Data Retention Policy

Purpose
This policy defines how long we retain user data in the ODOP Design Library (our cloud storage service) and under what conditions data is deleted. The intent is to balance operational efficiency, user expectations, and storage costs without requiring indefinite retention of abandoned data. It ensures transparency by explaining retention triggers, notification processes, and user rights.

Scope
This policy applies to all personal and non-personal data uploaded or generated by users in our cloud storage platform. It covers data at rest, backups, and logs associated with user accounts identified primarily by email address.

Definitions

Active user: any user who has logged in or uploaded/modified data within the past two years.
Inactive user: any user with no login or data changes for a continuous two-year period.
Abandoned data: data belonging to a user that remains inactive 30 days after a final notification.

Retention Principles

Data minimization: retain only what users actively use or explicitly request we keep.
Transparency: notify users before any deletion and provide clear steps to retain data.
User control: allow users to extend retention or request early deletion at any time.
Efficiency: permit cleanup of abandoned data to manage storage costs.

Retention Schedule

User Status	Criteria	Retention Action	Timeline
Active	Login or data change within last 2 years	No action; data retained	Indefinite (while active)
Inactive	No login or data change for 2 years	Send warning email	At 2 year inactivity mark
Abandoned	No response in 30 days post-warning	Schedule deletion	Purge data as part of database maintenance activity at least 30 days after nonresponse to warning message

Abandonment and Deletion Procedures

Identify inactive accounts as part of routine database maintenance activity.
Send a “Data Retention Warning” email detailing scheduled deletion date.
If no user login or opt-out action occurs within 30 days, flag data as abandoned.
Permanently delete abandoned data as part of next routine database maintenance activity.

Remove all abandoned design files associated with the user.
Log deletion events for audit purposes.

Exceptions and Appeals

Users may request extended or unlimited retention. Contact Us.
To halt pending deletions, users can click the link in the warning email or contact support within the 30-day window.
Appeals for data recovery after deletion may be honored on a best-effort basis.

Roles and Responsibilities
ODOP development team:

maintain retention schedules and notification templates.
build and monitor automated cleanup workflows.
handle user inquiries, retention extensions, and appeals.
review and approve policy updates annually.

Policy Review
This policy will be reviewed every 12 months or sooner if storage costs, legal requirements, or user feedback warrant changes.