Data Retention & Disposal Policy

1. Overview & Principles

SEO Runway is committed to minimizing data storage and strictly preserving data confidentiality. We adhere to core international data privacy frameworks, including the European Union General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and Google API Services User Data Policy.

Our data retention practices adhere to three fundamental rules:

• Storage Limitation: Personal and business data is retained only for as long as necessary to deliver analytical value, fulfill subscription contracts, and satisfy legal audit obligations.
• Continuous User Control: Customers maintain total sovereignty over their workspace data, including self-service data portability export and permanent deletion.
• Immediate Credential Revocation: Disconnecting a third-party service (e.g. Google Search Console, Google Ads, or Meta) immediately severs the OAuth token connection.

2. Data Retention Schedule by Category

The following table summarizes active retention periods across the SEO Runway ecosystem:

Data Category	Description	Active Retention Window	Post-Termination / Deletion
User Account Profile	Name, email, timezone, hashed passwords, RBAC permissions.	Duration of active account	Immediate deactivation; 30-day purge
Project & Client Metadata	Domain names, industry, target markets, channel setups.	Duration of project lifetime	Archived or purged with project
Keyword Rankings (SERP)	Daily historical position tracking and ranking graphs.	3 mos (Starter) / 12 mos (Pro) / 24 mos (Agency)	Purged upon project deletion
Site Audit Raw HTML	Raw crawler responses, HTTP headers, DOM snapshots.	30 days rolling	Automatically pruned; summary preserved
OAuth API Credentials	GSC, GA4, Ads, Meta, LinkedIn access/refresh tokens.	Duration of authorized connection	Instantly destroyed upon disconnect
Billing & Invoices	Tax records, payment receipts, subscription histories.	7 years (Statutory tax compliance)	Retained strictly for legal tax audits
System Logs & Audit Trails	Activity logs, login timestamps, error logs, incident IDs.	90 days rolling	Auto-rotated and pruned
Encrypted Database Backups	Daily and weekly full PostgreSQL encrypted dumps.	14 days (Daily) / 30 days (Weekly)	Permanently rotated and deleted

3. Keyword & SERP History Retention

Historical search engine ranking telemetry is retained based on your active subscription plan:

• Starter Tier: 90 days (3 months) of daily ranking movement.
• Professional Tier: 365 days (12 months) of ranking progression.
• Agency Tier: 730 days (24 months) of historical search intelligence.

If an account downgrades to a lower package or lapses into an inactive state, existing historical ranking data is preserved for 60 days to allow for renewal before automated lifecycle trimming commences.

4. Technical Site Audits & Crawler Snapshots

To optimize infrastructure performance and storage footprint:

• Executive Audit Scores: Overall site health scores, critical error counts, warning categories, and historical audit completion logs are retained permanently for the lifetime of your project.
• Raw Crawl Archives: Granular crawled page URLs, HTTP status codes, and issue lists are retained for 90 days. Detailed raw HTML snapshots are pruned after 30 days.

5. Third-Party OAuth Tokens & Credentials

We treat connected provider credentials with the highest level of security:

• OAuth tokens (Google Search Console, Google Analytics 4, Google Ads, Meta, LinkedIn, and YouTube) are encrypted at rest using Fernet AES-256 encryption.
• When you click Disconnect in your Project Integrations hub or delete a project, tokens are immediately and irreversibly shredded from our database, and ongoing synchronization jobs are terminated.

6. Database Backups & Snapshots

Our automated disaster recovery mechanism generates encrypted database snapshots stored in air-gapped locations:

• Daily Backups: Retained for exactly 14 days, after which they are automatically pruned.
• Weekly Snapshots: Retained for 30 days before rotational destruction.
• All backup archives are encrypted with SHA-256 integrity verification.

7. Account Deletion & GDPR Right to Erasure

Users can initiate self-service account deletion at any time directly within Profile > Security > Danger Zone:

• Immediate Actions: User authentication is invalidated, active subscriptions are cancelled in billing gateways to prevent recurring charges, and connected OAuth tokens are deleted.
• 30-Day Purge Window: In accordance with GDPR guidelines, all personal data, project associations, and stored telemetry are permanently scrubbed from production tables within 30 days.
• Data Portability: Users can download an instant, machine-readable JSON archive of all workspace data prior to deletion.

8. Secure Sanitization & Destruction

When data reaches its retention threshold, it is permanently erased using software-level cryptographic sanitization, rendering it completely unrecoverable across all database nodes and volume snapshots.

9. Compliance & Questions

For inquiries regarding data retention, GDPR requests, or enterprise Data Processing Addenda (DPA), please contact:

SEO Runway Privacy & Data Protection Office
Email: seorunwayai@gmail.com
Official Trust Portal: https://seorunway.com/trust/