Data Retention Policy

Cognitiva Systems Inc.
Public Disclosure

INTRODUCTION#

This document provides a summary of how long Cognitiva Systems Inc. ("Cognitiva," "we," "us," or "our") retains different categories of personal data.

Full Policy: Our complete Data Retention and Deletion Policy is maintained internally and governs operational procedures. This summary provides transparency for our users.

Legal Framework:

• GDPR Article 5(1)(e): Storage limitation principle
• CCPA: Supports right to deletion
• Industry best practices

RETENTION PRINCIPLES#

Core Principles#

Data Minimization: We retain personal data only as long as necessary for legitimate purposes.

Purpose Limitation: When original purpose is fulfilled, data is deleted or anonymized.

Legal Compliance: Some data must be retained to comply with legal obligations (tax, AML, etc.).

Transparency: We inform you of retention periods and provide mechanisms to request deletion.

RETENTION PERIODS BY CATEGORY#

Account and Profile Data#

Active Accounts:

• Retention: Duration of account plus 90 days
• Data: Name, email, company, profile information
• Reason: Service delivery, support, legitimate business interests

Inactive Accounts:

• Retention: 3 years of inactivity, then deleted
• Definition: No login, no API usage, no active subscription
• Notice: Email warning at 2 years, 30 days before deletion

Deleted Accounts:

• Retention: 90-day grace period (for accidental deletion recovery)
• After 90 Days: Permanent deletion
• Exception: Financial records retained 7 years (see below)

Campaign Execution Data#

In-Platform Campaign Data:

• During Campaign: Retained indefinitely while account active
• Client Control: Clients determine retention in their workspace
• Post-Deletion: 90 days after account deletion (grace period)

Campaign Metadata:

• Retention: 2 years post-campaign completion
• Data: Campaign dates, participants (IDs only), workflow events
• Reason: Support, dispute resolution, analytics

Anonymized Campaign Data:

• Retention: Indefinite
• Status: No longer personal data (GDPR Recital 26)
• Use: AI model training, benchmarking, data products

Financial and Payment Data#

Payment Transaction Records:

• Retention: 7 years
• Data: Invoice history, payment amounts, dates, status
• Reason: Tax law (IRS), audit requirements, dispute resolution
• Legal Basis: Legal obligation (26 USC §6001)

Payment Partner Data:

• Retention: Held by our licensed payment partner under its own policies as an independent controller (we do not store card or bank details)
• Data: Tokenized references only
• Control: Licensed payment partner as independent controller

Tax Documents:

• Retention: 7 years
• Data: W-9 forms, 1099 forms, tax IDs
• Reason: IRS requirements

Identity Verification Data#

Verification Outcome, Reference and Expiry:

• Retention: 7 years after account closure (AML)
• Data: Verification outcome, a reference and the expiry date
• Reason: Anti-Money Laundering regulations, FinCEN requirements
• Legal Basis: Legal obligation (31 USC §5318)

Government-Issued IDs and Biometric Data:

• Retention: Held by our regulated identity-verification provider under its own retention policy, not by Cognitiva
• Data: Identity documents, liveness and biometric data
• Control: Identity-verification provider

Communication Data#

Support Tickets:

• Retention: 3 years from ticket closure
• Data: Support conversations, attachments
• Reason: Support history, quality assurance, dispute resolution

Marketing Communications:

• Retention: Until opt-out or 2 years of inactivity
• Data: Email address, communication preferences
• Opt-Out: Immediate removal from active lists, suppression list retained indefinitely

Transactional Emails:

• Logs: 30 days
• Content: Not retained (generated on-demand)

Technical and Usage Data#

Application Logs:

• Retention: 90 days
• Data: Access logs, API requests, error logs
• Reason: Troubleshooting, security monitoring, performance optimization

Security Logs:

• Retention: 1 year
• Data: Authentication attempts, security events, access controls
• Reason: Security investigations, compliance audits

Aggregated Analytics:

• Retention: Indefinite
• Data: Anonymized usage statistics, performance metrics
• Status: No longer personal data

API Usage Data#

API Request Logs:

• Retention: 30 days
• Data: Endpoint, timestamp, response codes, user ID
• Reason: Debugging, billing verification, rate limit enforcement

API Keys:

• Retention: Until revoked or account deleted
• Deletion: Immediate upon revocation

Backup Data#

System Backups:

• Retention: 30 days (rolling)
• Automatic Deletion: Oldest backups overwritten
• Use: Disaster recovery only (not for individual data restoration)

Note: Personal data in backups subject to same retention as live data (backups eventually overwritten).

