Retention & Deletion Policy

Last updated: 1 January 2026

This policy explains how long uploaded documents are stored on CopyQR and how they are deleted. It covers the document files themselves and their metadata (for example, file name, order reference, and print settings). It should be read with the Privacy Policy.

1. Default and maximum retention

• Default window: documents are deleted 24 hours after the order is marked completed.
• Configurable by the shop: a shop may choose a different window within platform limits.
• Hard ceiling: no document is retained for more than 7 days (168 hours). There is no indefinite retention option.
• Minimum: a shop cannot set a window so short that a customer cannot collect the print.

2. What triggers deletion

A scheduled job runs on the platform and deletes documents whose retention window has expired. Deletion removes both the stored object and its metadata record. If a deletion attempt fails, the job retries with a bounded backoff schedule and flags repeated failures for administrator alerting so lingering data is not silently ignored.

Freshness of the scheduled job:Runs hourly; failed deletions are retried up to 3 times with exponential backoff, and persistent failures trigger administrator alerts after 24 hours. .

3. Limitation — encrypted backups

We want to be honest about a limitation. Deleting a document from live storage does not instantly remove every copy. Copies may persist in encrypted backups and disaster-recovery snapshots for a limited period.

• Backups are encrypted at rest.
• Backup copies are not restored for normal operations and are not made available to shops.
• Backup copies expire or are overwritten on the backup rotation schedule rather than being deleted on demand.
• We therefore do not claim instant or total erasure of a document at the moment it leaves live storage.
• Backup rotation / expiry period:Backups and disaster-recovery snapshots expire and are overwritten automatically within 30 days .

4. Deletion on request

Where you have the right to request erasure, we will delete the live object and metadata on a verified request, subject to the same backup limitation described above and to any legal retention obligation. For documents uploaded to a shop, the request is actioned on the shop’s verified instructions, since the shop is the data fiduciary for those documents.

5. Account, billing, and audit records

Retention above applies to uploaded customer documents. Account, subscription, billing, and audit records are retained for longer because they are needed for billing, tax, security, and legal compliance:8 Year . These records do not expose document contents.

6. Effect of subscription expiry

A customer document is not deleted merely because a shop’s subscription expires. The normal retention window still governs deletion, and historical documents are never made publicly accessible.

7. Your choices

• Shop owners may adjust the retention window within the limits above.
• Customers can see the applicable window in the upload notice before submitting.
• Erasure and other rights are described in the Privacy Policy and handled via the Contact page.

This page is a first draft and is not a substitute for review by a qualified Indian legal professional. See docs/legal-review-checklist.md.