Data Retention and Erasure Policy
Last updated: 16 August 2026
This policy explains how long ScriptMyAds keeps personal data and how we erase it. It sits alongside our Privacy Policy and is aligned to the Digital Personal Data Protection Act 2023 (DPDP) and to Indian tax-record requirements.
1. Principle and the erasure duty
We keep personal data only as long as needed for the purpose it was collected for, or as long as the law requires, whichever is longer, then we erase it.
We erase your personal data when you withdraw consent, or when the purpose is no longer being served, whichever is earlier, unless a law requires us to keep it. When we erase, we also require our service providers to erase their copies.
2. Retention schedule
| Data category | Purpose | Retention |
|---|---|---|
| Account identity (name, email, Google id, role) | Run the account | While active; erased 30 days after account closure |
| Creator profile and services | Marketplace listing | While active; removed on closure or listing removal |
| Brand profile and campaign requests | Run campaigns | While active plus any open campaign |
| Content submitted and approval/proof records | Approve, verify, resolve disputes | Campaign period plus 30 days |
| Disclosure and compliance audit trail | Defend an advertising-law query | 5 years |
| Payment and invoice records | Pay, charge, and meet tax law | 8 years (see section 3) |
| Consent and rights-request records | Prove compliance | Life of the account plus 3 years |
| Security and system logs | Security, fraud, incident response | 180 days |
3. Tax-record retention
Even if you request erasure, we must keep the records tax law requires, for the statutory period. We retain financial and invoice records for 8 years, which covers the income-tax retention period and its reassessment window, and the GST record-keeping period. Our legal-hold check accounts for these before any erasure.
4. Large-platform inactivity rule
The DPDP Rules require certain very large platforms to erase a user's data a set period after inactivity, with advance notice. ScriptMyAds does not meet those size thresholds, so this rule does not currently apply to us. If that changes, we will add an inactivity clock and a pre-erasure notice.
5. Security logs
We retain security and system logs for 180 days, stored in India, and use them only for security, fraud prevention, and incident response.
6. Erasure process
- A trigger fires: account closure, consent withdrawal, a retention period ending, or the purpose being served.
- We run a legal-hold check (open dispute, tax retention, ongoing legal claim). If one applies, we keep only the minimum required and erase the rest.
- We erase from our database and instruct each service provider to erase their copies, and we record their confirmation.
- We log that the erasure happened, holding no personal data in the log beyond a reference.
7. Backups and anonymisation
Deleted data may persist briefly in encrypted backups, which rotate on a 30-day cycle and are not restored except for disaster recovery. Where we need data only for aggregate statistics, we may anonymise it instead of deleting it; anonymised data is no longer personal data and falls outside this policy.
8. On consent withdrawal
If you withdraw consent, we stop processing for the withdrawn purposes and begin erasure, except for data we are legally required to keep (for example tax records) or need to resolve an open dispute.