Loading
This Data Retention Policy explains how long Adbridge Inc. ("Adbridge," "we," "our," or "us") retains different categories of data, the criteria we use to determine retention periods, and your rights regarding data deletion.
This policy is part of our commitment to data minimization and transparency. We retain data only as long as necessary for the purposes described in our Privacy Policy, unless a longer retention period is required or permitted by law.
The following table summarizes how long we retain each category of data. Where a row says data is deleted automatically, an automated job performs that deletion on a recurring schedule. Where a row says data is retained for the life of the account, we do not apply automatic time-based deletion to it; it is removed when you request deletion, subject to the minimum retention obligations in Section 3.2 and the legal holds in Section 5.
| Data Category | Retention Period | Legal Basis |
|---|---|---|
| Account Information | Retained for the life of the account, including while the account is deactivated, so it can be reactivated and so associated workspace, contract, payout, and audit records remain attributable | Contract performance; legitimate interest |
| Transaction Records (Payments, Payouts) | 7 years from transaction date | Financial regulations; tax law (IRS, state requirements) |
| Conversion Records (Attribution) | Life of the account; not automatically deleted, because these records substantiate amounts paid to creators | Contract performance; dispute resolution |
| Raw Webhook Payloads and Request Bodies | Deleted automatically, by default 30 days after receipt. A delivery we could not apply, because the endpoint was not yet live, a field mapping was missing, or the conversion was not attributable, keeps its payload until it is resolved or replayed | Data minimization; debugging and dispute resolution |
| Contract Documents | Life of the account, and at least 7 years where the document evidences a financial obligation | Legal compliance; statute of limitations |
| Deal/Campaign Data | Life of the account; not automatically deleted | Contract performance; analytics |
| Audit and Security Logs | Life of the account; retained to evidence access to financial and personal data, and not deleted on routine request | Security; compliance |
| Consent Records | Retained with the account record as proof of the terms you accepted | GDPR/CCPA compliance; proof of consent |
| Sessions and Authentication Tokens | Sign-in sessions expire after 7 days, and the tokens used to extend them after 30 days; sessions end immediately on sign-out or account deactivation | Security; session management |
| In-App Notifications | Deleted automatically, by default 30 days after being read and 90 days after being archived | Service delivery |
| Support Communications | Retained in our email systems for as long as needed to resolve the matter and to evidence its resolution | Dispute resolution; quality assurance |
| Demo Requests | Deleted automatically: unfinished requests 30 days after the last answer, finished requests 12 months after they are submitted. Copies emailed to our team are kept in our email systems like other communications. | Responding to your request; data minimization |
| Contact Requests | Deleted automatically: unfinished requests 30 days after the last answer, finished requests 12 months after they are sent. Copies emailed to our team are kept in our email systems like other communications. | Responding to your request; data minimization |
Adbridge supports account-level deactivation. Deactivation is a reversible state, not an automatic deletion: the account record and its associated workspaces, contracts, payouts, conversion history, and audit logs are retained so the account can be reactivated and so financial and compliance records remain intact.
The following records are retained for legal, financial, and audit reasons regardless of account state:
If you want personal data removed beyond what deactivation retains, submit a deletion request to legal@adbridge.com. We will respond within the timeframe required by applicable law and explain which records cannot be deleted because of legal, financial, or audit retention obligations described above.
Note for Brand Accounts: Account deactivation is blocked while you are the sole owner of an active or archived workspace, or while open financial obligations exist (active campaigns, active deals, unpaid payouts, or pending conversions). Resolve those before deactivating.
For certain data categories, instead of complete deletion, we anonymize the data to remove all personally identifiable information while retaining aggregate insights:
We may extend standard retention periods or suspend deletion in the following circumstances:
If we place a legal hold on your data that extends the normal retention period, we will notify you where legally permitted. You will be informed when the hold is lifted and normal retention schedules resume.
We use the managed backup facilities of our cloud infrastructure provider to support business continuity and disaster recovery. Backups are encrypted at rest and access to them is restricted. We can provide current backup and recovery details to business customers on request.
When we act on a deletion request, we remove the data from production systems. It may persist in backups until those backups expire on their normal cycle. We do not restore deleted data from backups except in disaster recovery scenarios, and any data restored that way would be deleted again in line with your original request.
You have the following rights regarding data retention and deletion:
You can request information about what data we hold about you and how long we intend to retain it.
You can request deletion of your personal data, subject to legal retention requirements. We will inform you if certain data cannot be deleted and explain why.
You can request a copy of your data in a structured, machine-readable format. Submit data export requests by email; account deactivation does not automatically delete or export data.
You can request that we restrict processing of your data while you dispute its accuracy or our basis for processing.
To exercise any of these rights, please contact us at legal@adbridge.com. We will respond to verified requests within the period required by applicable law, generally one month under the GDPR and 45 days under the CCPA. You may also manage some preferences directly in your account settings.
When data is transferred internationally, retention periods apply regardless of location. We ensure that data protection standards are maintained across all processing locations through appropriate safeguards such as Standard Contractual Clauses.
For more information on international transfers, see our Data Processing Addendum.
We may update this Data Retention Policy periodically to reflect changes in our practices, legal requirements, or business needs. When we make changes:
If you have questions about this Data Retention Policy or wish to exercise your rights:
This Data Retention Policy is effective as of September 2026 (Version 2026.4).