Data Retention and Deletion
Effective 20 September 2026
This describes what Cycle keeps, for how long, and what removes it. It expands on the privacy policy, which it does not replace.
Two parties are involved, and the distinction runs through everything below. We operate Cycle and control the platform. A subscribing company controls the records of its own business and its own customers. We do not decide what a company should keep.
The principles
- A company’s operational history is kept while the account is active. Invoices, payments, visits and customer records are what the business is made of. Nothing expires on a timer.
- Withdrawal is recorded, not erased. Where an upstream system removes something, we flag our copy and keep it, because reports that already counted it would otherwise silently change.
- Credentials are the exception. Tokens and secrets are removed the moment they stop being needed.
- Deletion is a request a company makes, not something that happens by accident.
What we keep, and for how long
| Data | Retention | What removes it |
|---|---|---|
| Customers, sites, assets, visits, field slips | While the account is active | Deletion request; 90 days after the subscription ends |
| Invoices, estimates, payments, credits | While the account is active | Deletion request; 90 days after the subscription ends |
| Catalogue items, pricing, users, technicians | While the account is active | Deletion request; 90 days after the subscription ends |
| Photographs | While the account is active | Deleting the photo removes the image itself, not only the record of it |
| QuickBooks access and refresh tokens | Until disconnect or replacement | Disconnecting; token rotation |
| Sign-in sessions | 7 days | Expiry; signing out |
| Sync events, error reports, assistant usage counts | 12 months | The daily sweep; deletion request |
QuickBooks specifically
- Disconnecting deletes nothing but the credentials. The stored tokens are removed immediately. Imported customers, invoices and payments stay: disconnecting is not a request to erase a company’s accounting history, and treating a mis-click as one would be unrecoverable.
- Records deleted in QuickBooks are flagged, never removed. They are excluded from balances but retained, so a report that already counted an invoice still reconciles.
- A payment outlives the invoice it was applied to, mirroring QuickBooks, where deleting an invoice with a payment against it leaves the payment as unapplied credit on the customer’s account.
- Deleting a company from Cycle never deletes anything in QuickBooks. Those books belong to the company.
What we do not keep
- Full card numbers. They go directly to Stripe and never reach us.
- Assistant questions and answers. We record how many tokens an exchange used, for billing. The question asked and the answer given are not stored.
- Raw QuickBooks webhook payloads. We record what changed and act on it; the payload itself is not retained.
Deletion
Cycle is a private application with a small number of subscribing companies. Deletion is handled directly rather than through a self-serve control: write to support@cycleback.net. A request is actioned within 30 days.
When a subscription ends, data is kept for 90 days so it can be exported or the account reinstated, and is then deleted. A company may ask for deletion sooner.
Both are carried out by a sweep that runs daily. Deleting a company removes its photographs and signed agreements from storage as well as its records, and each deletion is logged so that we can show it happened when we said it would.
Two limits worth stating
- Backups. Database backups are held by our hosting provider and are not selectively editable. Deleted records may persist in a backup until it ages out.
- Other providers keep their own copies. Removing data from Cycle does not remove it from QuickBooks, Stripe, Resend or AWS, each of which retains according to its own terms and its own relationship with the company. The privacy policy lists them.
Changes
We will update this page and revise the effective date. Material changes will be notified to subscribing companies directly.