Data Retention Policy

This Data Retention Policy describes how long Frontal Labs, Inc. ("Frontal," "we," "us," or "our") retains Customer Data and other categories of data processed through the Services. This policy is incorporated into the Terms of Service and supplements our Data Disposal Policy. Capitalized terms not defined here have the meanings given in the Terms of Service.

1. SCOPE

This policy applies to all data processed, stored, or transmitted by Frontal in connection with the Services, including Customer Data, Account Data, Usage Data, and Frontal's operational data.

2. RETENTION PRINCIPLES

Frontal retains data based on the following principles:

Purpose Limitation. Data is retained only as long as necessary to fulfill the purposes for which it was collected and processed.
Legal Compliance. Data is retained to comply with applicable legal, regulatory, and contractual obligations.
Business Necessity. Data is retained as needed to support business operations, security, and legitimate business interests.
Data Minimization. We periodically review data holdings and minimize data where retention is no longer justified.

3. RETENTION PERIODS BY DATA CATEGORY

3.1 Customer Data

Data Type	Retention Period	Notes
Active Customer Data (databases, storage, models, embeddings, configurations)	Duration of Account plus 30 days after termination	Customers may delete specific data at any time through the Services
Database backups	Per backup schedule (7-35 days depending on plan)	Backups rotate and expire automatically
Object storage version history	Configurable; default 30 days	Customers may configure longer retention
Fine-tuned model weights	Duration of deployment plus 30 days after deletion	Customers may delete at any time
Vector embeddings	Duration of collection plus 30 days after deletion	Customers may delete at any time
Agent configurations and execution history	Duration of agent plus 90 days after deletion	Execution logs retained per log retention schedule
Domain registration data	As required by ICANN and registry policies	Governed by Domain Name Registration Terms
Cached and temporary data	Up to 7 days	CDN caches, temporary processing data

3.2 Account Data

Data Type	Retention Period	Notes
Account profile and settings	Duration of Account plus 90 days	Used for account recovery and reactivation support
Billing and payment records	7 years from transaction date (or longer as required by tax law)	Tax and financial regulatory requirement
Invoices and receipts	7 years	Accessible through Account while active
Communication preferences	Until Account deletion	Opt-out preferences preserved indefinitely

3.3 Usage Data

Data Type	Retention Period	Notes
API request logs	30 days (standard); up to 24 months (Enterprise)	Configurable for Enterprise plans
Audit logs and access logs	12 months minimum; up to 24 months for Enterprise	Security and compliance requirement
Service telemetry and performance data	13 months	Aggregated after 30 days
Error and crash reports	90 days	Aggregated after 30 days
Analytics data (aggregated)	24 months	De-identified or aggregated
Analytics data (individual-level)	13 months	Connected to Account while Account is active

3.4 Communications Data

Data Type	Retention Period	Notes
Support tickets and communications	3 years after ticket closure	For quality, training, and continuity
Sales and pre-sales communications	3 years after last communication
Marketing communications history	2 years	Opt-out requests retained indefinitely
Call recordings (where applicable)	90 days	Only with notice and consent

3.5 Security Data

Data Type	Retention Period	Notes
Security event logs	12 months	SIEM retention
Access audit trails	12 months minimum	Longer for systems processing Restricted data
Incident reports and post-mortems	7 years	Historical record of security incidents
Vulnerability scan results	3 years
Abuse and fraud investigation data	3 years after Account closure	Longer if subject to legal hold

4. DELETION UPON REQUEST

4.1 Customers may delete specific Customer Data at any time through the Services interface or API. Upon deletion, data is removed from active systems in accordance with our Data Disposal Policy.

4.2 Upon Account termination, Customer Data is deleted according to the schedule in our Data Disposal Policy.

4.3 Backup data containing deleted Customer Data expires per the backup retention cycle and is not actively purged. Expired backups are securely deleted.

5. EXCEPTIONS TO RETENTION PERIODS

5.1 Legal Holds

Data subject to a legal hold is retained until the hold is released. Frontal preserves data subject to legal holds and does not delete it during the hold period. We will notify the Customer of a legal hold affecting its data unless prohibited by law.

5.2 Legal Obligations

Data may be retained beyond standard periods where required by applicable law, including:

Tax, accounting, and financial reporting obligations.
E-discovery and litigation preservation obligations.
Regulatory investigation requirements.
Data protection law requirements (e.g., records of consent).

5.3 Security and Abuse Prevention

The following categories of information, to the extent reasonably necessary for fraud prevention, abuse detection, and security purposes, may be retained for up to 12 months after Account termination:

IP addresses associated with Terms of Service violations.
Indicators of fraudulent activity.
Security incident data.
Blocked Account identifiers.

5.4 Anonymized Data

Data that has been anonymized or de-identified such that it cannot reasonably identify an individual or Customer may be retained indefinitely for research, analytics, and service improvement.

6. DATA EXPORT

Customers may export their data at any time during their Account term using the export tools available in the Services. Supported export formats are described in the Documentation. We recommend exporting data before initiating Account deletion.

7. CUSTOMER OBLIGATIONS

7.1 Customers are responsible for complying with their own data retention and deletion obligations under applicable law.

7.2 This policy describes Frontal's retention practices. Different retention periods may apply under an Order Form or separate written agreement with Enterprise Customers.

7.3 Customers are responsible for configuring retention settings for Services that offer configurable retention.

7.4 Customers are responsible for maintaining their own records and backups in accordance with their business and legal requirements.

8. CONTACT

Frontal Labs, Inc. Attn: Data Protection 131 Continental Drive, STE 305 Newark, DE 19713 United States of America Email: dpo@frontal.dev