Retention & Deletion Policy

This policy sets out what CraftCert keeps, where it is held, for how long and why, and how it is deleted. Section 1 is the summary. The sections after it explain how deleting, restoring and erasing an account work, and what survives a deletion.

1. What we keep and for how long

2. Deleting individual products

When you delete a single product from your dashboard, it is immediately hidden from your product list and from every view in the application. The row itself is kept in the database with a deletion timestamp, so support can recover it on request. Deleted products are not subject to the 90-day account-purge cycle described below — they remain recoverable as long as your account exists.

3. Deleting your account

You can delete your entire account in two ways:

• Self-service: go to Settings > Delete account in your dashboard, type DELETE to confirm, and submit. That does not delete anything on its own: we email you a confirmation link, and the deletion starts when you click it. The link is valid for 30 minutes, and the same email carries a link to cancel instead.
• By request: email support@craftcert.co.uk. We will acknowledge your request within five working days and action it within 30 days of verifying your identity.

Both paths trigger the same technical flow described in the next section.

4. What happens when you delete your account

Account deletion is a two-stage process. It is not instantaneous, and it is reversible within the first stage.

Stage 1 — Immediate soft-deletion (day 0)

The moment you confirm deletion, CraftCert does the following:

• Your profile is marked deleted in our database with the exact UTC timestamp of your request. We call this T₀.
• Your Supabase authentication record is suspended, so no-one (including you) can sign in using your credentials.
• Open browser sessions on other devices stop being able to access any of your data within roughly one hour (the maximum lifetime of an authentication token). They cannot view, edit, or export anything. The browser tab itself may continue to render until you close it, but every action returns an empty result.
• Row-level security rules hide every row you own (products, formulations, labels, evidence, ingredients) from the application, so nothing signing in as a user — you, or support acting under your session — can reach them. The data still exists in the database. Our server-side systems — the scheduled jobs that run this deletion process, and the administrative tooling behind them — connect with a privileged key that bypasses row-level security by design; that is how the permanent deletion at stage 2 is able to happen at all. Access to that key is limited to CraftCert's own server-side code and to the sole director of Crocker Digital Ltd.
• Any active paid subscription is cancelled immediately with no proration and no final invoice.
• An account_soft_deleted entry is written to our audit log, recording T₀ and the scheduled permanent-deletion instant T₀ + 90 days.

Stage 2 — Permanent deletion (day 90)

A scheduled job runs every day at 03:17 UTC. Each run looks for accounts whose 90-day window has elapsed and permanently deletes them.

Permanent deletion removes your authentication record, profile, products, formulations, ingredients, labels, evidence records, and any supplier documents you uploaded, from our production systems.

Audit log entries survive, because we need a record of what actions were taken on the system and when. Immediately before your account is removed, we strip the identifying content out of those entries: the email address, the product names you entered, and any ingredient names captured in them. Your user identifier is removed as well — by the database, as part of the deletion itself.

What remains on each entry is the action, its timestamp, an internal reference to the record it concerned, and a fixed list of other details — things like product type, hazard classification, counts of ingredients or warnings, and the dates of account events such as when deletion was requested. These remaining entries are not anonymous; section 8a explains why. We work from that fixed list of what may stay, rather than a list of what to remove, so a field added to the audit log in future is stripped at deletion unless it has been reviewed and added deliberately, rather than kept until someone notices it.

Two items on that list point to people or records outside the entry. Where a member of our staff acted on your account — restoring it, for example — the entry keeps that person's internal identifier, so the record of who did what survives; that identifies our operator, not you. And entries for payments keep references to the corresponding records at Stripe. We keep those because they are financial records we are obliged to retain, not because they are anonymous.

5. The 90-day timer — exact math

We promise that you have a full 90 days to change your mind. The timer is measured in UTC and is exact to the second.

• Start (T₀): the UTC instant at which you confirm the deletion by clicking the link in the email we send when you ask to delete. That instant — not the moment you pressed Delete in Settings — is the one we record.
• Restore-by instant (T₀ + 90 days): the exact UTC instant after which the scheduled purge is permitted to permanently delete your data. We store it against your account alongside T₀.
• Actual purge time: the next scheduled run after the restore-by instant. The purge runs daily at 03:17 UTC, so in the worst case your data is retained up to ~24 hours longer than the restore-by instant — never shorter.

