Data Retention and Deletion
Last updated: 14 July 2026
1. Retention Principles
Vettara keeps personal data only for as long as needed to provide the service, secure the platform, support customers, comply with law, resolve disputes, and preserve audit trails. Customer workspace data is controlled by the customer unless Vettara is an independent controller for account, security, billing, or operational records.
2. Default Retention
| Data category | Default handling |
|---|---|
| Workspace projects and candidates | Retained during the subscription until deleted by the customer or terminated under the agreement. |
| Google and Microsoft OAuth tokens | Encrypted while a connection is active; cleared from Vettara when the user disconnects the integration. |
| Synced email, calendar, and meeting data | Retained as workspace data until deleted by the customer or handled under account termination, legal, security, or backup rules. |
| Exports and reports | Available while stored in the workspace; customers should delete downstream copies they no longer need. |
| Audit and security logs | Retained only for the period needed for security, abuse prevention, compliance, and dispute handling. |
| Backups | Expire through the normal backup rotation unless legal hold, security, or restoration needs require longer retention. |
| Billing and tax records | Retained as required for accounting, tax, and legal obligations. |
3. Customer Controls
Customers can export organisation data from settings where enabled. Workspace owners can request deletion or account closure through support. Deletion may not remove records that must be retained for legal, billing, fraud-prevention, security, or audit reasons.
Vettara does not publish a single retention duration for every data category because customer instructions, active contracts, security needs, and mandatory accounting rules differ. A customer can request the applicable schedule for its workspace from support@vettarasearch.com.
Users can disconnect Gmail, Outlook, Google Calendar, or Microsoft Calendar in the relevant Vettara settings screen. Disconnecting clears Vettara's stored provider tokens; users may also revoke access directly in their Google or Microsoft account. Deleting or disconnecting a provider token does not automatically delete workspace records that were already imported from that provider.
4. Candidate and Data Subject Requests
Candidate requests should be submitted through the Privacy Request Center. If a customer controls the record, Vettara may coordinate with that customer before acting.