Retention and deletion

DataRetention
Free production submissionsRolling 90 days
Active paid production submissionsWhile the paid subscription is active
Sandbox submissions on every planRolling 30 days
Spam quarantine14 days
Lead trash7 days
Deleted project or form recovery30 days
Background export artifact24 hours
Failed webhook response snippet30 days

When a paid subscription ends, its existing production submissions enter a one-year read/export-only archive. Notes, tags, status, archive/spam state, read state, and webhook replay cannot change. Viewing, CSV/NDJSON export, explicit redaction, and confirmed permanent deletion remain available. Operational warnings are sent at 180, 90, 60, 30, 14, 7, 3, and 1 day before archive deletion.

Account deletion disables all submission endpoints immediately and starts a 30-day recovery window. It requires recent password confirmation and sends confirmation plus reminder emails. Recovering in time re-enables the account; after purge, active-system recovery is unavailable. Backup-media deletion timing is intentionally not promised until the deployment backup policy is finalized.

Permanent deletion and retention expiry also remove webhook events containing the lead's fields, including their delivery attempts. Identifier-only deletion notifications remain deliverable. Usage history retains its counted units without retaining a reference to the deleted lead.