage limitation (UK GDPR Article 5(1)(e)) and data minimisation. Every data type has a stated retention period, deletion is automated wherever possible, and anonymised data is anonymised irreversibly rather than pseudonymised.
- Consistency: the periods here match section 12 of our Privacy Policy and the settings of our retention job. If one changes, all three change together.
2. Retention schedule
An automated retention job runs daily. It carries out the rolling log deletions and processes each cancelled account 30 days after cancellation.
| Data | Kept for | Then | Reason |
|---|---|---|---|
| Account data: conversations, uploaded files, workspace content, business memory | While the account is active, plus 30 days after cancellation | Permanently deleted | Service delivery; 30 days allows reactivation |
| Bank data from Plaid: access tokens, account and transaction data | While the bank is connected | Deleted on disconnect, or with the account (section 3) | Service delivery |
| Accounting and other connections: Xero, QuickBooks, Google, Gmail, Outlook tokens and cached figures | While connected | Deleted on disconnect or with the account; access revoked with the provider | Service delivery |
| Sorted email previews (Gmail, Outlook) | 30 days from receipt | Deleted automatically | Service delivery |
| Passwords and sign-in sessions | While the account is active | Deleted with the account | Authentication |
| Sign-in records (IP address, approximate location) | While the account is active | Deleted with the account | Security |
| Email delivery log and product analytics events | 13 months | Deleted automatically (hard-bounce records kept as a suppression list) | Operations |
| Security event log and automated answer checks | 24 months | Deleted automatically | Security monitoring |
| Reduced account record: plan, join and leave dates, industry, country | Indefinitely, de-identified | Email replaced; name, phone, company, website, IP and password erased | Business and tax records; churn analysis |
| Usage and cost history (no message content) | Indefinitely, de-identified | Held against the reduced record only | Cost analysis |
| Billing records | 6 years | Deleted; email replaced and billing name, phone and address removed at account deletion | UK tax law |
| Benchmark observations | Indefinitely, anonymised | Re-keyed to a random identifier with no stored mapping | Anonymous industry benchmarks |
| Email opt-outs | Indefinitely | Address kept on a suppression list, unlinked from the account | Never email that address again |
| Database backups | Up to 30 days after deletion from production | Overwritten | Disaster recovery |
3. Plaid and bank data
Bank data is kept only while the customer keeps the bank connected, and goes when they disconnect or leave.
- Minimum collection: only the Plaid products and fields a shipped feature uses are requested and stored.
- Disconnect: when a customer disconnects a bank, Greymill calls Plaid's item removal endpoint to revoke access, then deletes the stored access token, item ID, and account and transaction data straight away.
- Account closure: the same removal runs at once on a request for immediate deletion, or otherwise 30 days after cancellation.
- Inactive connections: a connection that Plaid reports as permanently broken, and that the customer has not repaired within 90 days, is removed the same way.
- No secondary use: bank data is never sold, used for advertising or used to train AI models, and is not kept in the reduced account record or in anonymised datasets.
- Backups: deleted bank data may persist in encrypted backups for up to 30 days until they are overwritten, and is not restored or used in that time.
4. Disposal methods
Each kind of storage has a set way to dispose of data so that it can't be recovered.
| Where | How data is disposed of |
|---|---|
| Production database | Rows are permanently deleted, or identifying fields are erased in place, by the retention job or the admin delete-account process. Both use the same shared erasure code, so they delete the same data. |
| File storage | Uploaded files are deleted from storage buckets. A deletion that does not finish is recorded and retried on each daily run until done. |
| Backups | Overwritten on the provider's rolling cycle within 30 days. Backups are encrypted and never restored to read deleted data. |
| Third-party connections | Access is revoked with the provider (Plaid item removal, Google and Xero token revocation) before local tokens are deleted. |
| Subprocessors | Bound by data processing agreements to delete or return data when the service ends, and to apply their own retention limits. |
| Staff devices | Customer data is not stored on personal devices. Devices are full-disk encrypted; leavers' devices are returned or securely wiped, and failed drives are destroyed. |
| Paper | Customer data is not printed. Any paper record is cross-cut shredded. |
The retention job can only be started with a dedicated secret. Every run reports exactly what it deleted, and failures raise an alert.
5. Deletion requests, legal holds and review
- Deletion requests: a customer may ask for immediate deletion by emailing support@greymill.ai. We verify their identity and run the same erasure process at once instead of after 30 days. Requests are answered within one month under UK GDPR, or 45 days for California residents.
- Legal holds: where law, a regulator or litigation requires data to be kept, the owner suspends deletion for the data concerned only. The hold is recorded and lifted as soon as it ends.
- Verification: each retention job run reports what it found and deleted; failed deletions are retried and raise an alert. Each quarter, the owner checks that no cancelled account older than 30 days is still identifiable and that no disconnected bank data remains.
- Review: at least once a year, and whenever a new data type, integration or legal requirement is added.
6. Contact
For questions about this policy or to request deletion, email support@greymill.ai. Next scheduled review: October 2027.
Greymill Limited · Registered in England and Wales · Company number 17144930 · ICO registration ZC120843 · 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