Version 2026-07-28-v1

Account and Data Deletion

Last updated: 28 July 2026

This page explains how HisaBooks handles individual-account deletion, company-workspace closure, retention windows, backups, and the request-verification process. It is the explanatory policy page; the live request and tracking flow remains the Data and Account Requests page.

Deletion is verified and staged. HisaBooks does not treat deletion as an instant button that erases every record immediately. Identity, authority, exports, billing, retention, and backup timing are checked before irreversible actions are recorded.

1. What can be requested

Request	Who typically submits it	Important note
Delete my individual user account	An individual user who wants their login profile removed or anonymised where business-record retention still allows it.	Access is revoked first. Business records that the company must retain do not automatically disappear just because one user account is deleted.
Close and delete a company workspace	A verified company administrator or owner closing the whole workspace.	Closure and deletion are staged. Export, billing, authority, legal-hold, backup, and statutory-retention reviews happen before irreversible purge.
Access or export my data	A requester who needs a copy of eligible data before deciding whether deletion is the right next step.	Export can be prepared without immediately deleting records, and it is often part of the verified deletion flow for company closure.

2. Important deletion notes

Deletion and subscription cancellation are separate actions. A deletion request does not automatically cancel a paid subscription.
Deleting or uninstalling the desktop or mobile app does not close the server account or delete retained workspace data.
Company closure requires verified administrator authority. It cannot be requested by an ordinary workspace user on behalf of the whole company.
Accounting, tax, payroll, employment, billing, audit, dispute, and security evidence may remain retained even after access is closed.

3. Individual account deletion flow

This flow applies when one person's login account is being removed or anonymised without closing the whole company workspace.

User data export offered
Requester has been offered a copy of eligible account data or a not-required reason is recorded.
Customer-controller routing checked
If the data belongs to a customer workspace, the relevant company administrator has been routed or notified where appropriate.
Statutory retention reviewed
Accounting, tax, payroll, employment, dispute, and customer-controller retention needs are mapped before deletion.
Deletion scope locked
The exact accounts, tables, uploads, tokens, and retained categories are documented.
Business records preserved
Records that must remain for the customer, tax, payroll, audit, or dispute reasons are retained or anonymised safely.
User access revoked
The individual login, sessions, reset links, invites, and push tokens are revoked or queued for revocation.
Provider actions recorded
Stripe, email, storage, push, analytics, and other provider actions are recorded where relevant.
Physical purge recorded
Non-retained operational records are purged only after legal/retention checks; retained business records remain preserved.
Backup expiry recorded
Backup retention window and expected expiry date are recorded; any longer hold has a reason.
Final notice sent
Requester-facing completion notice explains completed action, retained categories, and backup timing.

4. Company closure and deletion flow

This flow applies when a verified company administrator or owner is closing the workspace itself.

Workspace export prepared
Export or handover package is prepared for the verified company administrator before closure.
Subscription and billing reviewed
Cancellation, downgrade, refunds, unpaid invoices, and paid-through dates are reviewed separately from deletion.
Closure window confirmed
The 30-day reversible closure window and final purge target are documented for the company.
Statutory retention reviewed
Accounting, tax, payroll, employment, dispute, and customer-controller retention needs are mapped before deletion.
Deletion scope locked
The exact accounts, tables, uploads, tokens, and retained categories are documented.
Business records preserved
Records that must remain for the customer, tax, payroll, audit, or dispute reasons are retained or anonymised safely.
Workspace access closed
Workspace access, active sessions, reset links, invites, and push tokens are closed or queued for closure.
Provider actions recorded
Stripe, email, storage, push, analytics, and other provider actions are recorded where relevant.
Physical purge recorded
Non-retained operational records are purged only after legal/retention checks; retained business records remain preserved.
Backup expiry recorded
Backup retention window and expected expiry date are recorded; any longer hold has a reason.
Final notice sent
Requester-facing completion notice explains completed action, retained categories, and backup timing.

The current closure design includes a recoverable 30-day closure window before irreversible primary-system purge begins, followed by the recorded purge target unless statutory or legal exceptions apply.

