# Aware AI Data Retention and Disposal Policy
Effective Date: May 2026
Company: Aware AI
Policy Owner: Security & Infrastructure Administration
# Purpose
The purpose of this Data Retention and Disposal Policy is to define how Aware AI collects, stores, retains, archives, and disposes of data in accordance with operational, security, legal, and privacy requirements. This policy is intended to support responsible data governance and reduce unnecessary retention of sensitive information.
# Scope
This policy applies to:
- User accounts
- Conversations and chat history
- AI memory and contextual systems
- Uploaded files and attachments
- Authentication records
- Infrastructure and audit logs
- Customer support communications
- Third-party integration data
- Financial and transactional metadata
- Internal operational systems
# Data Retention Principles
Aware AI follows the principles of data minimization, least-retention necessary, secure storage, controlled access, user-requested deletion support, and operational and legal compliance. Data is retained only for legitimate operational, security, legal, or service-related purposes.
# Data Categories and Retention Guidelines
## 1. User Account Information
Examples: name, email address, authentication identifiers, account preferences.
Retention: retained while the account remains active. May be deleted or anonymized following verified account deletion requests, subject to operational, legal, fraud-prevention, or security obligations.
## 2. Conversations and Chat History
Examples: user prompts, assistant responses, orchestration metadata, session summaries, AI reasoning traces.
Retention (3-tier model):
• **Saved Library items** (assets the user has explicitly saved into their Library — documents, images, decks, videos, exports) are retained **indefinitely while the account remains active**. They are excluded from any automatic time-based purge.
• **Conversations and their inline assets** are retained **indefinitely while the account remains active on paid plans**, and **for approximately 18 months on free plans**, after which non-pinned conversations are automatically purged. Users may choose a shorter window (30 days, 6 months, 18 months, 36 months) or — on paid plans — keep conversations indefinitely, via Settings → Memory → Chat Retention. Pinned chats, chats referenced by a live public share link, and chats whose assets have been promoted to the Library are exempt from automatic purges at all tiers.
• **Deleted conversations** are removed from active systems immediately. They may remain in protected backups for a limited operational recovery period (approximately 30 days) before permanent removal.
## 3. AI Memory and Contextual Intelligence Data
Examples: user preferences, working memory, semantic memory embeddings, style profiles, project continuity metadata.
Retention: retained while relevant to platform functionality and user experience. Low-value, expired, stale, superseded, or decayed memory entries may be purged periodically through automated lifecycle management systems.
## 4. Uploaded Files and Attachments
Examples: documents, images, user-uploaded assets.
Retention (3-tier model):
• **Saved Library items** are retained indefinitely while the account remains active, regardless of plan tier.
• **Chat-attached assets** follow the retention window of their parent conversation (see Section 2). Assets referenced by a live public share link are automatically promoted to permanent storage and are not pruned while the share link is active.
• **Orphaned or transient uploads** (files attached to a deleted conversation, or transient previews that were never referenced by a saved item or share link) are removed approximately 30 days after they become orphaned, during routine maintenance and integrity cleanup.
## 5. Authentication and Security Logs
Examples: login activity, session metadata, MFA events, access logs, infrastructure security logs.
Retention: retained for operational security, fraud prevention, troubleshooting, and compliance purposes. Access to security logs is restricted to authorized personnel.
## 6. Infrastructure and Operational Logs
Examples: API logs, error logs, performance telemetry, orchestration telemetry, persistence and retry logs.
Retention: retained for operational monitoring, debugging, reliability engineering, and security analysis. Logs may be rotated, archived, or deleted periodically based on operational requirements.
# Data Deletion Requests
Aware AI supports verified user requests for deletion of account-related data where applicable. Deletion requests may include account deletion, conversation deletion, removal of stored memory or context, and uploaded file deletion.
Certain data may be retained where necessary for security investigations, fraud prevention, legal obligations, financial compliance, backup recovery integrity, or operational continuity.
# Backup and Recovery Retention
Aware AI may maintain encrypted backups for disaster recovery and operational resilience. Deleted data may persist temporarily within backup systems until backup rotation cycles complete. Backups are protected using access controls and infrastructure security safeguards.
# Secure Disposal
Aware AI uses reasonable administrative, technical, and operational safeguards to securely dispose of or remove data that is no longer required. Secure disposal methods may include database deletion, storage lifecycle expiration, cryptographic deletion mechanisms, access revocation, and backup rotation and expiration.
# Third-Party Services and Integrations
Data shared with third-party providers is subject to the retention and deletion practices of those providers. Examples include cloud infrastructure vendors, authentication providers, AI model providers, financial integrations, and analytics platforms. Aware AI attempts to work with providers that maintain commercially reasonable security and privacy practices.
# Access Restrictions
Access to retained data is restricted based on operational necessity and role-based permissions. Administrative access to production systems and sensitive data is limited to authorized personnel.
# Policy Review and Updates
This policy may be reviewed and updated periodically to reflect infrastructure changes, product evolution, legal or regulatory requirements, security improvements, and operational needs.
# Compliance and Legal
Aware AI may retain certain records where required by applicable law, security investigations, fraud prevention requirements, financial or operational obligations, and regulatory requests. Nothing in this policy guarantees immediate deletion from all systems or backups.
# Contact
Questions regarding this policy may be directed to support@stayaware.ai.
# Last Updated
May 2026