DATA RETENTION & DELETION POLICY.
Retention principles for contacts, investor records, documents, sessions, keys, and communication safeguards.
LH / 17 / VERSION 2026.10 / PRIVACY & DATAPurpose-based retention
Inquiry, relationship, project, task, message, document, and review records may be retained as needed for the relevant business purpose, security, applicable obligations, separate agreements, and resolution of disputes. This site does not apply a single automatic deletion deadline to every business record.
Defined technical expirations
Invitation tokens expire after seven days. Personal connected-tool keys expire after 90 days unless revoked or rotated sooner. Authentication sessions and rate-limit records have technical expirations, and optional analytics events expire after 90 days. These technical expirations do not automatically erase all associated business records.
Documents and imported files
Raw import files and project documents use private object storage. Removing document access marks it unavailable through normal portal routes; underlying bytes, metadata, backups, or relevant activity records may remain. A UI removal is not a representation of immediate secure physical destruction.
Suppression and approval records
A minimal suppression record may be retained to honor a marketing opt-out and prevent accidental re-enrollment through another import. Campaign approval, recipient, provider receipt, and draft-review records support accountable operations. Deletion requests are evaluated in light of these purposes and any applicable requirements.
Requests, holds, and third parties
Request access review or deletion through the Contact page. Reasonable verification may be needed. Applicable preservation duties, disputes, security investigations, or third-party systems can affect what can be deleted and when. Lossless cannot guarantee deletion from an independent external AI client or other recipient's systems; those parties have their own responsibilities.