Data Retention & Deletion Policy

Vivus keeps personal data only as long as needed to run the service, meet legal requirements, maintain security, preserve consent evidence, and handle support or disputes. The canonical retention schedule is part of the Privacy Policy.

• Account and workspace data — kept as long as your account is active, unless you ask us to delete it sooner.
• Financial records — royalty statements, transactions, and related data may be kept longer when required for tax or legal compliance.
• Bank connections — when you disconnect a linked bank account, we remove the connection credentials immediately.
• Connected integrations (Google, social platforms) — when you disconnect a Google integration (Calendar, YouTube, Google Ads, or the Drive picker) or a social account, or when you delete your account, we revoke the access grant with the provider and delete the stored tokens. You can also revoke Google access yourself at myaccount.google.com.
• Security logs — retained on a rolling basis depending on how critical they are, then automatically purged.

When you request deletion, Vivus verifies your identity, checks for any legal holds, then permanently removes or anonymizes your data. Some deleted data may remain in encrypted backups until those backups naturally rotate out.

Vivus responds to verified deletion requests without undue delay, within 30 days where GDPR applies and within 45 days where California privacy law applies, unless a permitted extension or legal exception applies. If we need more time where the law allows it, we will notify you within the initial response period and explain the reason. Account closure starts a 30-day reactivation window. After that period, eligible account data is purged or anonymized, while limited records may be retained where required for legal obligations, tax or accounting records, security, fraud prevention, dispute resolution, regulatory obligations, legal claims, or backup rotation.

To request deletion, email contact@releaseledger.com.