What we hold, and for how long.

Who holds this material

Retros.ai is a trading name of GCI Solutions Limited, and that company holds everything described below. Write about anything on this page to security@retros.ai and a person reads it.

No reply time is published, here or anywhere else on this site, because none has been agreed and nobody is named as owning one. That is the same position the security and trust page takes, and it is stated rather than left for you to notice.

What the product holds

Five kinds of material, held in different places by different companies. They are listed apart rather than together because they are not kept for the same reason or for the same length of time, and one list would hide that.

Retro content

Every Card, Retro, Group, Vote, summary, Theme and Action, in the database that is this product's only data store. There is no second copy anywhere.

Identity

Names, email addresses, Workspace membership and role, held by the managed identity provider. A Workspace is exactly one organisation in that provider, and the two roles are Workspace admin and Member.

Billing

The billing contact and the subscription for a Workspace, held by the payment provider. No card number reaches our servers, because payment runs through that provider's own surfaces.

Product analytics

Counts, identifiers and flags from a set declared in advance. No Card, Retro, summary, Theme or Action text can reach it, by construction rather than by policy.

Correspondence

What you send to an address at this domain, or through the form on the contact page. The form stores your name, work email, firm if you gave one, the size band you chose and your message, and nothing else.

Why each kind is held

Retro content is held so the product can do the thing it is sold for, which is to still have your record after the meeting. Identity decides who may reach which Retro. Billing runs the subscription. Analytics counts whether the product works. Correspondence exists so somebody can reply to you.

One thing this section deliberately does not say is which lawful basis each of those rests on. Nothing in the record behind this product names one, and a page that picked one would be making a legal judgement on the company's behalf, written by the people who built the software rather than by anybody qualified to make it. It is an open item and it is named here rather than quietly filled in.

The lawful basis for each kind of processing

Not published here yet

How long each kind is kept

Cancelling a Workspace starts a deletion clock of 90 days. Two emails reach the Workspace admin first, one 30 days before deletion and one 7 days before it. Nothing is ever deleted silently, and every deletion is preceded by at least one email.

After you cancel

Everything the Workspace holds is deleted 90 days later, with warnings at 30 and 7 days. The record stays exportable the whole time.

After you move down a band

Nothing is removed. Every Retro stays where it is and what shrinks is how much of it you can read. Moving back up returns the reading.

After you delete a Team

Deleting a Team archives it. No Team, Retro, Card, Group, Vote, summary, Theme or Action is destroyed by that operation, and a Workspace admin can restore it.

A Retro run with no account

It lives 7 days and is then hard deleted. The rows go rather than a flag being set on them, so no remnant survives and the absence can be checked.

An enquiry you send us

A scheduled job deletes it 12 months after we receive it. That period covers an enquiry from somebody who never became a customer, and it is separate from the clock above.

If you need something erased

An erasure request under data protection law is a different operation from archival, and it is not designed in this version. Archival deliberately destroys nothing, which is the opposite of what such a request asks for, so nobody here will tell you that archiving a Team answers one.

What happens instead is that a person takes the request. Write to security@retros.ai and somebody will tell you what is possible today. This page promises you a person and does not promise you a result or a date, because neither has been decided.

The data processing page says more about which parts of the question are open and why the answer is taking the time it is.

Which companies see it

Every company that receives Card, Retro, summary, Theme or Action content is named on the security and trust page, in a table that says what each one receives and why. That list is not repeated here, so there is one list to keep true rather than two to keep matching.

Changing that list is a change to that page, and it ships in the same release as the change rather than after it. Read it at /trust.

Analytics, and what is kept in your browser

Product analytics are hosted in the EU and, by construction, cannot receive retro content as an event property. Every property an event may carry is declared in advance, there is deliberately no free text shape for content to arrive in, and a property named after content is refused even if somebody adds it later.

Nothing is captured automatically from what you click and no session is recorded, both because on a Retro the text of whatever you clicked is somebody's Card. A signed in person is identified by their identity provider id and the Workspace is carried as a group key. No email address, no display name and no Workspace name is sent. Any value that parses as a web address is reduced to its path before it leaves the browser, because a query string in this product can carry a link token.

On ordinary pages the analytics library keeps an identifier in your browser storage and in a cookie, so a return visit is recognised as the same anonymous visit. On any page reached through a link token it keeps nothing at all and runs in memory. There is no consent surface on this site today. That is a choice the company has not been advised on rather than a conclusion anybody has reached, and it is stated here so you can see it rather than discover it.

What is never sent to a model

No Card, Retro, summary, Theme or Action content is used to train any model, ours or a vendor's. That is a condition of a vendor being on the subprocessor list rather than a preference mentioned to them.

It is worth being exact about the state of this today, because the honest answer is stronger than the careful one. No model has ever run. No deployment carries the credential either AI vendor needs, so a call is refused before anything is sent, and no request has gone to either company. When that changes, the vendor has to be configured to keep our content out of training or it is disqualified, whatever else it is good at.

Where a Retro was run with no account and later claimed into a Workspace, the Cards written before the claim are sent for analysis only if the person who claimed it asks for that separately. The claim itself sends nothing.

How access is decided

Who you are, which Workspace you are in, what role you hold and what your band entitles you to are all resolved on the server from your verified session. None of them is ever accepted as something the browser sent, and a check in continuous integration reads the function signatures and fails the build on one that does.

Where a Retro hides authorship, the author is not in the response at all rather than hidden in the interface, so there is nothing to find in a browser's developer tools. A Guest link reaches exactly one Retro and an Action link reaches exactly one Action, and neither widens into the other.

Material is encrypted in transit and at rest by the two platforms that hold it. Both are vendor positions we rely on rather than controls we operate, which is why the trust page names the vendors and quotes what each publishes.

What this page does not claim

A reader checking a privacy page is reading for what is missing, so the absences are stated rather than left to be found. Each one below is an absence this company can account for, and none is softened with a date.

Nothing about where your material sits

No choice of location is offered and none is implied. No decision has been taken, and a commitment made now is one the infrastructure does not keep.

No attestation by anybody

No independent body has examined any of this. There is no report to send you and no programme to point at.

No agreement to countersign

There is no processing agreement to offer. It is an open item rather than an oversight, and it is not something a page can solve.

No conclusion about the law

This page says what the product does. It does not say what that amounts to under any particular regime, because nobody qualified has said so yet.

Changes, and how to reach us

Write to security@retros.ai about anything here, or to hello@retros.ai about anything else. Mail to either is received by our email provider and forwarded to a person, and no automated system reads it.

This page changes when the product changes, in the same release rather than after it. The date at the top is the date of the most recent change, and every figure on the page is read from the value the product enforces rather than typed here, so a period that moves in the code moves here in the same commit.