5. Retention, backups, and exceptions

Category	Current period	What happens	Why it exists
Active workspace data	While the workspace is active	Retain until the customer deletes it, closes the workspace, or retention is no longer needed.	Service delivery and customer instructions.
Closed workspace grace window	30 days after verified closure approval	Keep workspace recoverable while exports, billing, and authority checks are confirmed.	Operational recovery and customer protection.
Closed workspace purge target	90 days after the grace window unless a legal hold or statutory duty applies	Purge non-retained workspace content from primary systems and record completion evidence.	Data minimisation after service end.
Individual user login account	30 days after verified individual deletion approval	Disable access immediately after approval, then delete or anonymise login profile data not needed for retained business records.	Account security and controller/customer record duties.
Invoices, quotes, payroll, GST/tax, accounting, and employment records	Minimum 7 years from the relevant financial year end, or longer where local law, dispute, audit, or customer duty requires	Retain as business records even when a user account is removed; restrict access where possible.	Accounting, tax, payroll, employment, dispute, and statutory obligations across supported markets.
Document Studio issued-document render evidence	Minimum 7 years from the relevant financial year end, or longer where tax, dispute, audit, customer-controller, or legal-hold duties require	Retain immutable issue-time render evidence with its business record. Do not make it a direct workspace purge target.	Historical document reproduction, accounting/tax evidence, dispute handling, and customer-controller duties.
Document Studio design and publication audit evidence	2 years online, then up to 5 additional years in restricted archive if needed	Retain enough version, publication, and access evidence for security investigation and document-control accountability.	Security operations, accountability, and controlled document lifecycle evidence.
Subscription, payment, invoice, refund, and legal acceptance records	7 years after account closure or last transaction	Retain transaction and acceptance evidence; do not keep full card data in HisaBooks.	Tax, accounting, contract, fraud prevention, and dispute evidence.
Security, audit, access, and admin-operation logs	2 years online, then up to 5 additional years in restricted archive if needed	Keep enough evidence for security investigation, abuse prevention, and regulatory response.	Security operations and accountability.
Support tickets and privacy request evidence	7 years after final response	Retain request, verification, decision, and execution evidence with sensitive attachments avoided.	Rights-request accountability and dispute evidence.
Sessions, reset links, invite links, and push tokens	Expire by configured TTL; stale tokens purged within 30 days	Revoke on logout, password reset, verified deletion, or security event where supported.	Authentication security and least retention.
Desktop and mobile local app data	Until logout, account removal, clear-storage action, or uninstall on the device	Server closure does not automatically erase every device cache; app users must remove local accounts where needed.	Operating-system controlled local storage.
Restricted backups	35 days rolling target unless disaster-recovery, legal hold, or provider constraints require longer	Do not restore deleted data except for recovery necessity; re-apply valid deletions after restore.	Disaster recovery balanced with deletion commitments.

These retention rules mean that deletion can close access and purge non-retained operational content while still preserving records that accounting, tax, payroll, employment, dispute, security, or legal obligations require.

6. Provider and system actions

Deletion review is not limited to one application table. The verified workflow also records what happened across relevant providers and system boundaries.

Area	What is recorded
Stripe billing records	Record subscription cancellation, refund, paid-through, invoice, tax, and retention evidence. HisaBooks does not store full card data.
Email delivery records	Record any suppression, bounce, complaint, support-email retention, or no-action reason for requester email addresses.
Uploaded files and exports	Record which uploads, generated PDFs, export packages, or retained business documents were deleted, preserved, or out of scope.
Mobile push tokens	Confirm app push-token cleanup in HisaBooks and provider delivery scope after access closure.
Backups and restore replay	Record backup expiry timing and how deletion/access closure will be re-applied if a backup is restored.

7. How to submit or track a request

Use the Data and Account Requests page to submit a new request or track an existing request reference. For company closure, the requester must be a verified company administrator or owner.

If you need privacy help before submitting, email support@hisabooks.com. For broader privacy context, read the Privacy Policy. For subscription, cancellation, and paid-plan effects that are separate from deletion, read the Subscription Policy.