Data Retention Policy

In short. We keep your data only as long as we need it. Account and content data stays while your account is active; when you delete your account, personal data is erased within 30 days. A few records — mainly billing and anything the law requires — are kept longer, and only as long as necessary.

This Data Retention Policy explains how long OrbitSub, operated by KARAN (“we”), keeps different kinds of data and why. It reflects the principle in the Digital Personal Data Protection Act, 2023 that personal data should not be kept longer than necessary. Read it alongside our Privacy Policy and Data Deletion Policy.

1. Our retention principle

We keep personal data only for as long as it is needed for the purpose it was collected, to provide the Service, or to meet a legal obligation — and no longer. When data is no longer needed, we delete it or irreversibly anonymise it.

2. How long we keep each type of data

2.1 Account and profile data

Kept for as long as your account is active. Deleted or anonymised within 30 days after you delete your account.

2.2 Your content (research, drafts, comments, sources)

Kept while your account is active so the Service works. Removed when you delete the content or your account, subject to the shared-contribution and public-copy points in our Data Deletion Policy.

2.3 AI interaction history

Kept within your research rooms so you can see your history, and removed when you delete the room or your account.

2.4 Authentication data (sessions and tokens)

Session refresh tokens are short-lived and expire automatically; expired or revoked tokens are invalidated. Signing out or deleting your account invalidates your sessions.

2.5 Log and security data

Logs used for security, abuse prevention, and keeping the Service reliable (such as IP address and user-agent associated with sign-ins or reports) are kept only as long as needed for those purposes, then deleted or aggregated.

2.6 Billing and transaction records

We keep records of subscriptions and payments (such as your plan and a subscription identifier) for as long as required for accounting, tax, and legal compliance — which may be a number of years under Indian law — even after you delete your account. We do not store your card or bank details; those are held by PayPal.

2.7 Support and grievance records

Correspondence such as support requests and grievances is kept for as long as needed to handle the matter and to keep a reasonable record of how we resolved it, then deleted.

2.8 Backups

Encrypted backups are kept on a rolling basis and cycle out within a limited period, ordinarily up to 30 days. Data you delete is removed from live systems immediately and ages out of backups within that window.

3. Why we sometimes keep data longer

We may retain limited data beyond the periods above only where we need to:

• comply with a legal, tax, or regulatory obligation;
• establish, exercise, or defend a legal claim;
• prevent fraud, abuse, or security incidents;
• enforce our Terms of Service.

In each case we keep only what is necessary, for only as long as necessary.

4. Anonymised data

We may keep data that has been irreversibly anonymised — so it can no longer identify you — for analytics and to improve the Service. Anonymised data is not personal data and is not subject to the deletion timelines above.

5. Changes and contact

We may update this Policy from time to time; the current version and the “Last updated” date are shown here. Questions about retention? Contact us at team@orbitsub.com.