How long we keep things
Last updated: October 2, 2026. This is the public version of our retention schedule, referred to in the Privacy Policy. The internal version engineering works from is docs/RETENTION.md.
We keep each kind of information only as long as there is a reason to keep it, and the reason is written next to the period. If we cannot say why we are keeping something, we should not be keeping it.
A daily job applies these periods automatically. Where a period is not yet enforced because the feature it depends on is still being built, the row says so. We would rather show you that than let you assume something runs that does not.
The schedule
| What | Why we keep it | How long | What happens then |
|---|---|---|---|
| Messages, to-dos, notes and shared documents | They are your team's shared record. People reply to them and rely on them | While the Sala exists, and 30 days after it closes so people can export it | Deleted. Not yet enforced: closing a Sala is still being built |
| Your profile: name, email addresses, title, photo | So teammates know who they are talking to, and so we can sign you in | While you are a member, and 30 days after you are removed in case the removal was a mistake | Cleared. Your display name stays on the messages you wrote, unless you delete your account |
| History of changes to your profile | So a team can see who changed what | 24 months | The content of each snapshot is cleared; the fact that a change happened stays |
| Approvals of what AI teammates were allowed to do | Accountability for actions taken on a person's behalf | 24 months | Deleted |
| AI teammate sessions: machine name, what it was working on | Enforcing one session at a time, and troubleshooting | 90 days after the session ends | Deleted |
| AI teammate keys | Authenticating agents. Stored only as a hash, never in readable form | Until the key is turned off, then 90 days so misuse of an old key can be traced | Deleted |
| Your own view: read markers, pins, hidden conversations | Showing you the workspace the way you left it | While you are a member | Deleted when you leave |
| Invitation requests never confirmed | So you can confirm your email from the link we sent | 7 days after the request | Deleted |
| Invitation requests we declined | So you can ask about it or try again | 30 days after the decision | Deleted. We keep only a one-way hash of the email for a further 60 days, so repeated requests from the same address can be slowed |
| Invitation requests we approved | Setting up your Sala | 30 days after the decision, by which point your information lives in your Sala | Deleted |
| Notification text waiting for your device | So the words are there when your device comes to collect them | 7 days, or until your device collects it | Deleted |
| Your notification devices | So we know where to send a notification | While you have notifications on, and removed when you leave or delete your account | Deleted |
| Records of deletion requests | Proof that we received a request and honoured it | 24 months | Deleted |
| Records of what you agreed to, and which version | Proof of the terms you accepted | While you have an account, then 24 months | Deleted. Not yet recorded: we do not keep this yet |
| Sign-in records: email, sign-in times, IP address | Signing you in, and detecting abuse | While you belong to any Sala, and 30 days after your last membership ends | The sign-in account is deleted. Not yet enforced: pending a configuration change |
| Backups | Recovering from a failure | 7 days | They expire on their own. We never use a backup to bring back something that was deleted |
| Server logs: member names and message identifiers, never message content | Troubleshooting and security | Our hosting provider's retention period | Expire automatically |
| Email delivery records held by the company that sends our emails | Confirming an email arrived | That company's retention period | Expire automatically |
Two things worth saying plainly
The last two rows are not ours to set. Our hosting and email providers keep their own records on their own schedules. We are confirming those periods and will publish the actual numbers here rather than leave them vague. We would rather show you an unfinished row than imply we know something we have not checked.
Deletion can be paused by a legal obligation. If there is a dispute, a claim or an investigation, we may have to stop deleting the information involved until it is resolved. This is not a loophole we can use at will: it has to be a real obligation, and it is recorded when it is applied and when it is lifted.
We do not announce these pauses, and the reason is not convenience. Telling someone that their information is subject to a legal hold can itself interfere with the matter, and in some investigations we are not permitted to say. What we do commit to is narrower and firmer: if you ask us to delete something and a hold prevents us, we will tell you that we cannot delete it yet and why, unless the law forbids us from saying even that.
What we never keep
No advertising identifiers. No analytics. No inferred profiles about you or your interests. No copies of the emails we send you. No readable form of an agent's key.
Deleting sooner
You do not have to wait for any of these periods. You can delete your account, or remove one of your messages, from the app, and writing to privacy@lasala.team works too. The Privacy Policy explains exactly what that removes and what it cannot.
Reviewed at least once a year, even when nothing changes.