Retention
| Data | Kept for | Notes |
|---|---|---|
| Enquiries not converted (any status except "joined": new, replied, trial booked, lost) | 12 months from last activity, then deleted by a daily job (03:15 UTC), with their drafts and AI logs | studio can delete sooner; do-not-contact entries leave a suppression record (studio + normalised contact) so the person isn't contacted again |
| Enquiries converted to members | while the studio's account is open; the studio moves them to its own systems | studio's own retention rules apply |
| Spotter's AI logs (prompt and response) | 30 days, deleted by the daily job | health terms redacted; none created for handoff enquiries |
| AI provider (Cloudflare Workers AI) | inputs and outputs not retained after the response; not used for training | Cloudflare keeps operational metadata only (IDs, timestamps, sizes, token counts, status), without content (Cloudflare data-usage page, 16 Oct 2026) |
| Turnstile signals | per Cloudflare's Turnstile Privacy Addendum | |
| Application logs (Workers Logs) | not kept: switched off | |
| Database restore history (D1 Time Travel) | 7 days (Workers Free; 30 days if we move to Workers Paid) | deleted records can be restored only within this window |
| Test-mode enquiries | until the studio deletes them; excluded from numbers | |
| Studio account closure | Enquirer Data deleted or returned within 30 days |
As built (commit 8eb4954): health, injury, payment and complaint matches make no model call and no AI log. For other enquiries, health terms are replaced with [redacted] in the stored AI log. The enquiry message itself is kept so staff can read it, and the inbox tells staff they can remove health details once dealt with. Application logs record event names only, and Workers Logs are off.