Data HQ Data Retention Schedule: VistaConnect and BlogPilot
Version: 3.1 Effective date: 2026-10-26 Owner: Data HQ Limited Review cycle: Annually, or on material platform change
This schedule sets out how long Data HQ retains different categories of data processed through the VistaConnect platform and the BlogPilot content service. It is referenced by, and forms part of, the VistaConnect Non-Disclosure Agreement (NDA) and the Data HQ Privacy Notice, and is referenced by the BlogPilot Terms of Service and the BlogPilot Data Processing Agreement. It is published at vista.datahq.co.uk/legal/retention and is also linked from the BlogPilot website (blogpilot.datahq.co.uk).
Retention table
| # | Category | What it contains | Retention | Basis | How it's enforced |
|---|---|---|---|---|---|
| 1 | Data Audit: uploaded files | The rows parsed from CSVs you upload to run a matching/enrichment job (company names, addresses, postcodes, contact details if provided) | 30 days from job completion, or sooner if you delete the audit yourself in Job History | Business necessity: auditors typically re-download or iterate within 30 days | Automated: cleanup_expired_jobs daily task deletes jobs older than 30 days; cascades to results and purchased contacts, and to everything derived from the audit (see #2a). We email the person who ran the audit to confirm the deletion, with the date by which backup copies age out |
| 2 | Data Audit: job results | The matched company data returned against your upload | 30 days (same as source job) | Linked to #1 | Cascade delete from the job record |
| 2a | Data Audit: data derived from an audit | Look-alike runs made from the audit, your duplicate-grouping decisions, the classification of company names from your file that our duplicate check had to ask about (see the Sub-processor List), and copies of contact details removed from the audit under our Global Suppressions screening | Deleted with the audit (#1). A classification shared by several of your audits goes with the last of them | Linked to #1 | Automated: deleted in the same step as the audit; a daily task also removes any classification left with no audit after one day |
| 3 | Find Look-alikes / ICP: uploaded files | The raw CSVs uploaded to profile your customer base | Not persisted. Rows are parsed in-memory, matched, used to derive filters, and discarded at end of request. Only the matched site URNs (not your uploaded names/postcodes) are stored on the resulting saved list. | Data minimisation (GDPR Article 5(1)(c)) | Code behaviour: upload endpoint does not write raw rows to any table or blob |
| 4 | List Builder: saved drafts | Filter selections, chosen fields, list name (no personal data of third parties) | Until you delete the list, or until account closure, whichever is sooner | User-controlled | Manual via UI; cascade delete on account closure |
| 4a | List Builder: assistant conversations | The messages you exchange with the List Builder assistant, and the filter proposals it makes, so that a session can be re-opened | 12 months | Contract performance: needed to provide the assistant and let you return to a session | Deleted automatically when older than 12 months, and as part of account closure |
| 5 | List Builder: purchased lists | The site URNs (and contact URNs where contacts are included) representing companies you purchased access to | 24 months from the purchase date | Typical B2B list-usage cycle: purchasers download, enrich and outreach over 6 to 18 months, with occasional reference over the following 6 months. After 24 months the data is materially stale and the list has limited continuing commercial value. Longer retention is not justified against data-subject interests. | Automated: daily scheduler task deletes purchased lists with purchase_date older than 24 months; cascades to list_builder_results and list_builder_contact_results |
| 5a | List Builder: your suppression lists | Keyed one-way hashes of email addresses and telephone numbers, plus website domains and company registration numbers, from files you upload. The uploaded file itself is not stored. | Until you delete the list, the expiry date you set, or account closure, whichever is soonest | Needed to exclude those records from your Lists at your instruction | Delete in Settings (immediate, hard delete). Automatic on expiry. Cascade delete on account closure. Uploads and deletions are logged without their contents. |
| 6 | Shared Audit links | A read-only share token that lets a recipient view an audit report without an account | Token valid for lifetime of the parent audit job (30 days). When the job is deleted, the token stops working. | Linked to #1 | Cascade on job deletion |
| 7 | Your account: identifying details | Email, name, hashed password, client/company name, signup source, verification status | Until you request deletion | Contract performance | User self-serve deletion available in Settings → Delete account. Scheduled hard-delete after 7-day grace period |
| 8 | Credit balance + transactions | Records of credit purchases, consumption and monthly allocation | Up to 7 years from the end of the accounting period to which the record relates | UK tax and accounting law (HMRC) | Retained via legal obligation; not deleted when an account is closed. Automated archival/purge after statutory period |
| 9 | Payment records (Stripe) | Stripe payment intent IDs, invoice IDs, amounts, VAT, payment status | Up to 7 years | UK tax and accounting law (HMRC) | As #8 |
| 10 | Usage logs | A record of which API / portal features your account used, when, and how many credits were consumed | 24 months rolling, or until account closure if sooner | Operational and fraud monitoring, billing audit and credit-dispute resolution (legitimate interest) | Automated rolling purge at 24 months; remainder deleted as part of account closure. Where your account has a lifetime usage limit, the records needed to measure it are kept while that limit applies. Aggregated / anonymised statistics may be retained per row 14 |
