ArcAngel CRM
How long each kind of information is kept in ArcAngel CRM, who decides, and how it ends. It is part of the Data Processing Addendum and states what the Service does today; where a figure depends on how the Service is run rather than on its code, it says so.
The organization decides how long its records are kept. While its subscription is active, we never delete an organization's records on our own initiative: funders commonly require records to be kept for years, and only the organization knows which rules apply to it. Everything in the first table is kept until the organization deletes it, asks for its account to be erased, or its subscription has been over for a year (Section 3).
| Information | Kept | How it ends |
|---|---|---|
| Records about people: families and members, community clients, applications and inquiries, case notes, plans and goals, appointments, incidents, finances, program and housing history, pantry visits, volunteers | Until the organization deletes them | The organization can set a keeping period for each kind of record. Reaching it puts a record on a review list for a person to decide; it never deletes anything by itself. |
| Uploaded and signed documents | Until the organization deletes the record they belong to | Archiving hides a document without deleting it. |
| Consent records, including withdrawn consent | With the person's record | A withdrawal is kept, so the record shows what was agreed and when it ended. |
| The audit log | For the life of the account | Deleted with the account on erasure. |
| Staff, volunteer, resident and tenant accounts | Until the organization removes them | A removed person's name stays on what they did, so the history stays true. |
| Feedback and requests for help sent to ArcAngel | For the life of the account | Deleted with the account on erasure. |
| The organization's sign-up: its name, EIN, revenue and level, and what ProPublica's data showed | For the life of the account | Deleted with the account on erasure. The name and email of the person who signed up are removed from it once the account exists. |
| Proof of nonprofit status sent at sign-up | Until ArcAngel has reviewed it | Then deleted; deleted with the account on erasure if sooner. Only ArcAngel staff can open it. |
| A holiday program's season details: children's names, sizes, needs and wishes, and families' and givers' contact details | A set time after the season closes (90 days unless the organization chooses otherwise), or a later date an administrator chooses, provided that such date does not exceed 180 days after the season closes | Erased automatically on that date, and announced in advance. Who took part is kept with the family's or donor's own record, or in the participation log. |
| A request made on the public financial-assistance form that was never screened, or not taken forward, with its papers | One year from when it arrived | Deleted automatically. One taken forward becomes the organization's request and is kept like its other records. |
| Visits in the visitor log, and guests registered by residents | The organization's own retention setting: from 90 days to 3 years (1 year unless changed), after the visit | Deleted automatically. |
| Do-not-admit entries, with their photos | While in force, then the organization's own retention setting after they end or are lifted | Deleted automatically. |
| A holiday program's participation log (who took part and had no record of their own) | Until its expiry date (3 years after the season unless the organization chooses otherwise) | Then listed for the organization to review and delete; never deleted automatically. |
| Information | Lasts |
|---|---|
| A signed-in session | 10 hours, or until the user signs out |
| A password-reset link | 3 days, and one use |
| An invitation to create an account | 7 days |
| An applicant's link to their application | 14 days |
| An emailed link to sign documents | 7 days, and the code for it is never stored in readable form |
| A support session | Up to an hour, and ends when the organization ends it |
| A sign-up that was never paid for, with the name and email of the person who started it | 7 days, or 21 days while a bank payment clears |
| A data export | 7 days; its passphrase is destroyed as it is shown |
| A holiday giver's private link | 120 days, or until a newer one replaces it or the giver is withdrawn |
| Counters that limit repeated attempts | Minutes to an hour |
| Copy | Kept | Notes |
|---|---|---|
| Our hosting provider's database backups | Daily, for the provider's rolling window (currently 7 days), with recovery to a point in time within it | Encrypted by the provider. |
| Our own daily database backups, with our hosting provider and an off-site copy at Backblaze | No more than 90 days | Encrypted with a key held offline, which neither provider has. The off-site copy can't be deleted early, even by us, for its first 30 days. |
| Copies of every stored file at Backblaze | Each copy no more than 90 days; every file is copied again every 28 days | As we store them: each document and upload encrypted under its organization's own key, which Backblaze doesn't have; logos as published. Data exports are never copied. A file deleted from the Service is gone from Backblaze within 90 days. |
| Server logs (addresses and pages requested, never the contents of a record) | No more than 30 days | Used to keep the Service running and secure. |
When an account is erased, the values the Service encrypts — names, dates of birth, contact details, the narrative record and every document — can no longer be read in any backup, because the key that opens them is gone. Values the Service does not encrypt, such as dates and amounts, remain in backup copies until those copies reach the end of the periods above.
A record that the erasure happened: when it was asked for, who confirmed it, when it ran, and how many rows of each kind were deleted. Nothing about the people in it.
Questions about this document? Contact
info@arcangelts.com.
ArcAngel Technical Services, LLC