How long you keep customer data

Match the sentence to what deletion does

A security questionnaire asks how long you keep customer data. Founders commonly write one sentence, then check it against what the product actually deletes.

Name the event that starts the clock, or the number of days, whichever is true. Account closed, contract ended, and support ticket closed are events. A number of days with no event is a different answer. Use the one you can point to.

If backups, logs, or a copied database keep the data longer than the live product, say so in the same sentence. A reviewer who finds the longer copy will ask why the first sentence left it out.

If you have not watched a delete, write that you have not checked. Do not pick a number because it looks normal.

When they say as long as needed

Reviewers expand a short review when retention is as long as needed for business purposes and nothing else. The phrase does not say how long, and it does not say what ends the keeping.

Quote their words. Write the page you opened and the date. Ask once, in writing, for a number of days or for the event that starts deletion.

If the reply is still that phrase, keep the phrase and the date you asked. Do not replace it with a number they did not give you.

Use the same sentence everywhere you already send it

The questionnaire, a privacy policy, and a customer agreement should not describe three different periods. Founders commonly line those up before they send the form.

This note does not draft the policy or the agreement. If two of them disagree, change the one that does not match what deletion does. If you are unsure which wording the agreement requires, ask a lawyer.

What the vendor list can hold

The list row holds the company, what it does, the processing location, a link to the agreement, and the date you last checked it. It does not hold a retention period.

Keep the sentence in the questionnaire answer you control. Link the vendor's public terms on the row, so a reviewer can open the page you quoted.

Trust Prep does not store a retention answer, does not check that sentence against what the product deletes, and does not email anyone.

A location or an agreement link shows on the public page only after you save it. A retention sentence does not, because there is no field for it.

If you want the longer notes

What to check on a model provider's own page, including how long they keep data, is in the AI provider guide.

Whether customer data trains a model is a different sentence from how long prompts are kept. What to write is in the customer data training guide.

What to write when a vendor will not name one country is in the processing location guide.

How to answer the rest of a vendor security questionnaire is in the security questionnaire guide.

How soon you tell the customer about an incident is a different clock from how long you keep their data. What to write on that row is in the incident notification guide.

Which customer data reaches a vendor is a different sentence from how long you keep it. What to write is in the data access guide.

A backup that keeps a copy longer is not the same as having restored one. What to write for a restore and a recovery time is in the backup restore guide.

How the customer exports data when they leave, how soon the rest is deleted, and a confirmation when you send one, is a different row from how long you usually keep data. What to write is in the customer data export guide.