Retention Schedule

Last updated 25 July 2026

How long we keep each kind of data.

Asking us to delete your account

If you hold a ProCafe account, you can request deletion from Settings → Your account in the app. We confirm the request by email and answer within one month, as UK GDPR requires. What happens then:

Your request is logged and acknowledged. Your account keeps working — a request is not an instant deletion, and you can withdraw it at any time by replying to the confirmation email.
We close the account. Sign-in stops working immediately and the account stays recoverable for 30 days, in case the request was a mistake or was not made by you.
We erase your personal details. After the 30 days, your name, email, password and second-factor details are permanently removed. We email you to confirm.

Records your cafe is legally required to keep are not deleted. Where the cafeis the controller — your staff record, and food-safety entries signed under your name — those can still carry your name after your account is gone: that is the cafe's decision and their legal obligation, so ask them directly. What ProCafe holds about you as an account holder — your name, email, password and second-factor details — is erased.

Where a legal hold applies (a claim, an investigation, a regulator's request), erasure waits until it lifts. Your request stays open with us in the meantime and we act on it once the hold ends — you do not need to ask again. Backups age out on the schedule below.

If you are a staff member rather than the account holder, your employer is the controller of your records: ask them, and we will act on their instruction.

Schedule

Data	Kept for	Notes
Your live operational & staff data	For the life of the account	Earlier deletion goes through a data-subject request — usually via the cafe as controller — and may be subject to audit or legal retention.
A closed account, before erasure	30 days after closure	Recoverable in case a deletion request was a mistake or was not made by the account holder; then the personal details are erased.
Record that a deletion request was made	6 years	The request, its deadline and how it ended — kept as proof we answered, without your name or email attached once the account is erased.
Food-safety records & their audit trail	While the account is active; exportable on closure	We provide export so you keep your own copy.
Account & billing records	6 years after account closure where legally required	ProCafe as controller; tax/accounting obligation.
Support correspondence	24 months	Kept to resolve issues and maintain service history.
Request / security logs	90 days, then purged	No special-category data; minimal personal data.
Backups	30-day rolling window	Deletions in the live database age out as backups expire.
Mobile on-device cache & outbox	Outbox: queued until synced. Cached reads may persist locally until pruned or the device is wiped.	Stored on the device, namespaced per user and cafe. Signing out and clearing the device removes local data.