Data Retention Schedule

This page describes how long ITAD Tools retains each category of data, and the legal basis under which it is stored. When data reaches the end of a fixed retention period, it is permanently deleted by our automated cleanup processes, which run daily; the exceptions are noted below. For full details on how we collect and use your data, see our Privacy Policy.

Data Type	Retention Period	Basis
Account Information Name, email, hashed password	Until account deletion	Contract
Login History IP addresses, timestamps, user agents	90 days	Legitimate interest
Page Analytics First-party page-tracker: page views, scroll depth, click actions	90 days	Consent
Umami Analytics Cookieless page views, referrers, browser type, country, page-load performance	13 months, then deleted automatically	Legitimate interest
Cloudflare Web Analytics Cookieless page views and page-load performance, collected by Cloudflare	Kept by Cloudflare under its own privacy policy	Legitimate interest
Performance Metrics Request timing, endpoint usage	30 days	Legitimate interest
Bug Reports User-submitted issue reports	No automatic deletion is configured at present; browser details are removed if you delete your account	Legitimate interest
Certificate Records Data destruction certificates, wipe results	Indefinite (compliance); certificate purchase records are deleted with your account	Legal obligation
Health Check Results Drive and battery diagnostics	No automatic deletion is configured at present	Contract
Email Processing Logs Inbound email processing records: sender, subject, file names	30 days	Legitimate interest
Uploaded Lookup Spreadsheets Spreadsheets uploaded to the Dell, HP, Lenovo and Apple bulk lookups, and their results files	Within 9 days of upload	Contract
Lookup Results The serial or service tag with the model, specifications and warranty details found	Up to 30 days. Rollback backups taken during system changes can hold them longer; they stay on our server, readable only by the lookup service's system account and our server administrators.	Legitimate interest
Configuration Statistics A one-way hash of the serial (never the serial itself) with the model and configuration found	Indefinite	Legitimate interest
Emailed Spreadsheets Spreadsheets sent to our email-processing addresses (lookup@ and excel@itadtools.com)	30 days after processing	Contract
Support Inbox Copies When we cannot process a spreadsheet sent to excel@itadtools.com: the sender's address, the subject and the spreadsheet	Until handled (reviewed and deleted by hand)	Legitimate interest
Backup Configurations User-defined backup schedules and settings	Until deleted by user	Contract
Resale Assessments Device valuations and market data	Until account deletion	Contract
Whole-Server Backups Copies of all of the data above, taken daily	Up to six months	Legitimate interest

When You Delete Your Account

When you delete your account, we immediately delete your account record (username, email address and password hash), your login history, tool usage and assignments, preferences, saved rebranding settings, resale assessments, feedback, certificate purchase records and the other records tied only to your account. Some records are kept but no longer linked to you: performance metrics lose your IP address and browser details; bug reports lose your browser details but keep their text; email processing records keep the sender address until their 30-day deletion; application error records lose your IP address and browser details; compliance report purchases keep the purchaser email as a transaction record; and chain-of-custody records keep the name recorded with each event, with the IP address removed. Copies remain in our whole-server backups for up to six months and in server logs for up to 90 days. Deleting your account cancels an active Bulk Lookups subscription immediately, so no further payments are taken; Stripe keeps its own payment records. If you pay for your organization's subscription, cancel it before deleting your account.

Automated Data Lifecycle

Our platform runs automated cleanup processes daily to enforce the fixed retention periods above. Data that has exceeded its retention period is permanently deleted. The exception is our support inbox: when we cannot process a spreadsheet sent to excel@itadtools.com (the sender has no account with us, has no saved rebranding settings, or processing fails), the sender's address, the subject and the spreadsheet are forwarded there; we review them there and delete them once handled.

Your Rights

You can request early deletion of your data at any time. Account holders can delete their account (what that removes, and what it keeps, is described above) through the self-service option at /auth/delete-account, or by emailing admin@itadtools.com. For more information about your rights, see our Privacy Policy.