Legal

Data Retention Policy

Last updated: June 2026

This policy sets out how long PrimusReview retains personal data and other information collected through the platform, and the basis on which data is deleted or anonymised.

1. Account and profile data

Data typeRetention periodLegal basis
Email addressDuration of accountContract — necessary to provide the service
Full name and companyDuration of accountContract — necessary to provide the service
Subscription status and billing datesDuration of account + 7 yearsLegal obligation — HMRC financial records requirement
Stripe customer IDDuration of account + 7 yearsLegal obligation — billing reconciliation
Account creation dateDuration of accountLegitimate interests — account management

2. Review data

Data typeRetention periodLegal basis
Uploaded document content (extracted text)Duration of accountContract — necessary to display review history
Review results (AI analysis output)Duration of accountContract — necessary to display review history
File uploads (stored in Supabase Storage)Duration of accountContract — necessary to display document previews
Uploaded video/audio files and transcripts (Video Review)Duration of accountContract — necessary to display review history
Material type and prompt versionDuration of accountLegitimate interests — audit trail and service improvement
Flag annotations and commentsDuration of accountContract — necessary to display annotation history

3. Source library documents

Data typeRetention periodLegal basis
Personal source documentsUntil deleted by user or account closureContract — user-managed reference library
Shared baseline documentsUntil removed by administratorContract — shared compliance reference

4. Technical and log data

Data typeRetention periodLegal basis
Server logs (IP address, pages visited)90 daysLegitimate interests — security and debugging
Sentry error reports30 daysLegitimate interests — error monitoring
Uptime monitoring logs30 daysLegitimate interests — service reliability
Vercel Analytics (anonymised)90 daysLegitimate interests — product improvement

5. Communications data

Data typeRetention periodLegal basis
Contact form submissions12 monthsLegitimate interests — customer support
Support email correspondence12 monthsLegitimate interests — customer support

6. Deletion on account closure

Data typeRetention periodLegal basis
Account dataDeleted within 30 days of account closureUK GDPR right to erasure
Review data and documentsDeleted within 30 days of account closureUK GDPR right to erasure
Storage filesDeleted within 30 days of account closureUK GDPR right to erasure
Billing recordsRetained for 7 years after account closureLegal obligation — HMRC

You may request deletion of your personal data at any time by deleting your account from the Settings page, or by contacting us at thompson.daniel@primusreview.com.

This policy is reviewed annually and updated to reflect changes in our data processing activities.