How long does an AI vendor keep my data?

There's no single answer per vendor. The same vendor often states one window for customer data on termination and another for backups or logs. Every window we can quote is on this page, grouped by the vendor that published it.

What is a data retention window?

The period a vendor says it will hold a kind of data before deleting or anonymizing it. Three things define it: how long, which data, and what starts the clock. A number without the other two won't answer a customer.

Is 30 days a standard retention period?

It's the most common figure in the pages we hold, but it usually applies to one kind of data, like deletion on request or a backup cycle, not to everything a vendor holds. Read the sentence around it.

Do backups count as deleted data?

Several vendors below say they don't, keeping encrypted backups for a further period after a deletion. Where a vendor says nothing about backups, that silence is what its page says. Ask what happens to the copies.

Where do these retention periods come from?

Pages the vendors publish: privacy policies, data processing agreements, terms and trust pages. Each is quoted with its URL and the date we read it. Nothing is summarized or converted between units.

Resource · Security questionnaires

How long will your AI vendor keep your data?

A customer asks how long their data sits with your vendors. The honest answer is rarely one number: the same vendor often states several, for different data.

Here’s every window we can quote, vendor by vendor.

retention windows stated by 36 AI vendors, each quoted.

of those 36 vendors state more than one window, for different data.

150

of the 186 vendors we watch state no window we could quote. Recorded, with the date we looked.

Shortest: 1 hour (OpenAI). Longest: 7 years (Landing AI). Both are quoted as written. Comparing “13 months” with “365 days” needs a conversion, and no page states the converted figure.

One vendor, several windows.

They differ by what the data is. Answer a questionnaire with the first number you find and you’ll be wrong about the next kind of data, from pages the vendor published side by side.

Anthropic
30 days6 years
Google
72 hours30 days180 days3 years36 months
Intercom
14 days30 days

Read which data a window covers before you quote it. Each one is in the list below.

Then read what starts the clock.

Two vendors quoting the same number can mean periods that end months apart. Each sentence below carries its own starting point.

At termination.
When your contract ends.
When you delete.
From the day you remove something.
At collection.
From the day the data arrived.
When you ask.
From a request you have to make.

Find your vendor.

Open a vendor to see each window, the sentence it came from and the day we read it.

