---
title: Data retention and privacy
description: How long records are kept, where personal data lives, what is logged when it is viewed, and what erasure does and does not remove.
order: 9
updated: 2026-09-16
keywords: retention, privacy, PDPA, vault, erasure, access log, backups
---

## Retention

| Record type                                                               | Default retention                                                                    |
| ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
| Business records: bills, counts, sales, rosters, safety logs, audit trail | Seven years, in line with Malaysian record-keeping expectations                      |
| Documents and their files                                                 | Same as the business record they support, unless disposed of under a recorded reason |
| Demo requests on the website                                              | Two years, or sooner on request                                                      |
| Support session records                                                   | Kept with the audit trail                                                            |

Records are never edited in place. Corrections add entries. A legal hold on a document blocks disposal until the hold is released.

## Where personal data lives

Identity numbers, permits, contact keys and payment identifiers are stored in an encrypted vault, separate from the business record, which holds only a reference. Fixtures and demo data use synthetic people only.

## What is logged

- Every view of an identity number.
- Every export of people data.
- Every open of a restricted loss-prevention case.
- Every support session and the reads it performed.
- Every view of a shared inspection pack, including anonymous views.

## Customer data

Customer screens show masked keys and consent badges, never raw contact details. Consent is recorded with its reference and re-checked before any use. Segments are aggregate-only with minimum audience sizes.

## Erasure

An erasure request is verified, reviewed against retention obligations, and attested. The vault entry is removed so the reference can no longer be resolved; the business record stays intact for accounting, with the person shown as a tombstone. A staff PDPA action records the acknowledgement; deletion follows the retention rules above.

## Backups

Continuous write-ahead archiving and nightly full backups, with a rehearsed restore into a scratch area. Recovery objectives: at most 24 hours of data loss and at most 2 hours to restore service.

## What ChowChirp does not claim

ChowChirp is not certified under the PDPA, ISO 27001 or SOC 2, and does not promise a data-residency location today. Ask for the current hosting region before signing.

## Related

- [Approve a support access request](/docs/how-to/approve-a-support-access-request)
- [Handle a blocked file](/docs/how-to/handle-a-blocked-file)