We do not send you an email once the deletion has gone through. You click the link, we take you to a page confirming it, and nothing further arrives — so if you want to be told your exact T₀ and restore-by instant, email privacy@craftcert.co.uk and we will look them up for you.

Worked example. You confirm your deletion on 1 June 2026 at 14:22 UTC. Then:

• T₀ = 2026-06-01 14:22 UTC
• Restore-by instant = 2026-08-30 14:22 UTC (exactly 90 × 24 hours later)
• Actual permanent-deletion run = 2026-08-31 03:17 UTC (the first scheduled purge after the restore-by instant)
• Window during which support can restore your account: 2026-06-01 14:22 UTC to 2026-08-30 14:22 UTC. After the restore-by instant, a restore request may still succeed if the 03:17 purge has not yet run, but we do not guarantee it.

6. Restoring a soft-deleted account

To restore during the window, email support@craftcert.co.uk from the email address associated with the account. We will:

• Verify your identity (typically by confirming details from your account — last subscription, number of products, approximate signup month).
• Unsuspend your authentication record and clear the deletion flag on your profile, which re-opens row-level access to your data.
• Write an account_restored audit entry attributing the restoration to the support operator.
• Email you to confirm the account is live again, usually within one working day of receiving the request.

Your subscription is not automatically restored. When your account comes back, it is on the Free tier. If you want a paid plan again, subscribe through Pricing in the normal way. Your Stripe customer record is preserved, so billing history continues on the same record.

Product-level deletions stay deleted. If you had soft-deleted a specific product before you deleted your account, that product stays deleted when the account is restored — we only reverse the account-level deletion.

7. GDPR Article 17 — Right to erasure

The soft-delete window is a restoration convenience, not a delay to your statutory rights. If you want an immediate hard deletion with no 90-day restoration window, explicitly request this in writing to support@craftcert.co.uk — for example, “I am exercising my right to erasure under UK GDPR Article 17 and require immediate permanent deletion with no 90-day window.” We will:

• Acknowledge your request within five working days.
• Complete the permanent deletion within 30 days (or explain any delay, where a delay is permitted by the regulation — for example, if we are subject to a legal obligation to retain specific records).
• Confirm the deletion in writing once complete.

8. Backups

CraftCert's database is backed up by our hosting provider (Supabase) on a 7-day rolling retention. When we permanently delete your account at day 90, the production record is gone immediately; any reference to your data in rolling backups is removed naturally as those backups age out within seven days.

We do not take long-term snapshots and we do not copy production data to cold storage.

8a. What survives the deletion of your account

The table in section 1 shows what is kept after your account is permanently deleted. This section gives the detail.

The deletion record

When the day-90 deletion in section 4 completes, our system writes a single minimal record that the request was made and completed: a reference number, the email address the account used, the date and time you asked, the date and time it completed, and whether it succeeded. An immediate erasure requested under section 7 is carried out through the same controlled process, operated by an administrator, and the same record is written automatically as part of it. Its only purpose is so that we can show we honoured your request if the question is ever raised — by you, or by the Information Commissioner's Office. It is held in a separate table that no signed-in user or browser can read, and it does not contain your formulations, products, ingredients, labels, evidence records or correspondence. It also does not contain your account identifier. That does not stop it being matched to the audit log entries described in section 4, though: some of those entries record the same moments — when the deletion ran, and for the day-90 deletion also when you asked — so the two can be lined up on those times.

We keep it for 12 months from the date the deletion completes, and it is then deleted automatically by the same daily job that performs the deletions — the period is enforced in code, not left to us to remember. Our lawful basis is our legitimate interest in being able to demonstrate that we handled your request properly (UK GDPR Article 6(1)(f)), for the purpose recognised by Article 17(3)(e).

This record is personal data. If you would like to know whether one exists for you, or to ask us to justify keeping it, email privacy@craftcert.co.uk.

Audit log entries

What remains on each entry is described in section 4: the action, its timestamp, an internal reference, and the details listed there. These entries are not anonymous, for three reasons.

• Entries that record a payment keep references to the matching records at Stripe, and we could use those to look you up in our Stripe account. We keep them because they are financial records we have to retain.
• For account-level events, the internal reference is the account's own internal identifier. For anyone who has been through checkout, we store that same identifier against their customer record at Stripe, which also holds their email address. So we could work back from an audit entry to a named person by going through our own Stripe account, for as long as Stripe keeps that record — around seven years. This applies to paying and previously-paying customers. We are working on removing that identifier from Stripe as well.
• The deletion record described above holds your email address for 12 months. It is deliberately written without your account identifier, so it adds no link of the kind just described, but it can still be matched to these entries by time, as explained above.

