Data Retention Policy

Last Updated: December 29, 2025

1. Purpose

This Data Retention Policy explains how long ACAI Software Limited retains different types of data collected through the Thumbnail Generator service and the reasons for retention. We comply with Jersey data protection regulations, EU GDPR, and international privacy standards.

2. Data Retention Periods

Data Type	Retention Period	Reason
Account Information (email, name, profile)	Active account + 90 days after deletion	Service provision, account recovery
Authentication Tokens	Until logout or expiration (30 days)	Session management
Uploaded Images	Immediately after processing (not stored)	Privacy - only used for generation
Generated Thumbnails (Free)	30 days	Limited storage for free tier
Generated Thumbnails (Paid)	365 days	Extended history for subscribers
Credit Usage History	Active account + 3 years	Billing verification, support
Subscription Data	Active subscription + 7 years	Tax compliance (Jersey, EU, US)
Transaction Records	7 years	Jersey GST compliance, audit requirements
Payment Provider	Not stored here (retained by the payment provider)	PCI-DSS compliance
Referral Activity	Active account + 2 years	Program integrity, fraud prevention
Affiliate Earnings	7 years	Tax reporting, commission tracking
Promo Code Usage	Active account + 3 years	Fraud prevention, usage tracking
Support Tickets	3 years	Service improvement, legal protection
Server Logs	90 days	Security, debugging, performance
Analytics Data	25 months (aggregated/anonymized)	GDPR compliance, insights
Error Logs	180 days	Service improvement, debugging
Email Communications	2 years	Customer service, legal compliance

3. Data Retention by User Action

3.1 Account Deletion

When you request account deletion:

Immediate: Account deactivated, login disabled
Within 30 days: Personal data deleted (email, name, profile picture)
Within 90 days: Generated content and usage history deleted
Retained: Anonymized analytics, transaction records (7 years for tax compliance)

3.2 Subscription Cancellation

When you cancel a subscription:

Account remains active on free tier
Generated thumbnails retained according to tier (30 days for free)
Transaction records retained for 7 years (tax compliance)
Credit history retained for 3 years

3.3 Inactive Accounts

Accounts with no activity for:

Free accounts: 1 year → email notification → 90 days to reactivate or deletion
Paid accounts: 2 years → email notification → 180 days to reactivate or deletion
Deleted content: Generated thumbnails deleted before account deletion

4. Legal and Regulatory Retention

4.1 Jersey Tax Compliance

As a Jersey-registered company, we must retain:

All transaction records for 7 years
GST (5%) calculation records
Customer billing information
Revenue and expense documentation

4.2 GDPR Compliance (EU Users)

Under GDPR, data is only retained as long as necessary for:

Fulfilling the purpose it was collected
Legal obligations (e.g., tax records)
Establishing, exercising, or defending legal claims

4.3 CCPA Compliance (California Users)

California residents have the right to:

Know what personal information is retained and for how long
Request deletion of personal information (subject to legal exceptions)

5. Secure Data Disposal

When data retention periods expire, we securely dispose of data by:

Hard deletion from production databases
Overwriting backups during regular backup cycles (30 days)
Anonymization of any retained analytics data
Verification that data is irrecoverable

6. Backups and Recovery

Automated backups are taken daily
Backups are retained for 30 days
Deleted data may persist in backups for up to 30 days before permanent removal
Backups are encrypted and stored in secure Google Firebase infrastructure

7. Data Export and Portability

You can request a copy of your data at any time. We will provide:

Account information (JSON format)
Generated thumbnail history (downloadable links)
Credit usage history (CSV format)
Transaction records (CSV format)
Referral and promo code activity

Data export requests are fulfilled within 30 days.

8. Third-Party Data Retention

Third-party services we use have their own retention policies:

PayPal: Retains payment data per their policy (PCI-DSS compliant)
Google Firebase: Retains data per our configuration and deletion requests
Google Gemini AI: Does not store user-generated content (processed in real-time)

9. Changes to Retention Policy

We may update this Data Retention Policy to:

Comply with new legal requirements
Improve data management practices
Reflect changes in Service features

Material changes will be notified via email with 30 days' notice.

10. User Rights

You have the right to:

Access: Request information about what data we retain
Deletion: Request deletion of your data (subject to legal retention)
Correction: Update inaccurate data
Export: Receive a copy of your data in portable format
Objection: Object to certain data retention practices

11. Contact for Data Retention Requests

For questions about data retention or to exercise your rights, contact:

ACAI Software Limited
Data Privacy Officer
Jersey, Channel Islands
Email: bunty.chops1@gmail.com
Website: https://thumbgen-ai-e7ed1.web.app

This Data Retention Policy is part of our Privacy Policy and Terms of Service. By using the Thumbnail Generator service, you acknowledge and accept this policy.