Security and data retention

Last updated 4 November 2026

How long we keep what you give us, how we delete it, and what protects it while we hold it.

Retention Periods

Your account	While the account exists.
The file you upload	An upload no job uses is deleted after two days; one a job used goes once every job that used it has expired or been deleted, and in any case about 30 days after upload. Audio extracted for transcription is never stored.
Finished work	Your plan’s window: Starter 7 days, Pro 7, Growth 14, Scale 30, no plan 7, unless we have agreed another with you, up to 30; in a live review link, until the link ends, up to 30 days after delivery; while a safety report about the account is investigated, up to 30 days; and in any case about 30 days after it was made.
Working files	Transcripts, subtitle files, the wording read off a creative and a track’s lyric sheet are kept beside the result and deleted with it.
What you write	A prompt stays with its job record; your glossary, saved prompts, presets and client names while the workspace exists.
Typefaces you add	Your plan’s window, counted from the last time the font was used, uploaded or deleted by you, plus a day. Its name and your rights confirmation stay with the account.
Approved wording you upload	Kept until you delete it, then purged within 30 days of your deleting it. The file itself is an upload.
Job records	Deleted with their output.
The credit ledger and subscription records	While the account exists, as our books of account; it holds no files. If you erase your account, it keeps no name, note or file name, its welcome-credit entries keep keyed fingerprints of your email address and of the card that paid, and the workspace keeps its Stripe ids.
Invitations	The link works for 14 days; the invitation is erased with the workspace.
Review links and what reviewers say	While the workspace exists; erased with it.
Waiting list	Kept until you ask us to delete it, and deleted ninety days after we send the one email it was left for.
Copies of the emails we send	While the account exists. A copy sent to an address with no account, an invitation or the waiting-list email, is deleted with the waiting-list entry or 30 days after the invitation expires.
Proof that you accepted our documents	While the account exists; an erasure keeps which versions were accepted.
Withdrawals and cancellations you send	No set end date: the record that your statement arrived and how we answered it, kept after an erasure. A copy of our answer to an address with no account is kept with it.
Provider refusals	When, which job and product, the model and the provider’s reason, never the material. No set end date; after an erasure, kept under a keyed fingerprint of the workspace rather than its id.
Takedown records	Which job, the notice, when, and whether you were told; no file or its content. No set end date.
Records of staff actions, safety cases and erasures	No set end date.
Server logs	Until the server’s fixed-size log store overwrites them, usually after several months. The web server’s request log about two weeks, the rendering logs for a limited period, and each job’s processing log up to 30 days.
Database backups	A daily copy, kept for about 30 days and never more than about 90. They never contain your files.
Material the law requires us to preserve	At least one year after a report to the authorities, and until a person removes it. No deletion rule reaches it; the acceptable use policy says when this happens.

Your plan’s window is enforced by an automatic deletion that runs every six hours: access ends exactly on the window, and the files go at the next run. Underneath it, the 30-day limit is a rule on the storage itself, so uploads other than typefaces, and everything a job delivered, are deleted about 30 days after they were made whether or not our code is running. Work in a live review link is kept until the link ends, up to 30 days after delivery; nothing else you can press or ask us for keeps a result past its window. Download anything you want to keep before it closes. When finished work has two days or less left, we email the workspace owner, at most once a day, unless that email is switched off. A longer window, up to 30 days, can be agreed for work delivered after that; to ask, write to info@cralio.app.

How Your Files Are Protected

Files are encrypted in transit, and at rest by the storage service (AES-256). A file you upload through our server may be written to its disk for the length of that one request and is deleted when the request ends.
What you upload, and every typeface you add, is stored apart for your account, and what a job produces apart for that job. Every request for a file is checked against the account making it. Download links are issued on request and expire after an hour. No customer file has a public address, except work you share through a review link, which anyone holding the link can view until it expires or you revoke it.
Administrative actions — granting credits, retrying a job, changing a role — are written to a record the application can add to but not change or delete, naming the person, the account and the time.
Alerts to our operators carry a reason code, counts and amounts about the service and a reference to our own record, and no personal data.
Submissions, price quotes, upload preparations, billing actions, account-erasure confirmations and waiting-list sign-ups are rate limited per caller. A refused request spends nothing.

Deleting Sooner

You can delete a job from the dashboard. A running job must be stopped before it can be deleted. Deleting removes its renders, poster, subtitle files and log at once, and the file you uploaded follows the rule for uploads above. A job that had not started returns its credits. If the storage service refuses a deletion, the failure is recorded on the job and retried every hour, and we are alerted if it keeps failing.

You can erase your whole account in Settings by typing the address on it, or ask us to do it. The erasure is refused, with the reason, while a subscription is active or unpaid, a job is running, others are in the workspace, or any hold on the account is open; while a safety case is open we say only that the account is under review. If a step of the erasure fails, we finish it by hand. The privacy policy lists what an erasure removes and what it keeps.

Incident Response

If we learn of a breach affecting your data, we tell you without undue delay, and within 72 hours where the data processing addendum applies: what happened and when, which data and roughly how many people and records, the likely consequences, what we are doing about it, and who to reply to. Where the picture is incomplete we send what we have and follow up.

Found a vulnerability? Write to info@cralio.app with enough for us to reproduce it. Do not test against anybody else’s account or data, and do not run load against the live service.

This page is part of the terms of service. We will not change this page so as to reduce the protection it gives without your agreement; any other change is published here with a new date. The companies that receive your files are listed on the subprocessors page. For anything not covered here, write to info@cralio.app.