Data Retention Policy

This Policy applies to information associated with the Asiyst Services, which may include:

• Account information.
• Profile information.
• Projects and workspaces.
• AI assistants.
• Avatars.
• Conversations and interactions.
• Knowledge sources.
• Uploaded files.
• API and SDK information.
• CLI information.
• Usage information.
• Authentication information.
• Security logs.
• Support communications.
• Payment and transaction records.
• Technical and operational information.
• Other information processed through the Services.

Actual retention periods depend on the type and purpose of the information.

Asiyst generally considers the following factors when determining how long information should be retained:

• The purpose for which the information was collected.
• Whether the information is required to provide the Services.
• Account and project status.
• Customer instructions.
• Security requirements.
• Legal and regulatory requirements.
• Accounting and financial requirements.
• Dispute-resolution requirements.
• Fraud-prevention requirements.
• Backup and disaster-recovery requirements.
• Contractual obligations.
• Technical limitations.

Asiyst may retain different categories of information for different periods.

Account information may be retained while an account remains active.

Account information may include:

• Name.
• Email address.
• Authentication information.
• Profile settings.
• Account preferences.
• Organization information.
• Account status.

When an account is deleted, applicable information may be deleted or de-identified subject to legal, security, accounting, fraud-prevention, and other permitted retention requirements.

Project and workspace information may be retained while the relevant project or workspace remains active.

This may include:

• Project configurations.
• Assistant settings.
• Avatar settings.
• Integration settings.
• Knowledge-source configurations.
• Project membership information.
• API configuration.
• Other project-related information.

When a project or workspace is deleted, applicable information may be removed according to the Asiyst deletion process.

Where Asiyst stores conversations or AI interaction history, such information may be retained according to the applicable product configuration and Service.

Retention may depend on:

• Whether conversation history is enabled.
• User or administrator settings.
• Product requirements.
• Security requirements.
• Applicable contractual terms.

Deleting conversations through an available feature may begin the applicable deletion process.

AI prompts and outputs may be processed or temporarily stored where necessary to provide the requested functionality.

Depending on the Service, such information may be retained for purposes including:

• Providing conversation history.
• Maintaining application functionality.
• Debugging.
• Security.
• Abuse prevention.
• Usage measurement.
• Customer support.
• Service reliability.

Retention does not necessarily mean that such information is used to train general-purpose AI models.

Unless expressly stated otherwise in applicable documentation or an agreement, Asiyst does not intend to use Customer content, prompts, conversations, or connected knowledge sources to train general-purpose Asiyst models.

Third-party AI providers may have separate retention and data-use practices.

Where a third-party provider processes information, applicable provider terms and technical configurations may affect how long the provider retains that information.

Knowledge sources connected to Asiyst may be retained while they are configured for use by an applicable project or assistant.

Knowledge sources may include:

• Documents.
• Websites.
• Product information.
• FAQs.
• Documentation.
• Uploaded files.
• Connected data sources.

When a knowledge source is deleted or disconnected, Asiyst may remove associated active data according to its applicable deletion procedures.

Uploaded files may be retained while they are required for the functionality selected by the user or customer.

Retention may depend on:

• The associated project.
• The purpose of the upload.
• User configuration.
• Storage requirements.
• Security requirements.
• Deletion requests.

Users should delete files that are no longer necessary where deletion functionality is available.

API-related information may include:

• Request metadata.
• Response metadata.
• Usage information.
• Authentication information.
• Project identifiers.
• Timestamps.
• Technical logs.
• Error information.

API data may be retained for different periods depending on whether it is required for service operation, security, billing, debugging, or other legitimate purposes.

Active API keys may be retained while they are required for authorized API access.

When an API key is revoked or a project is deleted, the credential may become unusable immediately or within the applicable system-processing period.

Limited records concerning revoked credentials may remain for security and audit purposes.

Usage information may be retained for purposes including:

• Calculating usage.
• Managing credits.
• Billing.
• Account administration.
• Detecting unusual activity.
• Resolving billing disputes.
• Financial reporting.
• Service analysis.

Examples may include:

• Request counts.
• Token usage.
• Credit consumption.
• Applicable provider or model.
• Project identifiers.
• Timestamps.
• Billing events.

Financial and transaction records may be retained for longer periods where required by accounting, tax, legal, or regulatory requirements.

Payment transactions may involve third-party payment processors.

Asiyst may retain transaction-related information necessary to:

• Identify transactions.
• Confirm payments.
• Process refunds.
• Resolve disputes.
• Maintain accounting records.
• Detect fraud.
• Comply with applicable legal requirements.

Asiyst may not directly retain complete payment-card information where payment processing is handled by a third-party provider.

Third-party payment providers may maintain their own records according to their policies and legal obligations.

Authentication and access-related records may be retained for security and operational purposes.

These may include:

• Login events.
• Session information.
• Authentication attempts.
• Account security events.
• IP addresses or network information.
• Device information.
• Access timestamps.

Retention periods may vary depending on security requirements and the nature of the event.

Security logs may be retained to:

• Detect attacks.
• Investigate incidents.
• Prevent abuse.
• Protect accounts.
• Monitor infrastructure.
• Maintain service security.
• Establish security event histories.

Security-related information may need to be retained after an account is deleted when reasonably necessary for these purposes.