Every window, by vendor

36 vendors

Ada90 days
90 days
“Following termination, Ada retains data for up to 90 days, after which it is deleted or anonymized in accordance with Ada’s Data Processing Addendum.”
ada.cx/legal/privacy-policy · read Oct 11, 2026
Algolia12 months
12 months
“In such case, the IP address of the End User may be sent to a security watchlist in a country that offers an adequate level of data protection and retained for 12 months for security incident handling.”
www.algolia.com/policies/data-processing-addendum · read Oct 31, 2026
Anthropic30 days · 6 years
30 days
“You also are able to delete individual conversations, which will be removed immediately from your conversation history and automatically deleted from our back-end within 30 days.”
anthropic.com/privacy · read Oct 27, 2026
6 years
“The Activity Feed retains data for 6 years.”
platform.claude.com/docs/en/manage-claude/api-and-data-retention · read Oct 27, 2026
AssemblyAI48 hours
48 hours
“For pre-recorded audio, uploads are deleted within 24–48 hours and transcripts after 30 days by default.”
assemblyai.com/security · read Oct 20, 2026
Braze60 days
60 days
“Following termination or expiration of the Braze Services, Braze shall securely overwrite or delete Customer Data within 60 days following any such termination in Braze’s production instance, and in accordance with the Agreement, applicable laws and the Documentation. 22.”
marketing-assets.braze.com/production/hero/Braze-DPA-Rev-July-2024-SIGNED.pdf · read Oct 1, 2026
Demandbase13 months
13 months
“Customer Data is retained during the relationship and with Demandbase and for up to 13 months following the expiration or termination of the relationship.”
www.demandbase.com/security-policy/ · read Oct 25, 2026
Fireflies.ai30 days
30 days
“If you close your account, we will delete personal information related to your account within 30 days.”
fireflies.ai/privacy · read Oct 27, 2026
GitHub90 days
90 days
“Upon Cancellation](#2-upon-cancellation) We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements, but barring legal requirements, we will delete your full profile and the Content of your repositories within 90 days of cancellation or termination (though some information may remain in encrypted backups).”
github.com/terms · read Oct 25, 2026
Gong30 days
30 days
“You can request a custom retention period, and all data is permanently deleted 30 days after contract termination.”
gong.io/security · read Oct 11, 2026
Google72 hours · 30 days · 180 days · 3 years · 36 months
72 hours
“For example, Google stores your chats with your account for 72 hours so it is available in case of a potential system failure.”
support.google.com/gemini/answer/13594961 · read Oct 27, 2026
30 days
“After a recovery period of up to 30 days from that date, Google will comply with this Instruction as soon as reasonably practicable and within a maximum period of 180 days, unless European Law requires storage, where European Data Protection Law applies, or applicable law requires storage, where any other Applicable Privacy Law applies. 6.3. Deferred Deletion Instruction.”
cloud.google.com/terms/data-processing-addendum · read Oct 31, 2026
180 days
“Google will comply with this Instruction as soon as reasonably practicable and within a maximum period of 180 days, unless European Law requires storage, where European Data Protection Law applies, or applicable law requires storage, where any other Applicable Privacy Law applies. 6.2 Return or Deletion When Term Ends.”
cloud.google.com/terms/data-processing-addendum · read Oct 31, 2026
3 years
“It helps us detect and avoid unsafe requests or responses in the future. - Retained for up to 3 years. Reviewed feedback, associated conversations, and related data are retained for up to 3 years, disconnected from your Google Account. Learn how to send feedback or report a problem with Gemini Apps.”
support.google.com/gemini/answer/13594961 · read Oct 27, 2026
36 months
“You can change this to 3 or 36 months, or choose not to auto-delete.”
support.google.com/gemini/answer/13594961 · read Oct 27, 2026
Google Cloud24 hours
24 hours
“Enabling Session Resumption allows the user to reconnect to a previous session within 24 hours by storing cached data, including text, video, and audio prompt data and model outputs, for up to 24 hours.”
docs.cloud.google.com/gemini-enterprise-agent-platform/resources/zero-data-retention · read Oct 27, 2026
HubSpot30 days
30 days
“Any stored public YouTube API data is refreshed or completely deleted within 30 calendar days, or deleted immediately upon user request.”
hubspot.com/privacy · read Oct 15, 2026
Insider180 days
180 days
“Following termination or expiration of the Services, Insider One shall securely overwrite or delete Customer Data within 180 days following any such termination, in accordance with the Agreement, applicable laws and the Documentation. - Reliability and Backup All networking components, SSL accelerators, load balancers, Web servers and application servers are configured in a redundant configu…”
useinsider.com/legal/dpa · read Oct 12, 2026
Intercom14 days · 30 days
14 days
“Customer Personal Data from our back-up systems will be deleted 14 days after deletion of the Customer Personal Data from our main/live system, except where Intercom is required by Applicable Data Protection Legislation to retain some or all of the Customer Personal Data, which Intercom will securely isolate and protect from any further processing, except to the extent required by applicable law.…”
intercom.com/data-processing-agreement · read Oct 30, 2026
30 days
“Intercom will permanently and securely delete all live (online or network accessible) instances of the Customer Data within 30 days upon Customer’s in-app deletion request.”
intercom.com/data-processing-agreement · read Oct 30, 2026
Landing AI7 years
7 years
“Your data will normally be stored for up to 7 years in order to meet our legal obligations and protect our interests.”
landing.ai/privacy-policy · read Oct 1, 2026
LiveKit30 days
30 days
“LiveKit may maintain encrypted backups of Customer Content for up to 30 days following deletion for disaster-recovery purposes, after which such backups are securely purged. 9.1 Retention Required by Law.”
livekit.io/legal/data-processing-addendum · read Nov 2, 2026
Lovable30 days · 90 days
30 days
“Upon account termination or expiration (including forfeiture of unused Credits as per the Terms), we will delete your Personal Data within 30 days, except for data required for fraud prevention, legal compliance, or legal defense purposes.”