| 11 | Container / application logs | Operational logs (request traces, error messages, performance metrics). These do not contain customer-uploaded data but may contain email addresses of logged-in users and request IDs | 30 days standard; 90 days for audit-flagged events | Operational security | Azure Log Analytics retention policy |
| 12 | Database backups | Point-in-time backups of the full production database | 7-day rolling window | Business continuity | Azure Flexible Server automated backups. See Backups and the right to erasure below. |
| 13 | BlogPilot content (if used) | Draft articles, conversations, brand voice configuration you create within BlogPilot | Until you delete, or until account closure | User-controlled | Cascade on account closure |
| 13a | BlogPilot website access details | Encrypted CMS credentials (for example a WordPress Application Password or Craft CMS token) | Until you disconnect your website, or until account closure | Needed to publish at your instruction | Self-serve disconnect in Settings deletes them immediately; on request to support@datahq.co.uk within 5 working days; cascade delete on account closure |
| 13b | BlogPilot website tracking data (held as processor) | Page view and time-on-page records from the tracking script on your website, as listed in Annex 1 of the BlogPilot Data Processing Agreement | For as long as your account is open | Controller's instruction under the BlogPilot Data Processing Agreement | Deleted within 30 days of a deletion request; cascade delete on account closure, after the 7-day closure grace period |
| 13c | BlogPilot demonstration requests | Details of people who ask for a BlogPilot demonstration by email and do not become customers, held in our Microsoft 365 email and business systems | 24 months from last contact | Steps before a contract, and legitimate interest | Deleted at the end of the period |
| 14 | Anonymised / aggregated data | Statistics about how VistaConnect and BlogPilot are used in aggregate (e.g. number of jobs run per month, average list size), with no link to any individual client or user | Indefinite | No personal data involved once irreversibly aggregated (GDPR Recital 26) | Retained in aggregate form only |
What "deletion" means in practice
When data is deleted under this schedule:
- Live database: rows are permanently removed via SQL
DELETE, usually cascaded from a parent record. - Backups: deleted data remains in backups for up to 7 days while the backup window rolls forward. We cannot excise records from a backup snapshot without restoring, editing and re-snapshotting, which would compromise the integrity of the backup.
- Container logs: logs roll off the standard Azure retention window (30 days) independently of database deletion.
Backups and the right to erasure
If you exercise your right to erasure under UK GDPR, your data is removed from our live systems within 24 hours. Your data may persist in automated system backups for up to 7 additional days while the backup window rolls forward. During that period the data is not accessible for operational use and will be automatically aged out. If you have specific concerns requiring confirmation of backup ageing, email legal@datahq.co.uk and we will confirm the date by which residual backup copies will have been deleted.
Account closure
On request, or when an account is closed, we will delete:
- your user record (
users); - your client / organisation record (
api_clients); - your account-to-user link (
user_client_access); - your audit jobs and results (
bulk_enrich_jobs,bulk_enrich_results,bulk_enrich_contacts), and the data derived from them (row 2a); - your saved and purchased lists (
list_builder_lists,list_builder_results,list_builder_contact_results); - your List Builder assistant conversations;
- your BlogPilot content (all
blog_bot_*tables), including stored website access details and BlogPilot website tracking data; - your usage logs (
api_usage_log); - your credit ledger (
credit_transactions), except where retention is required for tax purposes under items 8 and 9 above.
We retain, for the statutory period, records required by UK tax and accounting law (invoices, payment history, VAT returns). These records are retained under legal obligation and are not subject to earlier deletion.
When the deletion is complete we email the account's administrator to confirm it, listing the Data Audits deleted and the date by which backup copies age out.
Requesting earlier deletion
You can delete a Data Audit yourself at any time from Job History. It is deleted straight away, with the data derived from it (row 2a), and we email you to confirm.
You can request that Data HQ deletes your Confidential Information before the retention period expires, by emailing legal@datahq.co.uk. We will comply within 24 hours of receipt of the request, subject to the statutory exceptions above. For BlogPilot website tracking data, the deletion period in the BlogPilot Data Processing Agreement (30 days) applies.
Version history
| Version | Date | Notes |
|---|---|---|
| 1.0 | [draft] | Initial schedule |
| 2.0 | 2026-04-22 | Added basis column; clarified backup persistence on right-to-erasure; aligned HMRC wording with "up to 7 years" |
| 2.1 | 2026-09-26 | Added row 5a: your List Builder suppression lists |
| 3.0 | 2026-09-29 | Retitled "Data HQ Data Retention Schedule: VistaConnect and BlogPilot" and extended to BlogPilot. Row 13 renamed from Blog Bot to BlogPilot. Added rows 13a (BlogPilot website access details), 13b (BlogPilot website tracking data, held as processor) and 13c (BlogPilot demonstration requests). Added row 4a (List Builder assistant conversations, kept for 12 months). Account closure list updated to match. |
| 3.1 | 2026-10-26 | Row 2a added: data derived from a Data Audit (look-alike runs, duplicate-grouping decisions, company-name classifications and Global Suppressions copies) is deleted with the audit. Rows 1 and 7 / Account closure: we email you to confirm a deletion. Row 1: you can delete an audit yourself. Row 10: records needed for a lifetime usage limit are kept while it applies. |