Data Retention Schedule

How to read this schedule #

This schedule sets out how long FLOW FN PTE. LTD. (UEN 202617303Z), a company incorporated in Singapore keeps each kind of data held for Nayto. It supplements the Privacy Notice and the Data Processing Addendum. A period runs from the event it names; at its end, the data is deleted or made anonymous.

Some records cannot be deleted one by one: an organization's activity history and its record of what was published are kept unaltered, because a history that can be edited is not a history. For those, closing an account removes the personal details they point to - the name and email address - so the records that remain no longer identify the person.

A legal hold - a court order, an investigation, or a dispute we are party to - can keep particular records longer, for as long as the hold lasts and for nothing else.

Your account #

• Account details (email address, name, password hash): while the account exists. Within 30 days of the account being closed, the name and email address are removed and the password hash destroyed. What remains is an account record that identifies nobody, kept so that the records below still hold together.
• Sessions: until 90 days after the session ends, whether it expired, was signed out or was revoked.
• Sign-in and account security records (sign-ins, password changes and resets): one year.
• Links we email (address confirmations and password resets): 30 days after the link is used or expires.
• Records of which version of our documents you accepted: while the account exists and for six years after it is closed - the period in which a claim about the agreement can be brought under Singapore law - held against the anonymised account record, then deleted.

Your organization #

• Uploaded media and the versions made from it for screens to play: while the organization exists. Media you delete yourself is removed from storage within 30 days, and all of it within 30 days of the organization being closed.
• Playlists, scenes, programs, campaigns, schedules, screens and locations, and the record of what was published where: while the organization exists. When it is closed, they are kept only as records that identify none of the people who made them: the accounts they point to are anonymised as above.
• Screen status history (when each screen was online and what it reported playing): 90 days.
• Activity history (who did what in the organization, and when): kept unaltered as part of the organization's record. It names who acted by an account identifier, so once an account is closed and anonymised, its entries no longer identify the person.
• Invitations: 90 days after the invitation is accepted, withdrawn or expires.
• On the Free plan, records of which advertisement played on which screen: 13 months.

Billing #

• Billing records - your organization's Stripe customer and subscription references, plan history, and invoices: at least five years from the end of the financial year they relate to, as Singapore's Income Tax Act and Companies Act require. They concern your organization, not people.
• Payment notifications Stripe sends us: 13 months.
• Stripe keeps its own records of payments under its own obligations; see its privacy policy.

Mail, support and operations #

• Records of email we sent and whether it was delivered: 90 days after sending.
• Addresses that bounced or complained, which we must not mail again: for as long as the address stays on that list.
• Correspondence with you: two years after the last message in the conversation.
• Server logs, including the network address and browser of each request: 30 days.
• Error reports: 90 days.
• Records of what our own staff do in our administration tools: kept unaltered as our own audit record. They name the account a member of staff acted on by its identifier, which closing that account anonymises.

Privacy requests and copies of your data #

• Privacy requests - what was asked, by whom, what we did about it and the email we sent about it: two years after the request is answered or refused. That is the time in which a regulator or a complaint may ask what we did, and the time California law requires records of requests to be kept.
• A request made on our privacy request form whose sender never confirmed it from the email we sent: 7 days.
• Copies of your data or of your organization's that we make for you to download: 7 days after they are ready, then deleted from storage, including any link to your media they contained.

Backups #

The database is backed up continuously so it can be restored after a failure. Backup history goes back at most 30 days, so data deleted from the Service is gone from backups within 30 days of its deletion. If we ever have to restore from a backup, we delete again whatever had been deleted since it was taken.

Anonymous data #

Counts and totals that can no longer identify anybody - how many screens were online on a day, for example - are not personal data and may be kept.

Questions and requests #

To close your account or an organization, to ask for data to be removed sooner, or for a copy of it first, write to privacy@nayto.io or use our privacy request form. If you have an account, you can download a copy yourself under Settings in the console.

How this document changes #

Every version of this document has a number and the date it applies from, both printed under the title. A change is published as a new version rather than an edit to this one, so what the document said on any day can be checked.

When a change matters to what you have agreed or to how we use your data, we tell you before it takes effect. Earlier versions are available from legal@nayto.io.