Retention Schedule

Last updated 31 October 2026

How long we keep each kind of data.

Asking us to delete your account

If you hold a ProCafe account, you can request deletion from Settings → Your account in the app. We confirm the request by email and answer under the timeframe that applies to your request (one month for UK GDPR requests). What happens then:

Your request is logged and acknowledged. Your account keeps working — a request is not an instant deletion, and you can withdraw it at any time by replying to the confirmation email.
We close the account. Sign-in stops working immediately and the account stays recoverable for 30 days, in case the request was a mistake or was not made by you.
We erase your personal details. After the 30 days, your name, email, password and second-factor details are permanently removed. We email you to confirm.

Removing a person's account does not automatically remove the cafe's food-safety evidence. Where the cafe controls operational records — your staff record, and food-safety entries signed under your name — those can still carry your name after your individual account is gone. Ask the cafe about those records. Closing the whole cafe account is different: export the records you must retain before closure, because its operational data is removed after the recovery period unless a legal hold applies. What ProCafe holds about you as an account holder — your name, email, password and second-factor details — is erased.

Australian category-one food businesses that use records to substantiate controls must keep those records for at least three months; another requirement may call for longer. An authorised officer may accept another way to demonstrate control. New Zealand operators under a Food Control Plan or National Programme must keep required records for at least four years from creation. These are the business's retention duties, not a promise that a closed ProCafe account remains accessible for those periods. See FSANZ evidence guidance and NZ Food Regulations 2015, regulations 36 and 81.

Where a legal hold applies (a claim, an investigation, a regulator's request), erasure waits until it lifts. Your request stays open with us in the meantime and we act on it once the hold ends — you do not need to ask again. Backups age out on the schedule below.

If you are a staff member rather than the account holder, your employer is the controller of your records: ask them, and we will act on their instruction.

Schedule

Data	Kept for	Notes
Mobile app version reports	Latest report per installation, user and cafe, until account erasure	New reports replace the version/build and last-reported time. These support records are removed when the user or cafe is erased.
Your live operational & staff data	For the life of a paid account	Earlier deletion goes through a data-subject request — usually via the cafe as controller — and may be subject to audit or legal retention.
Attendance evidence & payroll-preparation history	Account lifetime, subject to controller instructions and lawful retention	Includes stored owner-enabled clock-in coordinates, accuracy and photos, breaks, corrections, approval history and captured base/overtime rates. Upload-link expiry does not erase a completed attendance record or its evidence.
Private employee records & contract evidence	Account lifetime, with controller-led retention review	Includes contact details, right-to-work files and manual reviews, payslips, immutable profile/contract versions and signing receipts. A recorded retention date is for manual review; it does not automatically erase the record or earlier versions. Follow a deletion request through the business, subject to lawful retention.
Team messages & read state	Account lifetime, subject to controller instructions and lawful retention	Removing membership stops further access; it does not automatically erase conversation history or other participants’ records. Pending mobile sends remain on the device until sent or cleared.
An unpaid trial account	30 days after the trial ends, then erased	For those 30 days the account is read-only: subscribe to keep it, or export your records. We email the owner when the trial ends, 7 days before and 1 day before erasure. Erasure removes the locations, checklists, records, photos, documents and team logins; only minimal consent evidence and a receipt with counts remain.
A closed account, before erasure	30 days after closure	Recoverable in case a deletion request was a mistake or was not made by the account holder; then the personal details are erased.
Record that a deletion request was made	6 years	The request, its deadline and how it ended — kept as proof we answered, without your name or email attached once the account is erased.
Food-safety records & their audit trail	While the account is active; exportable on closure	We provide export so you keep your own copy.
Account & billing records	6 years after account closure where legally required	ProCafe as controller; tax/accounting obligation.
Support correspondence	24 months	Kept to resolve issues and maintain service history.
Request / security logs	90 days, then purged	Request and security logs are separate from the staff and operational records above. Avoid including unnecessary medical or other sensitive details.
Backups	30-day rolling window	Deletions in the live database age out as backups expire.
Mobile on-device cache & outbox	Outbox: queued until synced. Cached reads may persist locally until pruned or the device is wiped.	Stored on the device, namespaced per user and cafe. Signing out and clearing the device removes local data.

Service operator

ProCafe — Serdar Kahraman, sole trader

Cleekim DriveEH15 3QP EdinburghUnited Kingdom

Contact: support@procafe.app