Consent record retention

Consent record retention is plan-dependent. There is no single global figure, and any document that gives you one is describing a plan rather than the product.

The windows

Each plan in the shipped product catalog carries a consent retention value in months:

Teams whose subscription has lapsed fall back to the same window as Free.

Enterprise is the exception worth checking. The 84-month figure comes from the current product catalog. Enterprise catalog entries created before the retention field existed were backfilled as unlimited instead, and the job's own fallback for an enterprise entry with no retention value is also unlimited. A team resolving to unlimited is skipped by the purge entirely and its consent records are never deleted. Whether a given Enterprise account is on 84 months or unlimited therefore depends on when and how its catalog entry was created — if that distinction matters to your obligations, confirm your account's effective value rather than assuming the table.

Where you see your own value: each plan's retention window is listed with that plan's usage limits on the public pricing page. Platform operators can also apply a per-customer override, which takes precedence over the catalog value — if an override was agreed for your account, the agreed figure governs, and the pricing page will not reflect it.

How the effective window is resolved

A daily job resolves each team's window in a fixed order and stops at the first value it finds:

1. a per-customer override, then
2. the value on the team's catalog entry, then
3. a per-plan fallback for catalog rows that predate the field, then
4. the minimum window.

The result is then raised to a floor of 12 months. A configuration that asked for a shorter window than that would be ignored in favour of the floor, so twelve months is the shortest period any consent record is kept.

A window can also be set to unlimited, in which case the team is skipped entirely and nothing is deleted.

What deletion does

The job runs daily. For each team it computes a cutoff date, then deletes consent-log rows created before that cutoff in batches of five thousand until none remain. Deletion is permanent: rows are removed from the table, not flagged. There is no undelete, and the job supports a dry-run mode that reports the counts it would delete without touching anything.

Two consequences worth planning for:

• Export before the window closes if you need the records longer. Once the job has run, the rows are gone; a longer plan window applied afterwards does not bring back what was already deleted.
• Retention is measured from record creation, not from the visitor's last visit. A visitor who consented once and never returned has their record deleted a window after that consent, whether or not the consent was still being relied upon.

What this window does not cover

This window governs consent records only. It is not your retention policy, and it does not decide how long you should keep evidence of consent — that depends on your limitation periods and your own analysis. Other data in the product is governed separately; administrative audit records, for example, have their own fixed window described in Audit trail.