Keep data with purpose. Delete it with control.

Kool&Tech seeks to retain information only for a documented business, contractual, security, operational, dispute, or legal purpose; restrict information after active use; delete or anonymize information when no longer required; and preserve information when a valid legal hold or mandatory obligation applies.

This public policy does not assign one period to every record. Periods depend on data category, purpose, Customer instructions, subscription plan, legal requirements, claims periods, security need, provider capability, and whether Kool&Tech acts as controller or processor.

Kool&Tech may maintain service-specific schedules identifying record category, system, purpose, trigger event, active period, archive period, deletion method, owner, exceptions, and evidence. An Order Form, DPA, SOW, or product schedule may define more specific terms.

Categories may include account profiles, workspace content, process documentation, diagrams, files, forms, inputs, outputs, integrations, credentials, billing records, contracts, support tickets, communications, audit records, security logs, telemetry, backups, exports, and de-identified analytics.

Customer Content is retained while needed to provide the contracted service and according to the applicable Order Form, DPA, workspace status, and Customer instructions. Customer should remove content no longer needed and export required information before access ends.

Active workspace content may remain available during the subscription term subject to plan limits. Archived, disabled, suspended, canceled, or deleted workspaces may follow different access and deletion states defined in the Order Form or product schedule.

Account, administrator, authentication, role, and access records may be retained while accounts are active and afterward as necessary for security, billing, dispute handling, legal obligations, and account recovery. Deprovisioning a user may not immediately remove records created by that user from Customer workspaces.

Retention of AI inputs, outputs, prompts, attachments, safety records, and provider-side processing depends on the enabled feature, provider, account configuration, documented purpose, and applicable agreement. Customer should avoid unnecessary sensitive information and review feature-specific disclosures.

Operational, security, audit, API, authentication, performance, and diagnostic logs may be retained for service operation, threat detection, investigation, troubleshooting, abuse prevention, billing, capacity, and compliance. Detailed periods should be defined by service schedule or system configuration.

Tickets, emails, call notes, diagnostic files, screenshots, recordings, and investigation records may be retained for issue handling, history, quality, security, billing, contractual evidence, and legal obligations. Customers should not place unnecessary secrets or sensitive data in support channels.

Orders, invoices, payments, tax records, contracts, consents, acceptance records, and related communications may be retained for accounting, audit, legal, fraud-prevention, dispute, and compliance purposes according to applicable requirements.

Inquiry, lead, event, newsletter, preference, and campaign records may be retained while the relationship or valid business purpose continues and afterward where required to honor opt-outs, document consent, prevent repeated contact, or comply with law.

The retention of data copied to or received from connected systems may differ from Kool&Tech retention. Disconnecting an integration does not automatically delete information already transferred to either system. Customer must manage deletion in Customer-controlled and third-party systems.

Customer-created exports, downloaded files, reports, API responses, and local copies are outside Kool&Tech control after delivery. Customer is responsible for their storage, access, retention, deletion, and onward sharing.

Backups may retain data after deletion from active systems until backup rotation, expiration, overwrite, or secure disposal occurs. Backup copies are intended for resilience and recovery and may not support selective deletion from every historical recovery point.

Deletion may be suspended for litigation, investigation, audit, subpoena, regulatory request, security incident, contractual dispute, fraud prevention, or another preservation duty. Access should be restricted and the hold released when the preservation need ends.

Verified requests are handled under applicable privacy law, the Privacy Policy, and the DPA. Rights may be limited by identity verification, legal exceptions, processor instructions, technical feasibility, retained legal records, security needs, and data held by independent third parties.

When Kool&Tech acts as processor, Customer controls retention instructions subject to the DPA, law, service capability, and contract. When Kool&Tech acts as controller, Kool&Tech determines retention based on its documented purposes and legal obligations.

At termination, access, export windows, workspace states, and deletion timing follow the Order Form, Subscription Agreement, DPA, and product schedule. Customer must preserve required exports before the applicable access period ends.

Deletion may include removal from active interfaces, disabling access, logical deletion, queueing for automated deletion, expiry through lifecycle rules, anonymization, cryptographic erasure, overwrite, or media sanitization according to system design and risk.

When storage media is reused, returned, retired, or disposed of, sanitization methods should reflect media type, data sensitivity, provider capability, risk, and applicable standards. Physical media disposal may be performed by an authorized infrastructure provider.

Information that is aggregated or de-identified so it no longer identifies an individual may be retained for analytics, security, reliability, capacity, research, and product improvement, subject to applicable law and safeguards against inappropriate re-identification.

Subprocessors and independent providers may apply their own retention, backup, security, and deletion processes. Kool&Tech contractually addresses provider obligations where required but cannot promise technical behavior beyond the applicable provider commitment.

Exceptions may result from mandatory law, tax and accounting duties, dispute and claims needs, legal holds, fraud and security requirements, unresolved transactions, provider limitations, backups, disaster recovery, safety, or a Customer instruction permitted by contract.

Verification may use system status, lifecycle configuration, provider confirmation, deletion logs, administrative review, sampling, or sanitization records. Verification method depends on the system and does not imply byte-level inspection of every distributed copy.

Customer must define business retention needs, identify regulated data, configure available controls, manage Authorized Users and connected systems, preserve legally required records, export needed content, and submit timely verified requests.

Retained information remains subject to applicable access, confidentiality, security, monitoring, incident-response, and provider controls. Restriction, archival, or legal hold does not eliminate security obligations.

Kool&Tech may update this policy as products, providers, laws, technical architecture, risks, and contractual offerings evolve. Changes to binding customer-specific retention terms apply according to the governing agreement.

Questions about retention, export, deletion, workspace termination, privacy requests, or service-specific schedules may be sent to info@koolandtech.com. Do not include passwords, full payment-card information, or unnecessary sensitive data.