Data Retention and Deletion Policy

This policy explains how Cross decides how long to keep information and what happens when it is no longer needed. It should be read with the Privacy Notice, Terms of Service, and Customer Data Processing Agreement.

Cross keeps information only while there is a documented reason to do so. We consider:

• the purpose for which the information was collected;
• the Customer’s documented instructions;
• sponsor, employment, immigration, tax, accounting, and regulatory requirements;
• security, fraud prevention, audit, and dispute needs;
• the sensitivity of the information and risk to affected people; and
• whether deletion, anonymisation, or restriction is more appropriate than retention.

We do not keep personal data indefinitely merely because it might be useful. A legal hold, active investigation, regulator request, or pending claim may temporarily override the ordinary schedule for relevant records.

• Unfinished public onboarding: a never-paid draft workspace and its placeholder company information are deleted after 90 days without relevant activity.
• Onboarding statistics: privacy-minimised raw onboarding events are kept for 90 days. Non-identifying daily aggregates may be kept for up to 24 months.
• Active accounts and workspaces: account, company, workforce, attendance, notification, and support information is kept while the account and service are active and afterwards only for an applicable legal, contractual, security, or deletion purpose.
• Right to Work evidence: evidence connected to a recorded check is protected for the worker’s employment and ordinarily for a further two years after employment ends, unless a longer legal hold or requirement applies. It should then be securely deleted.
• Other employment and compliance records: records are retained according to the Customer’s documented schedule and applicable sponsor or employment requirements. Archive status hides a record from ordinary current views but does not itself delete it.
• Billing, invoices, and tax records: billing records are kept for the applicable accounting and tax period. UK VAT records are normally retained for at least six years where that requirement applies.
• Refund and payment-dispute records: chargeback notices, correspondence, evidence, outcomes, and related Stripe references are kept while the dispute is active and afterwards for the applicable accounting, fraud-prevention, limitation, or legal-claims period.
• Authentication and security: verification, password-reset, and session credentials expire automatically. Limited records of expiry, revocation, access, and security events may be retained longer where needed to protect Cross and its users.
• Legal acceptance and audit history: policy acceptances, advisor assignments, record changes, reviews, access events, and compliance actions may be kept for the relevant relationship and limitation or regulatory period because they provide evidence of authority, instructions, access, and decisions.
• Email delivery: email intent, delivery status, and provider identifiers may be retained for service support, security, and evidence. Email content is minimised so sensitive case details remain inside Cross.

Current documents, replaced versions, review history, and access events may need different retention periods. Replacing or archiving a document does not necessarily permit immediate deletion. Cross prevents deletion where a current employment contract, linked Right to Work check, legal hold, or another retention requirement applies.

Document files are held in private encrypted storage in the European Union. Database records hold their identity, version, review, retention date, and access history. A deletion must address both the file and its associated records without destroying audit evidence that must still be kept.

Cancelling a subscription stops renewal but does not immediately delete the workspace. The Customer should export information it needs while access is available and send any account-closure or return request through the support contact shown in Cross.

Cross will follow the Customer’s documented deletion or return instruction where it acts as processor, except for information that Cross or the Customer must retain by law or that Cross needs for security, billing, a dispute, or a legal claim. Retained information will be restricted to those purposes.

Workforce requests should normally be made to the employer or organisation controlling the workspace. Cross will assist the Customer as required by the DPA. Cross will respond to a valid rights request without undue delay and within one month, unless data-protection law permits an extension and the requester is told about it.

Cross verifies the requester’s identity, authority, affected workspace and record scope. A request may be refused, limited, or deferred where the requester lacks authority or a legal obligation, legal claim, security need, or other lawful exception requires retention. Where only part of a record must be preserved, Cross will restrict the retained part and delete or anonymise information that is no longer needed.

Whole-workspace deletion is currently a coordinated manual process rather than a self-service action. Once a request is approved, Cross identifies the affected live database rows, private files, email records, billing references, audit records, and service providers. Information that can lawfully be erased is deleted or irreversibly anonymised; information that must be retained is restricted from ordinary use.

Cross records the systems addressed, any information retained and the reason, the date on which live-system action was completed, and the latest expected expiry of any protected recovery copy. The written completion response gives those dates to the Customer or requester. Cross does not describe information as fully erased while an identified recoverable copy remains within its stated expiry period.

The current provider lifecycle relevant to deletion is:

• Cloudflare R2: after Cross successfully deletes an eligible live object, direct reads no longer return that object. Cross does not use a public document cache.
• Neon: deleted database data may remain in point-in-time recovery history, snapshots, or provider backups for up to 30 days under the approved production configuration, after which the recoverable copy expires unless a documented legal hold applies.
• Twilio SendGrid:message bodies may be held for delivery retries for up to 72 hours; most recipient and message metadata expires within 37 days; pseudonymised event data may remain for up to one year for security and abuse prevention. SendGrid's contractual backup deletion period following service termination may also run for up to one year.
• Stripe: Stripe may retain billing, tax, fraud, refund, and dispute data for its own legal and regulatory purposes when acting as an independent controller. A Cross deletion request does not override those obligations.
• Vercel and Railway: these providers do not hold the primary workforce database or private document store. Relevant account, request, and security data is handled under their contractual deletion processes and is included in a provider request where the verified deletion scope requires it.

Recovery copies are placed beyond ordinary use and are not restored except for disaster recovery, security, or legal reasons. If a recovery copy is restored, Cross will reapply the relevant deletion instruction before returning the restored system to ordinary use.

Cross reviews this policy when record types, providers, legal requirements, or deletion capabilities change and at least annually. Customers remain responsible for setting a lawful retention schedule for the workforce information they control. They should not use Cross to retain data longer than their own purposes and legal duties justify.

Retention, export, and deletion questions may be sent through the support contact shown in Cross or in the relevant account, order, or invoice. Include the workspace and relevant record category, but do not send identity documents or full payment details by email.