lovable.dev/privacy · read Sep 7, 2026
90 days
“Backups may retain data for up to 90 days.”
lovable.dev/privacy · read Sep 7, 2026
Make30 days
30 days
“By default, log data is stored for 30 days.”
make.com/security · read Oct 21, 2026
Microsoft90 days
90 days
“Except for free trials and LinkedIn services, Microsoft will retain Customer Data that remains stored in Online Services in a limited function account for 90 days after expiration or termination of Customer’s subscription so that Customer may extract the data.”
www.microsoft.com/licensing/docs/documents/download/MicrosoftProductandServicesDPA(WW)(English)(May2026)(CR).docx · read Oct 1, 2026
Nebius18 months
18 months
“When we process partially obscured copies of your ID for KYC purposes, we retain them for a maximum of 18 months in order to maintain the necessary records for our yearly audits.”
nebius.com/privacy-policy · read Oct 27, 2026
18 months
“When we process partially obscured copies of your ID, we retain them for a maximum of 18 months in order to maintain the necessary records for our yearly audits.”
nebius.com/privacy-policy · read Sep 13, 2026
New Relic90 days
90 days
“Return or Deletion of Data ** Upon receipt of Customer’s written request, New Relic shall (at Customer's election) return Personal Data or close Customer’s account and delete all Personal Data within 90 days of the termination, save that this requirement shall not apply to the extent New Relic is required by applicable law to retain some or all of the Personal Data, which Personal Data New Relic …”
newrelic.com/termsandconditions/dataprotection · read Oct 9, 2026
Notion60 days
60 days
“AI embeddings are deleted within 60 days of page or workspace deletion.”
trust.notion.com/subprocessors · read Nov 2, 2026
NVIDIA90 days
90 days
“Upon termination of the Agreement, or at Customer’s written request, NVIDIA will delete Customer Data in its possession or control within 90 days unless NVIDIA is required by applicable law to retain Customer Data or an alternative agreement is agreed upon.”
www.nvidia.com/en-us/agreements/data-processing-addendum/nvidia-cloud-services-data-processing-addendum/ · read Nov 1, 2026
OpenAI1 hour · 30 days
1 hour
“Audio outputs application state is stored for 1 hour to enable multi-turn conversations.”
developers.openai.com/api/docs/guides/your-data · read Oct 27, 2026
30 days
“Once you choose to delete Personal Data, we will remove it from our systems within 30 days unless we need to retain it for longer as described below, or it has already been de-identified and disassociated from your account when you allow us to use your Content to[improve our models](https://help.openai.com/articles/5722486-how-your-data-is-used-to-improve-model-performance…”
openai.com/privacy · read Oct 27, 2026
30 days
“By default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days, unless longer retention is required by law, or is reasonably necessary to protect our services or any third party from harm.”
developers.openai.com/api/docs/guides/your-data · read Oct 27, 2026
Qdrant90 days
90 days
“IP addresses are generally only stored for a maximum of 90 days and then deleted.”
qdrant.tech/legal/privacy-policy · read Oct 30, 2026
Rev12 months
12 months
“All other categories of sharing described in this Privacy Policy exclude text messaging opt-in data and consent. Retention. We keep call recordings and transcripts for 12 months unless needed longer to resolve a dispute or comply with law.”
rev.com/legal/privacy · read Oct 30, 2026
Sourcegraph365 days
365 days
“Logs are stored in GCP and the information is retained for up to 365 days.”
sourcegraph.com/security · read Sep 7, 2026
Spellbook30 days · 90 days
30 days
“(v) Abuse Monitoring. Solely with respect to Customers and Users accessing the Spellbook AI Platform through self-service onboarding options, Spellbook may collect, retain for up to 30 days (or longer if required for ongoing investigations or legal compliance), and use Customer Data (including Inputs) to detect and prevent malicious, abusive, or illegal activity.”
spellbook.legal/terms-of-service · read Oct 18, 2026
90 days
“QA Data will be: (A) retained for no longer than 90 days from the date of collection, then permanently deleted;”
spellbook.legal/terms-of-service · read Oct 18, 2026
Toloka30 days
30 days
“The email address submitted for verification is deleted from the verification provider’s systems within 30 days.”
toloka.ai/legal/privacy-notice · read Oct 28, 2026
UiPath3 months
3 months
“Recordings will be kept for up to 3 months.”
uipath.com/privacy-policy · read Oct 23, 2026
Ultralytics12 months
12 months
“For the Ultralytics Platform (SaaS), technical logs, access logs, and system backups are retained for up to 12 months and then deleted or anonymized.”
ultralytics.com/privacy · read Oct 31, 2026
Vectra AI90 days
90 days
“AWS Data older than 90 days will be deleted. ‍ 4. End User Administrator and Grant of Access. An AWS Administrator at End User must provide VECTRA with consent to access the AWS Data.”
www.vectra.ai/legal/terms-of-service · read Nov 1, 2026
Weaviate5 years
5 years
“We retain your personal data for a period of 5 years or as long as required to realize the objectives as described in this privacy policy.”
weaviate.io/privacy · read Nov 1, 2026
Wiz63 days · 180 days
63 days
“Notwithstanding Wiz's data retention policy, if upon termination, Customer requests expedited deletion of its Customer Data, Customer Data shall be deleted within 63 days. 3.5.”
wiz.io/data-processing-agreement · read Oct 23, 2026
180 days
“We retain most types of Service Data for a set period of up to 180 days (the exact number depends on the specific type of data).”
wiz.io/legal/privacy · read Oct 30, 2026
Workato30 days
30 days
“In general, the retention period is 30 days unless otherwise configured by the data exporter, and in no case exceeds 90 days.”
assets.ctfassets.net/khy5qy7zbpmq/5WZQn48Q35CcQvqCsehisP/b10c6bdfe7c148771e92312154178583/Workato_Data_Processing_Addendum_Websites_2025-03-17.pdf · read Sep 30, 2026
xAI30 days
30 days
“Private Chat and User Content that you request to be deleted will be queued for deletion, which may take up to 30 days, except as required by law.”
x.ai/terms-of-service · read Oct 30, 2026
30 days
“For example, when Private Chat is turned on, conversations will not appear in your conversation history and your conversations will be deleted from SpaceXSI systems within 30 days unless it is necessary that they be kept longer for legal, compliance, or safety purposes.”
x.ai/privacy-policy · read Oct 25, 2026

