Data Retention & Deletion Policy
Effective date: April 1, 2026
This policy describes how long Qhubio retains different types of data and what happens when data is deleted — whether automatically by the system or at your request.
1. Uploaded Source Documents
Automatic deletion after processing
Source documents (PDF, DOCX, XLSX, PPTX, TXT) uploaded for FMEA generation are strictly temporary. They are stored in a private storage bucket scoped to your user and job ID. Once the FMEA generation reaches "done" status, all uploaded files for that job are automatically and permanently deleted from storage.
If you delete a job from your history before generation completes, the associated storage folder and all files in it are also removed.
2. Generated FMEA Records
FMEA records (rows, metadata, moderation data) generated by the platform are retained in the database as long as your account is active. You can delete individual FMEA jobs from your history at any time, which removes all associated rows and metadata.
3. Audit Data
Audit records, answers, evidence files, and findings are retained as long as your organization account is active. Deleting an audit removes all associated answers, evidence, and findings.
4. Account Data
Your account information (email, profile, organization membership) is retained while your account is active. You can request account deletion at any time.
5. Account Deletion
You can permanently delete your account from the Dashboard. This is an irreversible action that requires typing "DELETE" for confirmation. The deletion process removes:
- All files in your storage bucket (fmea_uploads).
- All FMEA rows and document records from the database.
- Your user profile and terms acceptance record.
- All FMEA job records.
- Your authentication record from the identity provider (Supabase Auth).
After deletion, you are logged out and redirected to the homepage.
6. Backups
Important: Deleted data may persist in encrypted database backups for up to 30 days. These backups are used solely for disaster recovery and are not accessible through the application. After the backup retention period, the data is permanently purged.
7. Analytics & Logs
Aggregated analytics data (page views, feature usage) collected via Google Analytics is retained according to Google's data retention settings. This data is anonymized and cannot be used to identify individual users.
Server-side logs (e.g., edge function invocation logs) are retained for a limited period for debugging purposes and are automatically rotated.
8. Summary Table
| Data Type | Retention | Deletion Trigger |
|---|---|---|
| Uploaded documents | Until generation completes | Automatic |
| FMEA records | While account active | User or account deletion |
| Audit data | While org active | User or audit deletion |
| Account data | While account active | Account deletion |
| Backups | Up to 30 days post-deletion | Automatic rotation |
9. Contact
For questions about data retention or to request data deletion, contact info@qhubio.com.