1. Scope
Personal data that passes through the applications AppExpertly publishes. This document sets the rules. The specific retention windows are stated in each application's own privacy policy, because they follow from what that application does. See §9.
2. Our role
For data an application moves on a customer's instruction, the customer is the controller and we are their processor. We act on their instructions rather than our own judgement, and we do not decide the purpose of the processing.
We are the controller only for our own operational records: account details, support correspondence and billing. Those are covered by the Privacy Policy.
3. Data minimisation
Applications store identifiers that point back into the customer's own systems, not copies of those systems. A contact identifier is stored; a contact record is not.
No application stores payment card details, and none stores a password for any third-party account. Access to a third-party account is by OAuth, which the customer grants and can revoke.
Where an application must store the content of a third-party event in order to do its job, it stores that content for a bounded period and then deletes it.
4. Retention
Retention is enforced in code and runs automatically, not as a clean-up that can be forgotten.
- Third-party event payloads containing personal data — deleted on a fixed window, stated per application.
- Records of what we delivered to a customer's system — same window.
- The stored copy of a request a customer's automation made — same window.
- Sign-in session records — a longer fixed window, stated per application.
- Operational records carrying no personal data — kept for the life of the installation.
The window is chosen for the data, not for its size. When retention was first implemented for one application it pruned the two largest columns. A later audit asked which columns held personal data rather than which were large, and found two more that had been missed. Both now age out on the same window. That distinction is the point of this section.
5. Deletion
Uninstalling an application stops all processing immediately.
On request we run a purge that removes every record held for one customer: installation, integration credentials, operational records, event log and delivery log. The purge is a scripted operation with a dry run that reports counts before anything is removed.
A request from an individual rather than from a customer is directed to that customer, who is the controller of the data. Where the individual cannot reach them, we help identify the right contact.
Because personal data ages out automatically, a request arriving after the retention window has passed is already satisfied.
6. Backups
Backups are taken on a schedule, encrypted, stored separately from the running system, and age out on a rolling window. The restore procedure is documented and includes the exact commands.
A purge does not reach into a backup already taken. Backups age out on their own, and a restore is a recovery action rather than a routine one. We state this rather than gloss it, because a policy implying otherwise makes a promise the mechanism cannot keep.
7. How it is protected
- At rest — credentials granting privileged access to a customer's third-party account are encrypted with AES-256-GCM, under a key held outside the database and rotatable without downtime.
- In transit — TLS on every external connection, required on the database.
- Network — databases accept connections only from an allowlisted network, never from the open internet.
- Isolation — every operation checks that the record belongs to the customer asking, in both directions.
The full set is in the Security Policy.
8. Where it is processed
Applications and their databases run in Amazon Web Services, in the United States. AWS is our only sub-processor. The third-party platforms an application connects to are not sub-processors: they are systems the customer already uses and instructs us to reach on their behalf.
9. Per-application windows
Every application publishes its own privacy policy stating the categories it holds and the exact window for each, along with what it deliberately does not store. Those documents are linked from each application's own site and from its marketplace listing.
Questions, and deletion requests: dev@appexpertly.com.