Data Retention & Offboarding Policy

1. Scope and roles

This policy covers the Linear Ventures Business Operating Suite (“BOS”, the “Platform”). It explains how long BOS keeps each class of record, what happens when a subscription ends, and how a tenant can require permanent erasure.

• Subscriber tenants. For a company that subscribes to BOS, the company is the Controller and the seller/taxpayer of record. Linear Ventures is the Processor, acting on the Controller’s documented instructions under our Data Processing Agreement. The company decides what goes into BOS and is responsible for keeping its own statutory records; BOS provides the tooling and the export.
• Linear Ventures’ own workspace. Company LV-IN-001 holds the books of Linear Ventures’ own business (Nanoliss), including the personal data of Nanoliss’s customers and shoppers. Linear Ventures is the Controller of that workspace — BOS is an internal system, not a separate processor — and it is not deletable through the tenant offboarding procedure.
• Separate products. Linear Console is a separate system with its own data, database and retention policy. Deleting a BOS workspace does not delete Console records, and the reverse is also true.

2. Retention schedule

“Financial year” means the Indian financial year, 1 April to 31 March. The statutory minimum runs from the end of the financial year in which each record was created. We implement it with a single, conservative cutoff: 8 years from the end of the financial year in which the subscription terminates. For every retained financial record dated on or before termination, that cutoff is later than or equal to the record’s own 8-year minimum, and may keep an older record longer. Tenant access ends at termination, so we do not create later tenant financial records. Example: a workspace that terminates on 26 October 2026 is retained until 31 March 2035.

3. Termination: the 90-day recovery window

When a subscription ends, the workspace is closed: users lose access, but the data is kept for 90 days. During that window the Subscriber may reactivate the workspace or ask for a complete export.

At the end of the 90 days we run the retention split:

• Marketing, messaging, review, AI, bug-report, demo and account-identity data is permanently deleted.
• Integration credentials, access tokens and connection identifiers (including the WhatsApp phone-number ID, Meta/Google/Telegram settings and SMTP configuration) are permanently deleted; only the financial settings (tax identity, bank details, invoice numbering, payment QR) are retained.
• Full-data restore points and bug-report screenshots in R2 are permanently purged.
• Statutory financial records, the audit trail that supports them, and invoice branding/payment QR codes are retained for the 8-year period in the table above. The retained workspace is not accessible to the former tenant and is not used for any purpose other than legal retention.

This is the default path. Doing nothing after termination does not erase the books early; it moves the workspace into financial-only retention. The split is a controlled operator procedure measured from the termination date we record, not an automatic job that could delete data without review.

4. Permanent erasure at the tenant’s request

A Subscriber may ask us to erase the workspace completely instead of retaining its books. Erasure overrides the retention schedule, including the 8-year financial period, and is available under the DPDP Act 2023 and, for UAE Controllers, UAE Federal Decree-Law No. 45 of 2021.

1. Written request. The request must come from an authorised owner of the tenant and identify the company. We verify the requester and may ask for confirmation through a second channel.
2. Complete export first. Before anything is deleted, we generate a complete export of every tenant SQL table and deliver it securely. Invoice logo and payment QR image files are delivered separately if the Subscriber asks for them. We do not delete on the strength of a verbal request or a checkbox alone. Integration credentials and access tokens (including invitation, demo and demo-lead bearer tokens) are not business data; they are redacted from the export and remain under the platform’s control.
3. Receipt confirmed. The Subscriber confirms it has received and can open the export. The erasure then deletes all tenant SQL data and every tenant-owned R2 object (restore points, logos, QR codes, bug screenshots and other media).
4. Completion record. We write an offboarding receipt and an operator audit row, and send the Subscriber a confirmation. The target is to complete an erasure within 30 days of a verified request.

Because the Subscriber is the seller/taxpayer of record, the Subscriber is responsible for keeping the exported invoice and tax records for its own statutory period. Erasure removes BOS’s copy; it does not shorten the Subscriber’s own obligation.

5. What survives an erasure

• The offboarding receipt. Company id and name, the dates, the number of tables/rows and R2 objects removed, the export receipt, and the legal-acceptance evidence. It contains no business data and is retained for at least 8 years as proof that the contract was performed and the deletion authorised.
• Linear Ventures’ own accounting records. Invoices Linear Ventures issued to the Subscriber, and the corresponding payment/tax records, belong to Linear Ventures’ own books and are retained for 8 years. They are not the Subscriber’s BOS workspace.
• Backups, for a bounded time. Whole-database backups roll off after 14 days, and the database platform’s point-in-time recovery window expires on its own schedule. A backup is never used to restore a specific erased tenant; it exists for disaster recovery of the platform as a whole. This residual copy is not accessible to any tenant or to the offboarding tooling.

6. Legal acceptance evidence

At onboarding we record, server-side, the date and time the Terms of Service, Privacy Policy and Data Processing Agreement were accepted, the version of each document the user saw, and the accepting email address. That evidence lives in the company record and is copied into the offboarding receipt before deletion. A dedicated append-only acceptance ledger is a planned improvement; until it ships, the JSONB record plus the archived receipt is the evidence trail.

7. Service providers and location

BOS stores data on Neon (PostgreSQL) and Cloudflare R2, and runs on Vercel. The current sub-processor list, roles and transfer safeguards are in the Data Processing Agreement §5–§6. Deleting a workspace deletes its rows from the live database and its objects from the BOS R2 bucket; the provider’s own backup/PITR retention is the bounded residual copy described above.

8. Requests and contact

To request an export, erasure, correction or a copy of your data, email support@linearventures.in with the subject line “Data Request” and the company id. We acknowledge within 3 business days and respond within 30 days. The step-by-step deletion page is at /data-deletion.

If you are a customer of a BOS tenant (not the tenant itself), please contact that company first: it is the Controller of your data. We will assist it in responding.

9. Changes to this policy

We publish a new version date whenever this policy changes materially. The version accepted at onboarding is recorded against the company, so a later change does not rewrite what a tenant agreed to. Material changes are notified to the registered owner by email at least 14 days before they take effect.