Retention & Deletion Policy

1. Data retention — active accounts

While your account is active we retain all data you have entered into CraftCert, including:

• Account profile and preferences
• Products, formulations, and ingredient data
• Generated CLP labels and classification records
• Compliance evidence records
• Audit logs (who did what, when — required for compliance traceability)

We retain this data for as long as your account exists so that you can access your compliance history at any time.

2. Deleting individual products

When you delete a single product from your dashboard, it is immediately hidden from your product list and from every view in the application. The row itself is kept in the database with a deletion timestamp, so support can recover it on request. Deleted products are not subject to the 90-day account-purge cycle described below — they remain recoverable as long as your account exists.

3. Deleting your account

You can delete your entire account in two ways:

• Self-service: go to Settings > Delete account in your dashboard, type DELETE to confirm, and submit. That does not delete anything on its own: we email you a confirmation link, and the deletion starts when you click it. The link is valid for 30 minutes, and the same email carries a link to cancel instead.
• By request: email support@craftcert.co.uk. We will acknowledge your request within five working days and action it within 30 days of verifying your identity.

Both paths trigger the same technical flow described in the next section.

4. What happens when you delete your account

Account deletion is a two-stage process. It is not instantaneous, and it is reversible within the first stage.

Stage 1 — Immediate soft-deletion (day 0)

The moment you confirm deletion, CraftCert does the following:

• Your profile is marked deleted in our database with the exact UTC timestamp of your request. We call this T₀.
• Your Supabase authentication record is suspended, so no-one (including you) can sign in using your credentials.
• Open browser sessions on other devices stop being able to access any of your data within roughly one hour (the maximum lifetime of an authentication token). They cannot view, edit, or export anything. The browser tab itself may continue to render until you close it, but every action returns an empty result.
• Row-level security rules hide every row you own (products, formulations, labels, evidence, ingredients) from the application, so nothing signing in as a user — you, or support acting under your session — can reach them. The data still exists in the database. Our server-side systems — the scheduled jobs that run this deletion process, and the administrative tooling behind them — connect with a privileged key that bypasses row-level security by design; that is how the permanent deletion at stage 2 is able to happen at all. Access to that key is limited to CraftCert's own server-side code and to the sole director of Crocker Digital Ltd.
• Any active paid subscription is cancelled immediately with no proration and no final invoice.
• An account_soft_deleted entry is written to our audit log, recording T₀ and the scheduled permanent-deletion instant T₀ + 90 days.

Stage 2 — Permanent deletion (day 90)

A scheduled job runs every day at 03:17 UTC. Each run looks for accounts whose 90-day window has elapsed and permanently deletes them.

Permanent deletion removes your authentication record, profile, products, formulations, ingredients, labels, evidence records, and any supplier documents you uploaded, from our production systems.

Audit log entries survive, because we need a record of what actions were taken on the system and when. Immediately before your account is removed, we strip the identifying content out of those entries: the email address, the product names you entered, and any ingredient names captured in them. Your user identifier is removed as well — by the database, as part of the deletion itself.

What remains on each entry is the action, its timestamp, an internal reference to the record it concerned, and a fixed list of non-identifying details — things like product type, hazard classification, and counts of ingredients or warnings. We work from that fixed list of what may stay, rather than a list of what to remove, so a field added to the audit log in future is stripped at deletion unless it has been reviewed and added deliberately, rather than kept until someone notices it.

Two items on that list are worth naming rather than glossing over. Where a member of our staff acted on your account — restoring it, for example — the entry keeps that person's internal identifier, so the record of who did what survives; that identifies our operator, not you. And entries for payments keep references to the corresponding records at Stripe. We keep those because they are financial records we are obliged to retain, not because they are anonymous.

5. The 90-day timer — exact math

We promise that you have a full 90 days to change your mind. The timer is measured in UTC and is exact to the second.

• Start (T₀): the UTC instant at which you confirm the deletion by clicking the link in the email we send when you ask to delete. That instant — not the moment you pressed Delete in Settings — is the one we record.
• Restore-by instant (T₀ + 90 days): the exact UTC instant after which the scheduled purge is permitted to permanently delete your data. We store it against your account alongside T₀.
• Actual purge time: the next scheduled run after the restore-by instant. The purge runs daily at 03:17 UTC, so in the worst case your data is retained up to ~24 hours longer than the restore-by instant — never shorter.

We do not send you an email once the deletion has gone through. You click the link, we take you to a page confirming it, and nothing further arrives — so if you want to be told your exact T₀ and restore-by instant, email privacy@craftcert.co.uk and we will look them up for you.

