Principles
We keep data only as long as it is needed for the reason it was collected, or as long as the law requires, and then delete it or make it anonymous. This policy sets out the periods for each kind of data.
Who decides
For client records in Nootus, the firm is the data fiduciary and decides how long they are kept, within the statutory minimums below. Nootus keeps them on the firm's instruction. For website enquiries, analytics and our own records, Nootus decides.
Retention periods
Unless a firm instructs a longer period, or the law or a pending proceeding requires one:
- Books of account, vouchers and filed-return records: 8 years from the end of the financial year for companies, and 6 years from the end of the assessment year for others, in line with the Companies Act, 2013 and the Income-tax Act.
- Activity log for books and filed periods: kept with the records it relates to, for at least 8 years. It cannot be switched off.
- Client messages on WhatsApp, email and the portal, and the files attached: while the firm's account is open, or for the period the firm sets.
- Password vault entries: until the firm removes them or closes its account. The log of vault views is kept for 8 years.
- Records of AI work (what each agent did, for which client, reporting to whom): kept with the records they relate to.
- Questionnaire answers and uploaded documents: while the firm's account is open, or for the period the firm sets.
- Website enquiries from our demo and partner forms: 24 months from our last contact with you, then deleted.
- Website analytics in Google Analytics 4: 14 months.
- Security and access logs: at least 180 days, kept in India, as CERT-In directions require.
- Backups: overwritten on a rolling cycle of up to 30 days.
- Billing and tax records of our own: 8 years.
Trials and lapsed plans
When a trial or paid plan ends, the account moves to Free and paid features become read-only. Nothing is deleted. If an account stays unused for 24 months after its plan lapses, we will write to the firm and give 30 days' notice before deleting it.
When a firm leaves
When a firm closes its account, it can export its data for 30 days. We then delete the firm's data from the live service within 90 days, and from backups as they roll over, except records the firm asks us to keep for the statutory period or the law requires us to keep.
Deletion requests
To have your data deleted, write to privacy@nootus.ai. If your data is in a firm's records, we will pass your request to the firm, which decides as fiduciary. We will not delete records the law requires to be kept, and we will tell you why.