1. Overview

This Data Retention Policy explains how AdBudgetBuddy ("Company," "we," "us," or "our") retains, archives, and deletes data collected through our ad budget management platform ("Service"). We retain data for specific periods based on the type of data, the purpose for which it was collected, and applicable legal requirements.

This policy supports our obligations under the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws. It should be read alongside our Privacy Policy and Terms of Service.

2. Retention Periods by Data Category

2.1 Budget Data

Budget allocations, budget entries, and planned spend data entered into the Service:

Data Type	Retention Period	Basis
Budget entries (active)	Duration of subscription	Service delivery
Budget entries (after cancellation)	90 days	Grace period for data export
Historical budget snapshots	3 years	Financial record-keeping requirements
Exported budget reports	30 days (download link)	Temporary secure delivery

2.2 Actuals (Spend Data)

Actual spend data imported from ad platforms or entered manually:

Data Type	Retention Period	Basis
Actuals (active account)	Duration of subscription	Service delivery
Actuals (after cancellation)	90 days	Grace period for data export
Aggregated/anonymized spend summaries	Indefinite (anonymized)	Product analytics, no personal data

2.3 Audit Logs

Audit logs record all significant actions taken within the platform for security and compliance purposes:

Log Type	Retention Period	Basis
Security audit logs	2 years	Security incident investigation
Access logs (user actions)	1 year	Compliance and dispute resolution
Authentication events (sign-in/out)	90 days	Security monitoring
API request logs	30 days	Debugging and performance
Error logs	90 days	Debugging and product improvement

2.4 User Account Data

Data Type	Retention Period	Basis
Active user profile (name, email)	Duration of account	Service delivery
User profile (after deletion request)	30 days grace period, then deleted	GDPR Article 17 (right to erasure)
Organization records	90 days after all members depart	Contractual obligations
Billing/payment records	7 years	Tax and financial regulations
Support correspondence	3 years	Customer service quality
Consent records (GDPR/CCPA)	3 years after consent withdrawn	Legal accountability

2.5 OAuth Credentials and Ad Platform Connections

Data Type	Retention Period	Basis
OAuth access tokens	Until disconnected or expired	Service delivery
OAuth refresh tokens (encrypted)	Until disconnected or revoked	Service delivery
Connection metadata (platform name, account ID)	90 days after disconnection	Audit trail

3. Account Deletion Timelines

When you request account deletion through the platform settings or by contacting support, the following process applies:

Immediate (Day 0): Your account is flagged for deletion. You are logged out from all active sessions. No new data is collected.
Grace Period (Days 1–30): Your account data remains accessible but the account is suspended. You may cancel the deletion request during this period and recover your account and all data.
Data Deletion (Day 30): Your personal data, budget entries, actuals, channel configurations, advertiser accounts, and OAuth connections are permanently deleted. A confirmation email is sent to your registered address.
Billing Records (7 years): Invoice and payment records are retained as required by tax law, stripped of personally identifiable information where possible.
Audit Logs (Up to 2 years): Security and access logs may be retained for the periods described in Section 2.3, but will be anonymized as soon as your personal data is deleted.

To initiate account deletion, go to Settings → Account → Delete Account or contact us at privacy@adbudgetbuddy.com.

4. Data Minimization

We apply the principle of data minimization throughout the retention lifecycle:

Aggregation: Where possible, detailed records are replaced with aggregated summaries once the detail is no longer operationally required.
Anonymization: Data retained for analytics or product improvement is anonymized — personal identifiers are removed or hashed before retention.
Pseudonymization: Internal identifiers are used in place of direct identifiers where full anonymization is not feasible.
Regular Review: We review retained data annually and delete any data that no longer serves a documented purpose.

5. Backups and Disaster Recovery

Our infrastructure uses automated daily database backups. Backup data is subject to its own retention schedule:

Daily backups: Retained for 7 days
Weekly backups: Retained for 4 weeks
Monthly backups: Retained for 3 months

When you request data deletion, your data will be removed from production systems within the timelines described in Section 3. Backup copies may persist for up to the maximum backup retention period (3 months) before being automatically purged. We do not restore deleted data from backups except in cases of accidental data loss within the 30-day grace period.

6. Your Rights

Under applicable data protection laws, you have the right to:

Request deletion of your personal data (subject to legal retention requirements described in this policy)
Request a copy of all personal data we hold about you (GDPR Article 15, CCPA)
Request correction of inaccurate personal data
Object to processing for specific purposes
Lodge a complaint with your national data protection authority (EU/EEA residents)

To exercise any of these rights, contact us at privacy@adbudgetbuddy.com. We will respond within 30 days (GDPR) or 45 days (CCPA).

7. Changes to This Policy

We may update this Data Retention Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by posting the updated policy on our website and updating the "Last Updated" date. For significant changes, we may also send an email notification.

8. Contact Us

For questions about this Data Retention Policy or to exercise your data rights:

Privacy inquiries: privacy@adbudgetbuddy.com

General support: support@adbudgetbuddy.com