Data Retention and Destruction Schedule
Visibility Group Limited · Version 1.0
Definitions
- Last interaction: the later of the account's last sign-in and the last time the account holder contacted us.
- Closure: the moment an account is finally deleted. That is either at once, or after the optional 30-day pause.
- Destroy: delete from the live system so that the data cannot be retrieved through it. Copies in backups then expire by rotation. For face templates, destroy means
DeleteFaceson the AWS collection, after which nothing remains to match against.
1. Biometric information (published)
| Data | Held in | Kept while | Destroyed at the earliest of | Method |
|---|---|---|---|---|
| Face template | AWS Rekognition collection in US East (N. Virginia), in Acclaimedly's AWS account | The account is open and used | 30 days after closure · 30 days after 24 months without interaction · 30 days after consent is withdrawn | DeleteFaces by the daily job, then a destruction log entry (FaceId and date only) |
| Face template, account closed by us for serious or repeated breach | Same | Needed to prevent ban evasion | 24 months after the closure date | Same |
| Face check video and reference frames | AWS Face Liveness session | The check | At the end of the session. Never written to our storage | Expires with the AWS session; never saved |
FaceId reference on the account | Supabase | The template exists | Cleared in the same transaction as DeleteFaces | Cleared from our database |
| Consent record (notice version, timestamp, IP hash, user agent) | Supabase | The template exists, and then as evidence of consent | 6 years after the template is destroyed (limitation for claims) | Deleted from our database |
| Destruction log | Supabase | Evidence of destruction | 6 years | Deleted from our database |
Hard cap: no face template is kept more than 24 months after the last interaction, whatever the reason. The ban-evasion case counts from the date of the ban, which is our last interaction with that person.