Worked example. You confirm your deletion on 1 June 2026 at 14:22 UTC. Then:

• T₀ = 2026-06-01 14:22 UTC
• Restore-by instant = 2026-08-30 14:22 UTC (exactly 90 × 24 hours later)
• Actual permanent-deletion run = 2026-08-31 03:17 UTC (the first scheduled purge after the restore-by instant)
• Window during which support can restore your account: 2026-06-01 14:22 UTC to 2026-08-30 14:22 UTC. After the restore-by instant, a restore request may still succeed if the 03:17 purge has not yet run, but we do not guarantee it.

6. Restoring a soft-deleted account

To restore during the window, email support@craftcert.co.uk from the email address associated with the account. We will:

• Verify your identity (typically by confirming details from your account — last subscription, number of products, approximate signup month).
• Unsuspend your authentication record and clear the deletion flag on your profile, which re-opens row-level access to your data.
• Write an account_restored audit entry attributing the restoration to the support operator.
• Email you to confirm the account is live again, usually within one working day of receiving the request.

Your subscription is not automatically restored. When your account comes back, it is on the Free tier. If you want a paid plan again, subscribe through Pricing in the normal way. Your Stripe customer record is preserved, so billing history continues on the same record.

Product-level deletions stay deleted. If you had soft-deleted a specific product before you deleted your account, that product stays deleted when the account is restored — we only reverse the account-level deletion.

7. GDPR Article 17 — Right to erasure

The soft-delete window is a restoration convenience, not a delay to your statutory rights. If you want an immediate hard deletion with no 90-day restoration window, explicitly request this in writing to support@craftcert.co.uk — for example, “I am exercising my right to erasure under UK GDPR Article 17 and require immediate permanent deletion with no 90-day window.” We will:

• Acknowledge your request within five working days.
• Complete the permanent deletion within 30 days (or explain any delay, where a delay is permitted by the regulation — for example, if we are subject to a legal obligation to retain specific records).
• Confirm the deletion in writing once complete.

8. Backups

CraftCert's database is backed up by our hosting provider (Supabase) on a 7-day rolling retention. When we permanently delete your account at day 90, the production record is gone immediately; any reference to your data in rolling backups is removed naturally as those backups age out within seven days.

We do not take long-term snapshots and we do not copy production data to cold storage.

8a. The one thing we keep for longer

One narrow category is kept beyond the point described above, and we would rather set it out plainly than let the sentence that used to sit here — that no trace of your data remains after 97 days — stand when it was not accurate.

When the day-90 deletion in section 4 completes, our system writes a single minimal record that the request was made and completed: a reference number, the email address the account used, the date you asked, the date it completed, and whether it succeeded. An immediate erasure requested under section 7 is carried out by hand, and the same record is written by hand alongside it. Its only purpose is so that we can show we honoured your request if the question is ever raised — by you, or by the Information Commissioner's Office. It is held in a separate table that no signed-in user or browser can read, and it does not contain your formulations, products, ingredients, labels, evidence records or correspondence. It also does not contain your account identifier — deliberately, so that it does not add another way of matching you to the audit log entries described in section 4.

We keep it for 12 months from the date the deletion completes, and it is then deleted automatically by the same daily job that performs the deletions — the period is enforced in code, not left to us to remember. Our lawful basis is our legitimate interest in being able to demonstrate that we handled your request properly (UK GDPR Article 6(1)(f)), for the purpose recognised by Article 17(3)(e).

This record is personal data and we do not describe it as anything else. If you would like to know whether one exists for you, or to ask us to justify keeping it, email privacy@craftcert.co.uk.

Two further categories survive your deletion, and we would rather name them than write another absolute we cannot stand behind.

• Audit log entries, as described in section 4 — the action, its timestamp, an internal reference, and the non-identifying details listed there. We are not going to call these anonymous. Entries that record a payment keep references to the matching records at Stripe, and we could use those to look you up in our Stripe account; we keep them because they are financial records we have to retain.
  
  One of those internal reference numbers can still be traced back to a person, and we would rather say so than discover a fourth way it is possible. For account-level events the reference is the account's own internal identifier, and for anyone who has been through checkout we store that same identifier against their customer record at Stripe, which also holds their email address. So we could work back from an audit entry to a named person by going through our own Stripe account, for as long as Stripe keeps that record — around seven years. That is a real limit on what the removal above achieves, it applies to paying and previously-paying customers, and we are working on removing that identifier from Stripe as well.
  
