Traduction automatique. En cas de différence, la version anglaise prévaut.
Sur cette page
How long we keep your data
In short
- We keep data only as long as we need it for the reason we collected it, or as long as the law tells us to.
- When you delete your account it is closed and anonymised at once. A few records stay, without your identity where possible, because tax or safety rules require it.
- Some periods are set in our systems and run automatically. Others are proposals that are still being confirmed; they are marked below.
- Backups are not edited. They expire on a schedule, and we re-apply your deletion if one is ever restored.
1. How to read this table
"Set in the system" means the period is configured in the service and enforced automatically (a database time-to-live rule, a scheduled job, or cloud storage rule). "Proposal" means we plan this period but it has not been approved yet, and it is marked [OWNER: approve]. If a proposal changes, we update this page and its version. The reasons we hold each kind of data are in the privacy policy, and deletion is explained in account deletion.
2. Retention periods
| Data | How long | Status |
|---|---|---|
| Account, sign-in details, profile | While the account exists. On deletion the account is anonymised immediately: email replaced, password, two-factor secret, date of birth and guardian email cleared, profile and goals removed | Set in the system |
| Login sessions (refresh tokens) | 7 days | Set in the system |
| Verified documents and the text read from them | 730 days after verification, or sooner if you ask or withdraw consent | Set in the system |
| Unverified documents | 30 days | Set in the system |
| Older versions of stored files, incomplete uploads | 90 days; incomplete uploads 7 days | Set in the system |
| Movito conversations and copilot runs | 90 days after creation | Set in the system |
| Movito memory | Until you delete it, or when you delete the account | Set in the system |
| Voice audio | Not stored; discarded when turned into text | Set in the system |
| Copilot audit record (proposal, confirmation, result) | 12 months | Set in the system |
| Usage events (analytics) | 13 months | Set in the system |
| Recommendation impressions and clicks | Pseudonymised at 90 days, deleted at 13 months | Set in the system |
| Notifications | 90 days | Set in the system |
| Free guide requests by email (no account) | Unconfirmed requests 7 days; confirmed until you unsubscribe, which erases the address | Set in the system |
| Live Q&A email reminders (no account) | Unconfirmed sign-ups 7 days; confirmed until you unsubscribe, which erases the address | Set in the system |
| Live Q&A session sign-ups and questions sent from the app | While the account exists | Proposal [OWNER: approve] |
| Success story and its photo | Until you withdraw consent (deleted at once) or delete the account; a rejected story 90 days | Proposal [OWNER: approve] |
| Document verification and admin audit logs | 7 years | Set in the system |
| Chat messages and translations | While the account exists; your messages are redacted when you delete the account (messages in an open report are held); a thread is removed 30 days after all participants have been deleted | Set in the system |
| Bookings | 10 years when tied to invoices | Proposal [OWNER: approve] |
| Invoices and electronic invoices (SDI) | 10 years, as Italian tax and accounting rules require | Proposal [OWNER: approve] |
| Store orders (single guides, day passes) | 10 years; on account deletion the order is pseudonymised and personal details dropped, and amounts, VAT, country and payment references stay | Proposal [OWNER: approve] |
| Points ledger, balances and unlocks | While the account exists; once it is deleted the records no longer identify you | Proposal [OWNER: approve] |
| Points fraud-check records | 12 months; accounts of users under 18 are excluded | Proposal [OWNER: approve] |
| Forum posts | While the account exists | Proposal [OWNER: approve] |
| Reports and moderation records | 24 months after closure | Proposal [OWNER: approve] |
| Support mail | 24 months | Proposal [OWNER: approve] |
| Data export files | 7 days after creation | Proposal [OWNER: approve] |
| Guardian consent records (14 to 17 year olds) | Removed when the account is deleted | Set in the system |
| Consent records (what you accepted, when, which version) | Kept as proof, without a link to your name after deletion | Proposal [OWNER: approve] |
| Cached data (short-lived copies of answers and translations) | 5 minutes by default; translations 24 hours | Set in the system |
| Database backups | Daily backups 35 days; monthly backups 365 days | Set in the system |
3. Backups and restores
Backups are protected copies of the whole database and are not edited record by record. A deleted account therefore remains in a backup until it expires, at most 365 days for monthly copies. Backups are used only to recover from a failure. If one is ever restored, we first re-apply every deletion made since it was taken, so that deleted data does not return.
4. Longer keeping because the law says so
Invoices, store orders and booking records tied to invoices stay for the period set by Italian accounting and tax rules, understood to be 10 years. We keep them separate and do not use them for anything else. Records needed to defend a claim are kept for as long as the claim can still be brought. To ask a question about a period, write to À confirmer.