Data Retention Policy

This policy sets out how Saltara AI manages the retention and deletion of personal data processed through its WhatsApp AI booking service. This policy applies to all personal data processed by Saltara AI as a data processor on behalf of its clients.

1. Purpose

UK GDPR requires that personal data is kept no longer than is necessary for the purposes for which it was collected (the storage limitation principle, Article 5(1)(e)). This policy ensures Saltara AI complies with this principle across all client types and use cases.

2. Data Categories and Retention Periods

Data Category	Retention Period	Basis	Deletion Method
End User Contact Data (WhatsApp Number, Name)	Maximum 12 months from last booking or interaction	Necessary for service delivery and follow-up	Secure deletion from all systems
Service or Booking Details	Maximum 12 months from date of booking or enquiry	Necessary for delivery and administration of the booked service	Secure deletion from all systems and sub-processors
WhatsApp Conversation Logs	Maximum 90 days from date of conversation	Operational quality assurance and dispute resolution	Automated deletion after 90-day period
Booking Records (Anonymised Summary Data)	Up to 3 years	Legitimate business interest and financial record-keeping	Secure deletion after period expires

⚠ Applicable Where Children's Data is Processed

Children's Personal Data (Name and Date of Birth):

Retention period: Maximum 12 months from date of booking
Basis: Necessary for the duration of the activity and reasonable post-activity administration
Deletion method: Secure and verified deletion from all systems and sub-processors

Children's data must never be retained beyond 12 months under any circumstances, and must be deleted at any time upon parental or guardian request regardless of the standard retention period.

The above obligations apply in addition to all standard clauses in this document.

3. Deletion Procedures

All deletion of personal data must be:

Secure and irreversible — data must not be recoverable after deletion
Applied across all systems — including primary database, backups, and sub-processor systems
Documented — deletion events must be logged for accountability purposes

Saltara AI will maintain a deletion log recording the category of data deleted, the date of deletion, and the method used.

4. Early Deletion Requests

Where an individual exercises their right to erasure under UK GDPR Article 17, Saltara AI will:

Acknowledge the request within 5 working days
Complete the deletion within 30 calendar days
Notify relevant sub-processors to delete the data from their systems
Confirm completion to the individual in writing

Deletion requests should be directed to helxp@saltxaraai.com.

5. Sub-processor Retention

Saltara AI will ensure Data Processing Agreements with sub-processors (Twilio, Anthropic, Railway) include retention and deletion obligations consistent with this policy.

6. Client Responsibilities

Our clients (data controllers) are responsible for their own retention practices in respect of data passed to them by Saltara AI. Clients must maintain their own data retention policies appropriate to their industry and the nature of the data they hold.

⚠ Applicable Where Children's Data is Processed

Clients whose businesses involve children must implement specific data retention controls for children's data. They must not retain children's personal data beyond what is strictly necessary for their activities, and must have a documented process for deleting children's data on request or at the end of a retention period.

The above obligations apply in addition to all standard clauses in this document.

7. Review

This policy will be reviewed annually or following any significant change to our data processing activities, applicable law, or ICO guidance.

8. ICO Registration

Saltara AI is required to register with the Information Commissioner's Office (ICO) as a data processor. Registration must be completed at ico.org.uk/registration before commercial deployment of the Service. Annual renewal is required.