This Data Retention Policy explains how ForgeAI Studio, trading as NovaStacks ("we", "us", "our"), retains and deletes personal and business data. It should be read together with our Privacy Policy.
ForgeAI Studio is a company registered in England & Wales (Company Registration Number 17175307). The only channel for contacting us about this policy is email: support@novastacks.co.uk.
1. Purpose and Scope
This policy sets out the principles we apply when deciding how long to keep data, the indicative periods for which we retain different categories of data, and how data is securely deleted once it is no longer needed.
It applies to personal data and business records that we hold in connection with our website, our enquiries and client relationships, and the software platforms and services we provide, including HookPilot, GuardFlowApp, FleetFlowApp / FleetFlowTech, AutoLeadCall and GrowthDept / GrowthPilot.
2. Our Retention Principles
We follow a small set of consistent principles:
- Retain only as long as necessary. We keep data only for as long as it is needed for the purpose for which it was collected, or for as long as we are required to keep it to meet a legal, regulatory, accounting or contractual obligation.
- Purpose limitation. Data is retained to fulfil a defined purpose. When that purpose has been met and no other lawful basis for retention applies, the data is deleted or anonymised.
- Proportionality. Retention periods are set proportionately, balancing operational need, the rights of individuals, and our statutory duties.
- Security throughout the lifecycle. Data is protected by appropriate technical and organisational measures for the whole of its retention period, up to and including the point of secure deletion.
- Review. We review the data we hold from time to time and remove information that is no longer required.
Where a specific legal obligation requires a longer or shorter retention period than the indicative periods below, the legal obligation takes precedence.
3. Indicative Retention Periods
The periods below are indicative. Actual retention may vary where a longer period is required by law, where data is needed to establish, exercise or defend legal claims, or where an ongoing relationship or obligation justifies continued retention.
3.1 Enquiry and Contact Data
Information you provide when you contact us through our website or by email — such as your name, email address, and the content of your enquiry — is retained for as long as is needed to respond to and manage your enquiry, and for a reasonable period afterwards to maintain a record of our correspondence. Where an enquiry does not lead to an engagement, this data is deleted once it no longer serves any business or record-keeping purpose.
3.2 Client and Project Records
Records relating to client engagements — including project documentation, specifications, correspondence, configurations and deliverables — are retained for the duration of the engagement and for a reasonable period afterwards. This supports ongoing support and maintenance, contractual obligations, warranty and continuity needs, and the establishment or defence of legal claims. Where these records form part of, or evidence, a financial transaction, the financial-records period in section 3.3 also applies.
3.3 Financial and Accounting Records
Financial records — including invoices, payment records, contracts with financial terms, and related accounting documentation — are retained in line with UK statutory requirements. This typically means a retention period of approximately six years from the end of the relevant accounting period or financial year, in order to meet our tax, accounting and company-law obligations.
3.4 Marketing Consent and Communications
Where you have consented to receive marketing communications from us, we retain your contact details and a record of your consent until you withdraw that consent or unsubscribe. You can withdraw consent at any time, after which we cease using your details for marketing and remove them from our marketing lists, retaining only the minimal record needed to evidence that you opted out and to honour your preference.
3.5 Website Analytics Data
Analytics data relating to how our website is used is retained only for as long as it is useful for understanding and improving the performance and content of our website. Such data is held in aggregated or de-identified form where practicable and is retained on a rolling basis, with older data removed once it no longer serves an analytical purpose.
3.6 Account and Platform Data
Where you use one of our software platforms, account and operational data is retained for the duration of your use of the service and in accordance with the applicable service agreement. Following the end of a service, data is retained only for the period needed to complete off-boarding, meet legal and accounting obligations, and allow for any data export or deletion that has been agreed, after which it is securely deleted or returned as appropriate.
4. Secure Deletion
When data reaches the end of its retention period, or when we are required to delete it on request, we dispose of it securely.
- Electronic data is deleted, overwritten, or otherwise rendered irrecoverable using appropriate technical measures.
- Where deletion is not immediately practicable — for example, in routine backups — data is isolated from active use and removed in the ordinary course of our backup and deletion cycles.
- Where retention of statistical or analytical insight is appropriate, data may instead be anonymised so that it can no longer be associated with an identifiable individual.
- We apply equivalent standards to any third-party service providers who process data on our behalf, requiring them to delete or return data in line with this policy and our agreements.
5. Requesting Deletion of Your Data
You may ask us to delete personal data we hold about you. To make a request, please email us at support@novastacks.co.uk.
When you contact us:
- We may ask you to confirm your identity before acting on a request, in order to protect your data.
- We will respond within the timeframes required by applicable data protection law.
- We will delete the data unless we are required or permitted to retain it — for example, to meet a statutory obligation such as the financial-records requirement described above, or to establish, exercise or defend legal claims. Where we cannot delete certain data, we will explain why and, where appropriate, restrict its further use.
6. Changes to This Policy
We may update this policy from time to time to reflect changes in our practices or legal obligations. The "Last updated" date at the top of this page indicates when the policy was last revised. Any material changes will be reflected on this page.
7. Contact
If you have any questions about this Data Retention Policy or how we handle your data, please contact us by email:
ForgeAI Studio (trading as NovaStacks) Email: support@novastacks.co.uk Website: https://novastacks.co.uk