Data retention & deletion

Draft policy — durations marked TBD must be confirmed with each client before launch.

Retention by data type

• Sessions: expire after 8 hours (60 minutes idle); revoked sessions are kept for security review for TBD days.
• Single-use links (invitations 72 hours, password resets 30 minutes): unusable after expiry or first use.
• Comments, interest marks and shortlists: kept for the life of the engagement plus TBD months.
• Audit logs: kept for TBD months for security and accountability.
• Published proposal versions: kept for the engagement so earlier versions can be compared or restored.

Deletion

On request or at the end of an engagement, Zemam deletes the organisation's workspace, which removes its proposal, versions, comments, decisions, shortlists, assessments and files. Backups roll off within TBD days.

Backups and restore tests

Database backups are taken daily by the managed database provider (TBD) and restore is tested periodically (TBD cadence).