SPECIAL CIRCUMSTANCES#

Legal Holds#

When Applied:

• Litigation or regulatory investigation
• Government request or subpoena
• Internal investigation of ToS violations

Effect:

• Data preserved beyond standard retention period
• Deletion suspended until hold released
• Only affected data preserved (not entire account)

Release:

• When legal matter concludes
• Standard retention periods resume

Anonymization vs. Deletion#

Anonymization (GDPR Recital 26):

• Data transformed to prevent re-identification
• No longer considered personal data
• Retained indefinitely for business purposes

Deletion:

• Complete removal of personal data
• Applied when anonymization not feasible or appropriate
• Secure deletion methods (overwriting, cryptographic erasure)

Decision Criteria:

• Data utility for anonymization vs. deletion
• Re-identification risk assessment
• Business need for anonymized insights

YOUR RIGHTS#

Right to Deletion#

GDPR (EEA/UK Residents):

• Request deletion of personal data
• We delete within 30 days (or explain exceptions)
• Exceptions: Legal obligations, legitimate interests with compelling grounds

CCPA (California Residents):

• Request deletion of personal data
• We delete within 45 days (or explain exceptions)
• Exceptions: Complete transaction, legal compliance, internal uses

How to Request: Email: privacy@cognitiva.systems
Subject: "Deletion Request - [Your Email]"

Exceptions to Deletion#

We may retain data when necessary for:

• Completing transactions
• Detecting/preventing fraud or security incidents
• Debugging and error correction
• Complying with legal obligations
• Internal uses aligned with your expectations
• Exercising free speech or research rights

Financial Records: Cannot be deleted during 7-year retention period (legal requirement).

DATA EXPORT#

Before Deletion#

Export Your Data: We provide data export in machine-readable format before deletion:

What You Can Export:

• Account information (JSON)
• Campaign data (CSV, JSON)
• Messages and communications
• Reports and analytics

How to Export:

1. Account settings > Data Export
2. API endpoint: /v1/export
3. Email request: privacy@cognitiva.systems

Timeline:

• On-demand: Within 30 days
• Before deletion: Available during 90-day grace period

AUTOMATED DELETION#

Scheduled Deletions#

Daily:

• Expired logs (>90 days)
• Old backups (>30 days)

Weekly:

• Inactive session data
• Temporary files

Monthly:

• Expired API tokens
• Old notification data

Annually:

• Inactive accounts (3+ years, after warnings)
• Expired support tickets (3+ years)

Verification:

• Deletion logs maintained
• Audit trails preserved (metadata only, not deleted content)

CONTACT INFORMATION#

Retention Questions#

Phone: +1 212-220-8418
General Questions:
privacy@cognitiva.systems

Deletion Requests:
privacy@cognitiva.systems
Subject: "Deletion Request"

Data Export Requests:
privacy@cognitiva.systems
Subject: "Data Export Request"

EU data rights contact:
eu-datarights@cognitiva.systems

UPDATES#

Review Frequency: At least annually

Last Updated: 8 October 2026

Notification: Material changes will be communicated via email 30 days in advance.

RELATED POLICIES#

Full Privacy Policy: cognitivasystems.com/legal/privacy-policy
Terms of Use: cognitivasystems.com/legal/terms-of-use
Data Processing Agreement: Available for enterprise customers

QUICK REFERENCE TABLE#

END OF DATA RETENTION SUMMARY

Note: This is a public summary. Full operational procedures are maintained in our internal Data Retention and Deletion Policy.

Transparency Commitment: We believe users have a right to understand how long their data is retained.

Last Updated: 8 October 2026
Version: 3.0