SpendGuard™ Data Retention Policy
Operated by: Constant Control Limited
Effective Date: 26 March 2026
Reviewed: 12 September 2026 | Next Review Due: April 2027
Contact: privacy@constantcontrol.co.nz
This Data Retention Policy describes how Constant Control Limited ("we", "us", "our") retains, archives, and deletes data within the SpendGuard™ platform. It supplements our Privacy Policy and applies to all organisations and users of the platform.
1. Principles
- Data is retained only as long as it serves a legitimate business, legal, or regulatory purpose.
- Personal data is minimised and anonymised where practical.
- Retention periods are aligned with New Zealand regulatory requirements, including the Privacy Act 2020, the Public Records Act 2005, and the Public Finance Act 1989.
- All retention periods are enforced consistently, regardless of how data was created (UI, API, or integration).
2. Retention Schedule
| Data Category | Retention Period | Basis |
|---|---|---|
| Active account data (profiles, organisations, CSOs, projects, programmes, vendors, transactions) | Duration of subscription | Contractual obligation |
| Audit trail logs (all user actions, data changes, login events, API calls) | 7 years from date of creation | Public Records Act 2005; Public Finance Act 1989; ISO 27001 control A.8.15 |
| Authentication events (sign-in, sign-out, failed sign-in, MFA enrolment) | Recorded in the audit trail; 7 years with it | Security monitoring; NZISM v3.8 Section 17.1. Our authentication provider (Supabase) also keeps short-term service logs under its own retention. |
| API usage logs (endpoint, API key, IP address, status and timing; no request or response bodies) | 90 days from date of creation | Rate limiting; usage dashboards; breach forensics window: 90 days of request metadata is available to investigate suspected misuse of an API key. Security-relevant events (key creation, rotation, revocation, anomalies) are also written to the audit trail and kept 7 years. |
| Support tickets and correspondence | 3 years from ticket closure | Customer service; dispute resolution |
| Email notifications | SpendGuard does not keep email delivery logs. In-app notifications are kept for the duration of the subscription. Our email provider (Resend) holds delivery records under its own retention terms. | Operational monitoring |
| Uploaded files (CSO documents, attachments) | Duration of subscription, then 30 days after account closure | Contractual obligation |
| AI legal review results (findings, which quote short excerpts of the reviewed contract) | Kept with the source document; deleted with the document, CSO or organisation | Contractual obligation; the review is part of the contract record |
| Backup copies | 7 days (standard) / 30 days (enterprise) after source data deletion | Disaster recovery |
| Archived users (deactivated accounts within an active organisation) | Duration of the organisation's subscription | Audit trail integrity; ability to attribute historical actions |
3. Account Closure and Data Deletion
When an organisation's subscription is terminated:
- Within 30 days: On written confirmation from the customer, Constant Control removes the organisation's customer data (CSOs, projects, programmes, vendors, transactions, uploaded files, AI legal review results, user profiles) from production. This is a manual procedure carried out by our operator and recorded in the audit trail, not an automated job; it is completed within 30 days of the termination date.
- Backup purge: Backup copies are purged within the applicable backup retention window (7 days standard; 30 days enterprise) following production deletion.
- Audit logs: Retained for the remainder of the 7-year retention period, then permanently deleted by the nightly retention job. The audit trail is an append-only, tamper-evident ledger: entries cannot be edited after they are written, so the ledger itself keeps the original user name and email address for the full 7 years. When the trail is displayed in SpendGuard or included in an export, entries made by a user whose account has since been deleted are shown as "Deleted user" with no email address.
- Confirmation of deletion: Written confirmation of the date and scope of deletion is available on request after the organisation record has been removed. It is prepared by Constant Control from the deletion audit entry; it is not generated automatically.
4. Audit Log Retention: Detail
Audit logs are retained for 7 years to meet the requirements of New Zealand government agencies subject to the Public Records Act 2005 and the Public Finance Act 1989. This period covers:
- All create, update, and delete actions on contracts, budgets, and spend records
- User authentication events (login, logout, MFA)
- Role and permission changes
- Integration and API key events
- AI consent and configuration changes
- Data export and access events
Audit logs are immutable once written. They cannot be modified or deleted by any user, including administrators. After the 7-year retention period, logs are permanently deleted in automated batch processes.
5. Data Subject Requests
Under the Privacy Act 2020, individuals may request access to or correction of their personal data. Where a data subject requests deletion of their personal data:
- Profile data, preferences, and settings are deleted promptly: the account is disabled and, 30 days later, the nightly retention job replaces the name with "Deleted User" and clears the email address, phone number, avatar, job title and the IP address recorded when the terms were accepted.
- Audit log entries attributed to the user are not deleted or edited, to maintain the integrity of the tamper-evident audit trail; the ledger keeps the original name and email address for its 7-year retention period. Wherever the trail is presented (the Audit Trail page, the IT report, and the organisation data export), those entries are shown as "Deleted user" with no email address.
- This approach is consistent with Information Privacy Principle 9 (IPP 9) and the legitimate interest in maintaining accurate financial records.
6. Data Minimisation
- AI requests for portfolio analysis are anonymised before transmission: organisation, vendor, project and programme names are replaced with codes, and free-text questions are scrubbed of email addresses, phone numbers and account numbers. The same scrubbed copy of the question is what the audit trail stores.
- The AI Legal Reviewer sends the extracted text of an uploaded contract to your organisation's own AI provider after automated redaction of email addresses, phone numbers, NZ bank account, IRD/GST and NHI numbers, street and postal addresses, dates of birth, passport and driver licence numbers, and names in signature blocks, contact lines, salutations and after titles. Personal names in running prose and the parties' company names are not removed. Scanned PDFs and images cannot be redacted; they are sent as uploaded, and only when an administrator has separately enabled scanned document review.
- API usage logs record endpoint, API key, IP address, status and timing but do not store request or response bodies.
- SpendGuard does not store email delivery logs or message content; in-app notifications hold only the notification text shown to the user.
- Backup encryption ensures data at rest is protected throughout the retention period.
7. Review
This policy is reviewed annually. The next review is due April 2027. Material changes will be communicated to customers with at least 30 days' notice.
8. Contact
Privacy Officer: privacy@constantcontrol.co.nz
Constant Control Limited, licensed for business in New Zealand. Servicing a global market for our clients.