Principles
We keep data only as long as it is needed for the reason it was collected, or as long as the law requires, and then delete it or make it anonymous. This policy sets out the periods for each kind of data.
Who decides
For an organization's records in Nootus, the organization is the data fiduciary and decides how long they are kept, within the statutory minimums below. Nootus keeps them on the organization's instruction. For website enquiries, analytics and our own records, Nootus decides.
Retention periods
Unless an organization instructs a longer period, or the law or a pending proceeding requires one:
- Books of account, vouchers and filed-return records: 8 years from the end of the financial year for companies, and 6 years from the end of the assessment year for others, in line with the Companies Act, 2013 and the Income-tax Act.
- Activity log for books and filed periods: kept with the records it relates to, for at least 8 years. It cannot be switched off.
- Messages on WhatsApp, email and the portal, and the files attached: while the organization's account is open, or for the period the organization sets.
- Password vault entries: until the organization removes them or closes its account. The log of vault views is kept for 8 years.
- Records of AI work (what each agent did, for which request, reporting to whom): kept with the records they relate to.
- Questionnaire answers and uploaded documents: while the organization's account is open, or for the period the organization sets.
- Website enquiries from our demo and partner forms: 24 months from our last contact with you, then deleted.
- Website analytics in Google Analytics 4: 14 months.
- Security and access logs: at least 180 days, kept in India, as CERT-In directions require.
- Backups: overwritten on a rolling cycle of up to 30 days.
- Billing and tax records of our own: 8 years.
Trials and lapsed plans
When a trial or paid plan ends, the account moves to Free and paid features become read-only. Nothing is deleted. If an account stays unused for 24 months after its plan lapses, we will write to the organization and give 30 days' notice before deleting it.
When an organization leaves
When an organization closes its account, it can export its data for 30 days. We then delete the organization's data from the live service within 90 days, and from backups as they roll over, except records the organization asks us to keep for the statutory period or the law requires us to keep.
Deletion requests
To have your data deleted, write to privacy@nootus.ai. If your data is in an organization's records, we will pass your request to that organization, which decides as fiduciary. We will not delete records the law requires to be kept, and we will tell you why.