  The deletion record described above is deliberately written without your account identifier, so that it does not add a further link of the same kind.
• Product analytics events. We record which parts of CraftCert were used and when, so we can see where people get stuck. These rows are not deleted when your account is; your user identifier is removed from them, and what is left is the event name, the time, and settings and counts such as product type or number of ingredients. We checked every field: there is no free text, no names and no email addresses in them. Some of these rows do, however, still carry the network (IP) address the event came from. That is a gap we have identified and have not yet closed, and we are recording it here rather than describing it as something it is not.

One more, only if it applies to you: if you gave us a written reason when cancelling, sent us feedback through the app, or gave us a testimonial, those words are currently kept after deletion, along with any name you attached to the testimonial. We are addressing that alongside the analytics events above.

Waitlists are separate. If you joined the cosmetics or toys waitlist, that entry is not part of your account — you can join either without having one. So deleting your account does not remove it: the email address you gave, anything you wrote in the “what would help most” box, and the browser details recorded at signup all stay until you ask us to remove them. Email privacy@craftcert.co.uk and we will.

What this list covers. The categories set out above are the ones that survive in our own database— the one CraftCert runs and controls. In our own database, those categories, the deletion record described above, and any waitlist entry are what remain once the 90-day window and the 7-day backup cycle have both elapsed. Everything else — your account, products, formulations, ingredients, labels and evidence records — is gone from our database.

What our suppliers keep is a separate question, and this list is not the place we answer it. Stripe is named above only because its record is what makes an audit entry traceable back to you; Stripe, Microsoft 365 and Resend each hold records on their own schedules, and deleting your CraftCert account does not by itself remove any of them. Section 11 sets out what each one keeps, what we can ask them to remove, and what you can ask us to remove on your behalf. We have split it that way deliberately: an earlier version of this page made a single claim about every system at once, and a claim that size cannot be kept accurate.

9. Data export

You can export every product, formulation, label, and evidence record as a single JSON file from Settings > Export all data in your dashboard. Export is also available on request via support@craftcert.co.uk. The export satisfies the UK GDPR right to data portability.

10. Cancelled subscriptions

Cancelling a paid subscription is not the same as deleting your account. If you cancel, your account is downgraded to the Free tier at the end of the current billing period; your data is preserved and accessible; you can re-subscribe at any time without restoring anything. The 90-day clock only starts when you explicitly delete the account.

11. Third-party processors

Some data is held by third-party processors on our behalf (Stripe, Resend, Sentry, Netlify, Upstash, GoatCounter, Supabase). Each processor has its own retention schedule. We cover this in the Privacy Policy and list every processor on the Subprocessors page. In summary:

• Stripe keeps your customer and transaction record after you delete your account at CraftCert, because it is separately obliged to keep transaction records for tax and anti-money-laundering purposes (typically seven years in the UK/EU). CraftCert has no authority to shorten that. You can request erasure directly from Stripe, subject to those obligations.
  
  Two things about that record are ours, not Stripe's, and we would rather set them out here. It holds your email address. And if you went through checkout, we wrote your CraftCert account identifier into it — which is the link described in section 8a that lets us work back from an audit entry to a named person. Stripe did not put it there; we did, and we have not yet removed it. That work is in progress.
• Supabase hosts our database, so anything we keep, it stores for us. That includes the categories set out in section 8a — the deletion record, audit log entries, analytics events, and any cancellation reason, feedback or testimonial you wrote. Supabase deletes what we delete, when we delete it; it does not keep a separate copy on its own account, beyond the 7-day rolling backups described in section 8.
• Microsoft 365 hosts our support mailbox, which is also where data-subject requests arrive. If you have emailed us — including to ask for deletion — that correspondence stays in the mailbox after your account is gone, because it is the record that we received your request and what we did about it. Deleting your account does not delete it. Ask us at privacy@craftcert.co.uk if you want it removed as well, and we will do that separately.
• Resend sends our transactional email. It keeps its own delivery logs, which include the address a message was sent to, under its own retention schedule. We do not have an integration that deletes those logs when you delete your account — we previously said we did, and that was not accurate.
• The remaining processors hold only non-identifying aggregate data (GoatCounter) or transient operational data that ages out in days or weeks (Upstash rate limit counters, Sentry error events, Netlify logs).

12. Contact

Questions about retention or deletion? Email support@craftcert.co.uk.

Crocker Digital Ltd, Company No. 17008789