Information associated with suspected fraud, abuse, unauthorized access, or policy violations may be retained for as long as reasonably necessary to:

• Investigate the activity.
• Protect users.
• Protect the Services.
• Prevent repeated abuse.
• Resolve disputes.
• Enforce applicable agreements.
• Comply with legal obligations.

Such information may be retained even after an associated account has been suspended or deleted.

Support requests and related communications may be retained for purposes including:

• Responding to the request.
• Maintaining support history.
• Troubleshooting.
• Training support personnel where permitted.
• Resolving disputes.
• Improving support processes.
• Security and compliance.

Retention may vary depending on the nature of the support request.

Records relating to transactional or service emails may be retained for purposes including:

• Confirming delivery.
• Diagnosing delivery failures.
• Maintaining notification history.
• Security.
• Customer support.
• Compliance.

Third-party email providers may maintain separate delivery and operational records.

Asiyst may retain analytics and product usage information to understand how the Services are used and to improve reliability and functionality.

Analytics information may include:

• Feature usage.
• Page views.
• Session information.
• Performance information.
• Error information.
• General interaction data.

Where possible and appropriate, Asiyst may aggregate or de-identify such information.

Asiyst may retain properly de-identified or aggregated information after identifiable information has been deleted, where permitted by applicable law.

Such information may be used for purposes including:

• Statistical analysis.
• Service improvement.
• Security analysis.
• Capacity planning.
• Product development.
• Business analysis.

Properly de-identified information is not treated as Personal Data to the extent permitted by applicable law.

Information deleted from active systems may remain temporarily in backups.

Backups may be maintained for:

• Disaster recovery.
• Business continuity.
• Security.
• System restoration.
• Operational resilience.

Backup copies are generally subject to automatic replacement or deletion according to applicable backup cycles.

Asiyst does not ordinarily restore deleted user information solely for the purpose of recovering individual deleted data unless there is a legitimate operational or legal reason.

Asiyst may retain information for longer periods when necessary to:

• Comply with applicable law.
• Meet tax or accounting obligations.
• Respond to lawful requests.
• Comply with court orders.
• Establish or defend legal claims.
• Resolve disputes.
• Enforce contracts.
• Maintain required business records.

Where possible, retained information may be restricted to the information reasonably necessary for the applicable purpose.

Enterprise customers or other customers with specific contractual arrangements may have retention periods established by:

• Data Processing Agreements.
• Enterprise agreements.
• Order forms.
• Service agreements.
• Customer instructions.

Where a specific contractual retention requirement applies, the applicable agreement may govern.

Certain Asiyst Services may provide customers with controls over retention.

Depending on the product, these controls may include:

• Deleting conversations.
• Deleting projects.
• Deleting files.
• Disconnecting knowledge sources.
• Revoking API keys.
• Deleting accounts.

Available controls may vary by Service and account type.

For organizational or enterprise accounts, retention may be controlled by the organization's administrator or contractual configuration.

Individual users may not be able to independently delete information where the organization is responsible for the relevant account or workspace.

Asiyst may use third-party providers for:

• Cloud infrastructure.
• Storage.
• Authentication.
• AI processing.
• Payments.
• Email.
• Analytics.
• Security.
• Customer support.

These providers may maintain information according to their contractual arrangements, technical architecture, and applicable legal obligations.

When Asiyst sends information to an external AI provider, the provider's retention practices may depend on:

• The provider.
• The applicable API or service.
• Account configuration.
• Contractual terms.
• Provider policies.
• Applicable law.

Where customers connect their own provider credentials, customers should review the provider's applicable data-retention and data-use terms.

Information may be processed or stored in countries different from the country where it was originally collected.

Retention practices may therefore be affected by the applicable infrastructure, service providers, contractual arrangements, and legal requirements.

When information is no longer required for its applicable purpose, Asiyst may:

• Delete it.
• De-identify it.
• Aggregate it.
• Anonymize it where appropriate.
• Restrict access to it before final deletion.

Deletion may occur automatically or through scheduled processes.

Information may be retained beyond ordinary retention periods when reasonably necessary for:

• Legal proceedings.
• Investigations.
• Security incidents.
• Fraud prevention.
• Regulatory requirements.
• Accounting requirements.
• Contract enforcement.
• Dispute resolution.

The applicable information may be retained only for as long as reasonably necessary for the relevant purpose.

Users may request deletion of applicable personal information according to the Asiyst Data Deletion Policy.

A deletion request does not necessarily override legal or operational retention requirements.

Where information must be retained, Asiyst may explain the applicable limitation where legally and operationally appropriate.

There is no single retention period applicable to all Asiyst information.

Retention varies according to:

• Data category.
• Service.
• Account configuration.
• Customer instructions.
• Legal obligations.
• Security requirements.
• Business requirements.
• Third-party processing.
• Technical architecture.

Specific retention periods may therefore change as the Services evolve.

Asiyst may update this Policy to reflect changes in:

• Services.
• Data-processing practices.
• Storage systems.
• Security requirements.
• Legal requirements.
• Retention procedures.

The updated Policy will be made available through the Asiyst Services.

For questions regarding data retention or retention-related requests, contact:

Asiyst Website: https://asiyst.com Email: support@asiyst.com