04
What stays, and why
Deletion is not erasing everything everywhere — part of the record is kept by legal
obligation. Saying so upfront avoids the impression that the request was ignored.
- Access logs
- Server logs required by Brazil's Internet Civil Framework, kept for the statutory
period and used only for security and to answer court orders.
- Tax and contract records
- Invoices, contracts and whatever tax law requires us to keep — as a rule, 5 years.
- Backups
- A backup already written is not rewritten. The data leaves the live system
immediately and disappears from backups as they expire and are replaced.
- Record of the request
- We keep the fact that you asked and what we did, so we can show we complied. The
minimum: request identifier, date and outcome.
Full retention periods, per data type,
are in retention. If you disagree with our answer, you
may complain to Brazil's National Data Protection Authority (ANPD).