Legal
Data Retention Policy
Last updated: 30 August 2026 Purpose: states, for every category of data AMT holds, how long we keep it and why.
Data we control (AMT is the data controller)
| Data | Retention | Then what |
|---|---|---|
| Marketing/outreach contact records (CRM) | 12 months from last contact/engagement | Deleted, or reduced to anonymous aggregate stats |
| Website contact-form submissions | 12 months, or until resolved + 90 days if it became a support/sales conversation | Deleted |
| LeadView tenant account/user data (login, role, name, work email) | Duration of the subscription | On termination: 30 days' grace for export, then deleted or anonymised |
| LeadView billing records | 6 years (UK HMRC requirement for business records) | Archived, then deleted |
| Session/auth logs, audit trail (who did what in LeadView, for security) | 12 months rolling | Deleted on a rolling basis |
| Support/correspondence emails | 3 years from last message in a thread | Archived or deleted |
Data we process on a client's behalf (AMT is the processor; the client is the controller - see the Privacy Policy §5)
| Data | Retention | Then what |
|---|---|---|
| Uploaded/connected financial data (bank statements, transactions, P&L outputs) | For the life of the subscription, per the client's own instructions | Within 30 days of contract termination: exported to the client if requested, then permanently deleted |
| Connected-account OAuth tokens (Google, Meta) | While the connection is active | Revoked and deleted immediately on disconnect or account termination |
| Marketing/analytics snapshots (GA4, Meta, Google Business Profile) | Rolling window matching the product's reporting horizon | Purged alongside financial data above at termination |
| AI-generated briefings/forecasts | Same as the underlying financial data | Deleted alongside it |
Deletion/erasure requests
A request under UK GDPR Art. 17 (right to erasure), or a client-instructed deletion under our Data Processing Agreement, is actioned within 30 days. Requests should go to info@ash-makes-things.com; requests concerning data inside a client's LeadView tenant should go to that client first (they're the controller), though AMT will assist per the DPA.
Legal holds
If AMT is required to preserve data beyond these periods (e.g. a legal dispute, a regulator request, an insurance claim), that data is retained only for as long as the hold applies, then deleted per the schedule above.
Review
This policy is reviewed whenever a new LeadView module goes live that touches personal or financial data, and at least annually.