POLICY 003REV 01DRAFTED BY BRAND DESKAPPROVED A.R.LAST UPDATED 22 SEP 2026
Retention schedule
Last updated 22 September 2026.
How long we keep each kind of record, and why. Published in full, because a retention period you cannot read is not a policy.
The schedule
| Record | How long | Why |
|---|---|---|
| Outreach logs and approvals: who approved what, when, the version approved, the recipient, the sources | 3 years | Evidence of diligence: the reviews rule's "knew or should have known" standard, PECR and CAN-SPAM1 |
| Your canon, documents and content | The length of the contract plus 90 days, then deleted or returned | Your chapters and canon stay exportable for 90 days after you leave |
| Monitoring data: mentions, alerts, review text we fetched | 12 months | Enough for a year-on-year chapter; no longer |
| Model prompts and outputs tied to an approval | 3 years | Part of the approval record above; the editor of record's evidence2 |
| Model prompts and outputs not tied to an approval | 30 days | Debugging only |
| Billing records | 7 years | Tax and accounting law3 |
| Journalist contact records | Reviewed every 12 months; deleted 24 months after the last confirmation that the record was current | Article 5(1)(e): no longer than necessary4 |
| Opt-out and deletion hashes | Indefinitely | So that we can never re-add someone who said stop; the hash cannot be turned back into an address5 |
| Audit log | 3 years, append-only | Nobody, including us, can edit or delete an entry; the database refuses |
| Snapshot requests (the free report) | 12 months | To honour "one snapshot per site per month" and to send you the report you asked for |
What "deleted" means
Deleted means removed from the live database and from backups on their normal cycle, which is at most 35 days behind. A journalist who asks to be deleted is anonymised the same day: every field is blanked and only the one-way hash of the address remains, on the suppression list.
What we will not do
We will not delete an approval record early, even if you ask, because it is the evidence that a named human read what went out in your name. We will not keep monitoring data past twelve months, even if it would make a nicer chart.
Questions
privacy@mainlore.com. A person, within 30 days.