Product analytics events

We record which parts of CraftCert were used and when, so we can see where people get stuck. These rows are not deleted when your account is; your user identifier is removed from them, and what is left is the event name, the time, and settings and counts such as product type or number of ingredients. They contain no free text, no names and no email addresses.

Until 29 September 2026, events recorded while a visitor was not signed in also stored the network (IP) address they came from. Since that date we no longer store the address. In its place, such an event carries a code worked out from the address, the date and a secret key that we hold. The code stands for a network address, not a person: several people sharing one home or office connection get the same code, and someone whose address changes gets a different one. An address's code also changes every day, so the stored codes do not, on their own, connect one day's events to another's. They are not anonymous, though: anyone holding the key — which means us — could take a particular address, work out its code for any day, and so find that address's events on one day or across several. That is why we treat these codes as personal data. On the same date we replaced the address in every earlier event with a similar daily code, made with a key that was used once and then destroyed, so those older codes cannot be traced back to an address by anyone, including us. The old addresses remain only in the rolling backups described in section 8, until those age out.

Your words in cancellations, feedback and testimonials

If you gave us a written reason when cancelling, sent us feedback through the app, or gave us a testimonial, those words are removed when your account is permanently deleted, along with any name you attached to the testimonial. The database does this itself, as part of the deletion. What stays is the part of each record that is not your words — for a cancellation, a category label from a short fixed list (anything else is replaced) and its date; for feedback, its type and any score. The reference to your subscription at Stripe is removed as well, so the cancellation record no longer carries a link to your Stripe record. This has applied since 29 September 2026. When we put it in place, we checked and found no earlier deletion that had left any such words behind.

Waitlists and what this section covers

Waitlists are separate. If you joined the cosmetics or toys waitlist, that entry is not part of your account — you did not need one to join. So deleting your account does not remove it: the email address you gave, anything you wrote in the “what would help most” box, and the browser details recorded at signup all stay until you ask us to remove them. Email privacy@craftcert.co.uk and we will.

What this list covers. The categories set out above are the ones that survive in our own database— the one CraftCert runs and controls. In our own database, those categories, the deletion record described above, and any waitlist entry are what remain once the 90-day window and the 7-day backup cycle have both elapsed. Everything else — your account, products, formulations, ingredients, labels and evidence records — is gone from our database.

What our suppliers keep, and what you can ask them or us to remove, is set out in the table in section 1 and in section 11. Stripe, Microsoft 365 and Resend each hold records on their own schedules, and deleting your CraftCert account does not by itself remove any of them.

9. Data export

You can export every product, formulation, label, and evidence record as a single JSON file from Settings > Export all data in your dashboard. Export is also available on request via support@craftcert.co.uk. The export satisfies the UK GDPR right to data portability.

10. Cancelled subscriptions

Cancelling a paid subscription is not the same as deleting your account. If you cancel, your account is downgraded to the Free tier at the end of the current billing period; your data is preserved and accessible; you can re-subscribe at any time without restoring anything. The 90-day clock only starts when you explicitly delete the account.

11. Third-party processors

Some data is held by third-party processors on our behalf (Stripe, Resend, Sentry, Netlify, Upstash, GoatCounter, Supabase). Each processor has its own retention schedule, summarised in the table in section 1. We cover this in the Privacy Policy and list every processor on the Subprocessors page. Two of them need more than a table row:

• Stripe. Your Stripe record holds two things that come from CraftCert: your email address and, if you went through checkout, your CraftCert account identifier, which we wrote into it. That identifier is the link described in section 8a that lets us work back from an audit entry to a named person. We have not yet removed it; that work is in progress.
• Supabase hosts our database, so anything we keep, it stores for us. That includes the categories set out in section 8a — the deletion record, audit log entries, analytics events, and what remains of any cancellation reason, feedback or testimonial once your words are removed. Supabase deletes what we delete, when we delete it; it does not keep a separate copy on its own account, beyond the 7-day rolling backups described in section 8.

12. Contact

Questions about retention or deletion? Email support@craftcert.co.uk.

Crocker Digital Ltd, Company No. 17008789