Data Retention and Deletion Schedule

1. Scope and principles

This schedule explains how פרסום מי סטודיו לעיצוב גרפי והפקות דפוס בע"מ, trading as Chat4U, retains information for the Privacy Policy and DPA. Different purposes have different clocks. Closing an account does not erase required invoices; an invoice obligation does not justify keeping unrelated chat content.

We retain personal data only for its applicable purpose, instruction or legal requirement, remove or genuinely anonymize information no longer needed, and restrict any justified longer retention. Pseudonymization or hashing is not anonymization if a person can still be identified. Applicable earlier deletion duties and binding provider requirements prevail over a longer general schedule.

2. Conversations, analysis and media

The default visitor-conversation inactivity period is 90 days, with customer choices of 30, 90, 180 or 365 days where the setting is offered. Each new conversation receives the selected duration. A later settings change applies to subsequently created conversations rather than silently rewriting existing durations.

A newly committed visitor or assistant message resets the inactivity clock; merely opening a conversation, reading it or running background analysis does not. An empty session uses its creation time. At expiry, we remove the conversation and related personal summaries and analysis from active systems, together with linked media and other copies in the applicable deletion scope. A narrowly justified hold or applicable legal requirement can affect that scope. Interrupted cleanup is tracked and retried; a due date is not itself confirmation that every copy has been physically erased.

Earlier records remain subject to applicable instructions, notices, rights and lawful retention limits. They are not exempt indefinitely merely because they predate a setting. We do not retrospectively shorten an existing customer's agreed retention by an undisclosed bulk setting change. A valid earlier deletion request or provider requirement is handled separately.

Customer-specific conversation insights, related social media, transcripts and image descriptions follow the relevant conversation's lifecycle. Moving an insight into another record does not create a new unrestricted retention period. Genuinely anonymous statistics may be retained only where they no longer identify people or permit reconstruction of their information.

3. Account and administrative schedule

We review ongoing necessity at least annually and also act when a deadline, valid request or material change requires earlier action. Annual review does not permit keeping expired data until the next review. Retention can be administered through existing automated controls and controlled manual handling; no particular automation method changes the obligation.

4. Other service records

Where a precise provider or customer-selected retention period is relevant, we provide the applicable information through the service, provider disclosures or privacy support. We maintain category-specific expiry or review rules and remove information when its justified retention ends.

5. WooCommerce expiry and cleanup

The following limits concern particular credentials, permissions or operational records, rather than the merchant's underlying order:

Expired permissions deny access independently of physical cleanup. Minimized unresolved action references, parameter hashes and state may remain as non-executable recovery evidence after secret-bearing material expires, while genuinely necessary to resolve the uncertain operation. They do not authorize replay or private-order access.

Protected plugin cleanup can operate while content synchronization is paused or knowledge is detached. If the plugin is removed or the merchant host is unreachable, merchant action or restored connectivity may be needed to verify host-side cleanup. Chat4U remains responsible for its own copies. A neutral message replaces the supported private order answer in durable Chat4U history, but information independently typed into ordinary chat follows that chat's schedule.

6. Shopify uninstall and other deletion triggers

Covered Shopify Merchant Data, including originals and copies, is deleted within 30 days of the applicable uninstall, no-longer-needed or enforceable-request trigger, except where applicable law prohibits or varies that deletion. The later arrival of a privacy webhook does not restart the clock. A merchant preference to retain history covers only data that can lawfully remain outside the required cleanup.

This requirement covers relevant derivatives and provider/backup copies; ordinary backup rotation cannot extend it. If unable to comply, we make the notification required by Shopify's terms. We do not apply a generic accounting or dispute label to retain unrelated store or conversation content.

7. Return, backups and restoration

At the end of processing, customers can choose required return or deletion under the DPA. Standard secure export and support assistance are available where the dashboard does not cover the required scope. This is not a promise of custom migration, permanent download availability or indefinite storage. The Data Export and Switching Schedule separately provides covered customers with 30 calendar days of secure retrieval after the agreed transition ends, with applicable extensions or longer mandatory periods. This is retrieval of the covered data, not free continuation of running assistants. Ordinary seven-day export-file handling and 15-minute links do not shorten that right: authorized retrieval remains available with necessary reissued links or replacement files. The lawful data needed for retrieval remains protected for that purpose; unrelated records do not gain a blanket longer period. Following successful switching and expiry of the applicable retrieval period, the Schedule's full-erasure rule applies. Deletion-only requests, earlier erasure duties, integration-specific triggers and legally retained records remain subject to their actual scope, applicable exceptions and privacy-law priority; no generic longer clock resolves every case.

Active-system deletion is distinct from removal of protected backup and provider copies. Those copies are isolated from ordinary use and expire under a verified bounded cycle, subject to any stricter legal or contractual deadline. Restoration reapplies erasure before deleted personal information becomes available. We account for supplier-operated copies and do not certify all-copy completion from a local deletion alone.

We do not specify a universal backup-retention number because the applicable storage and service copies can differ. We will provide the relevant category and timing on a scoped request and comply with the applicable obligation; this qualification is not permission for indefinite backups.

8. Holds, independent records and requests

A hold preserves only information necessary for an actual legal requirement, investigation or dispute, with restricted access, a recorded reason and a review/release condition. Once the reason ends, the applicable schedule resumes; it does not automatically start a new seven-year period. A voluntary business preference cannot override a binding processor or provider erasure duty.

Deleting Chat4U information does not cancel an order or erase independent records held by a merchant, Paddle, Shopify, a social platform or a customer-selected system. We explain the boundary and assist within our role rather than claiming those records are gone.

Contact privacy@chat4u.ai for retention or deletion questions. See Privacy Rights for locating a chat, verification, response periods and complaints. We distinguish a received request, access restriction, incomplete cleanup and verified completion.