This document describes how long Stilops retains which data, and how that is enforced. Where a period is not enforced automatically, this is stated — a period on paper that the software does not know is not a period.
What the customer sets
| Data | Period | Where enforced |
|---|---|---|
| Agent runs (proposals, test runs, transcripts, costs) and chat conversations of your organisation | The retention period on your organisation's Settings page, minimum 183 days. A lower value is rejected. A previously saved lower value counts as 183 during clean-up. | Daily clean-up task; the lower limit of 183 days is in the code, not in a setting |
Why 183 days as a minimum: the EU AI Act requires log retention of at least six months for high-risk systems (art. 19). Stilops is limited risk, but applies that lower limit anyway — the audit trail is the core of the product.
What Stilops retains for a fixed period
| Data | Period | Reason | Where |
|---|---|---|---|
| Conversation transcripts that the AI program stores on the server in order to be able to continue a conversation (in addition to your organisation's task and chat data) | 30 days after the last activity; in the demo without an account they are not retained | Being able to continue a conversation | The AI program cleans them up itself |
| Demo without an account: the temporary organisation per visitor, with everything the visitor typed, the session and the files | 1 hour (at most 15 minutes later if a task was still running at that time) | Trying out without an account; after that there is no reason any more | Clean-up task that runs every minute, also during an emergency stop |
| Anonymous visitor count of the website (per day: path, referring domain, number; no personal data) | 400 days | Seeing which channels bring in visitors | Cleaned up when the count is written |
| A test run scheduled via stilops.com (name, e-mail address, office, remark, time) | 1 year after the appointment | Honouring the appointment and being able to look back at who did a test run | Cleaned up daily by the scheduling tool |
| Origin at sign-up (optional choice "How do you know Stilops?" and UTM labels) | As long as the organisation exists | Knowing which channels bring in customers (legitimate interest, privacy statement 1.4) | Disappears with the organisation row (retention after termination, or a deletion request) |
| Agreement to terms and conditions and privacy statement (version, language, time, text + hash) | As long as the organisation exists. Even if the organisation has been deleted they remain: there is as yet no automatic deletion or period for this; a period has been proposed and awaits a decision | Proof of what you agreed to | Recorded append-only at sign-up; after deletion of the organisation the row remains with an e-mail snapshot |
| Acceptance of agent disclaimers | Idem: no automatic deletion yet after the organisation is deleted | Proof (AI Act art. 50, contract) | Recorded append-only when an agent is hired |
| Actions of organisation users (who approved what) | As long as the organisation exists | Traceability | Append-only action log of the organisation; disappears with the organisation |
| Actions of administrators (administrator log, with e-mail address and organisation name as a snapshot) | No automatic deletion yet: the log remains even after the organisation is deleted; a period has been proposed and awaits a decision | Traceability | Append-only administrator log |
| Invoices and the financial log | At least seven years after the end of the financial year (statutory retention obligation, art. 52 AWR). After that, an invoice is not yet automatically deleted or anonymised (the customer's name, address and VAT number then remain); that has been proposed and awaits a decision | Tax | Annual tax archive per financial year (overviews, invoice PDFs and a manifest with control totals), automatically written to the server and, once that link is established, to the owner's OneDrive. The archive is never deleted automatically, not even after seven years. A final invoice is never changed again |
| Signed log export (a daily snapshot of the append-only audit trail, with hash chain and digital signature; sensitive texts only as a hash) | Ten years (limitation period for product liability, Directive 2024/2853 art. 17) | Proof that the audit trail has not been changed afterwards; the database itself is cleaned up after 183 days | Shielded folder on the same server, outside the application, which can only read and verify the export (weekly), not change it. Reservation: there is currently one copy. A rebuild of the server erases the folder and key; the second copy in another location has not yet been set up (see the document Log export, "What it is not") |
| Organisation data after termination | Until the organisation's own retention period has expired; after that the organisation is deleted | Right to erasure versus burden of proof | The same daily clean-up task, which also takes along the organisation's uploads and deliverables |
What is internal and shorter
| Data | Period | Where |
|---|---|---|
| Mail in the mailboxes of Stilops' internal agents | Set per mailbox, by default 90 days; older, already processed mail is archived | Setting per mailbox; automatic archiving |
| Attempts for the rate limit (logging in, forms) | Short; the table is cleaned up periodically | Periodic clean-up task |
| System logs (operational events; no customer content, but organisation IDs) | 365 days, configurable, never shorter than 183 days. The signed log export above retains the messages for ten years | Daily clean-up task; each round leaves a log line, even when zero are deleted |
What has no period in days
- Back-ups on the server itself: rotation according to Stilops' back-up setting: a limited number of full and intermediate copies (and a byte budget), where the oldest expires first and a minimum of recovery points always remains.
- Offsite back-ups (object storage, OneDrive): these are not cleaned up automatically. They remain until the owner deletes them by hand. There is as yet no period for this; that is an open choice of the owner.
- The tax archive (local and, if linked, OneDrive): at least seven years, after that no automatic deletion; a period is an open choice of the owner.
- A back-up may contain data that has already been cleaned up in the live database; it is stored encrypted. There is no separate "also delete from back-ups" path. A deletion request is carried out in the live database and disappears from the local back-ups through rotation, but from the offsite copies only when the owner deletes them.
Requests from data subjects
You download your data (GDPR art. 15 and 20) yourself in the portal, under Settings → Account → Your data: a JSON file with your account, agreements, tickets and, for an owner, the data of the organisation. A request for erasure (art. 17) you also submit there, or by e-mail via [email protected]. Stilops handles it within one month and records each request with the date of receipt, how your identity was established and the outcome.
What is deleted: the organisation profile, users, agents, runs, conversations, integrations, knowledge and tickets, with the organisation's files (uploads and deliverables). What remains: the agreements, the invoices and the administrator log (with e-mail snapshot), until their own period above, because they have a statutory or evidentiary basis. The customer record at Stripe also remains until an administrator deletes it by hand; this does not happen automatically. The request itself remains in the requests register as proof that it has been carried out.