Data retention

Userz processes and stores customer data in the United States only; no EU intake or storage zone is offered.

Userz may also process customer data on computing hardware that Userz owns and operates in the United States, connected over encrypted channels. That hardware is a Userz processing location, not a subprocessor.

Errors, performance, engagement and custom events sent by the browser SDK are kept for your plan's retention period:

Expired events may be kept in an archive in which end-user identifiers are encrypted. An erasure request makes that end user's archived events permanently unattributable.

Raw events are summarised into aggregate statistics that carry no per-user identifier, and into Signals that describe what happened, not who. Aggregates and Signals are kept for the life of your App unless you delete them earlier.

To measure and improve quality, Userz keeps a small, redacted sample of signals with how the Service handled them and, where a person reviewed one, their label. A label is kept for 180 days, and longer only while an evaluation or training run that used it still exists; the signals it was drawn from expire on their own schedule. Erasure requests delete labels like any other derived record, and an organization that has opted out of training is excluded from every training run.

Userz keeps records of the AI processing done for your organization. A record identifies its input without keeping a copy of it. Records the Service acted on are kept for 180 days; records used only to evaluate quality are kept for 90 days; a record a label refers to is kept as long as the label.

The code index is kept current with your connected repositories, replacing older excerpts as they are re-indexed, and is deleted when your organization is deleted or on request to [email protected].

Media uploaded by the SDK — screenshots, annotated images, files, replay clips — is stored separately for each organisation:

• Media attached to a live Signal or Directive is kept with it, up to your plan's media retention period (30 days on Free and Starter, 90 days on Pro and Enterprise).
• Media never attached to a submission, or whose last attachment was deleted, is deleted within a few days.

Rate-limit and abuse-prevention records carry a pseudonym of the client address, never the address itself, and expire after 90 days. They are included in erasure requests.

Account, organization and configuration data; encrypted secrets; mirrored run content; server logs; and backups follow the periods in the Privacy Policy §8 — in short: account and organization data until you delete them, which you can do yourself at any time; secrets deleted on disconnect or when the organization is deleted; run content for the life of the organization unless deleted earlier; server logs about 30 days; backups expire within 30 days after the live data is gone.

An erasure request for one of your end users deletes that user's feedback, telemetry, replay clips and derived records, makes any archived copy unattributable, and is recorded so it can be evidenced. You can delete your own account or organization at any time in Settings, or write to [email protected].

• Data Processing Addendum
• Subprocessors
• Content-Security-Policy — the upload host, and what the SDK sends where (connect-src).