What to ask for at renewal.

Three questions turn a published number into an answer you can give a customer.

Which data it covers.
And which data is left out. Backups, logs and telemetry are the usual exceptions.
What starts it.
Termination, deletion, collection or a request. The same number means different things.
What happens to the copies.
A deletion that leaves encrypted backups for another ninety days is a different promise from one that doesn't.

A window on a trust page can change without anyone telling you. What your agreement obliges the vendor to send usually covers sub-processors (the companies your vendor hands your data to), not retention. A retention change often arrives as an edit and nothing else.

Download the retention list.

The same list as a Word document, with every quote, source and read date. It’s generated when you download it, so it matches what the vendors’ pages say that day.

What counts as a window.

Quoted, never converted.
Each window is the vendor's own sentence, with the URL and the date we read it. Hedges stay in.
Repeats are kept.
Where a vendor states a window in two places, both sentences are shown. They're often about different data.
Only real windows.
An age limit, a regulatory lookback or a response deadline can sit next to “delete.” Only a number that bounds how long data is held appears here.

Nothing is summarized or scored. How Xither reads a page.

Common questions.

How long does an AI vendor keep my data?
There's no single answer per vendor. The same vendor often states one window for customer data on termination and another for backups or logs. Every window we can quote is on this page, grouped by the vendor that published it.
What is a data retention window?
The period a vendor says it will hold a kind of data before deleting or anonymizing it. Three things define it: how long, which data, and what starts the clock. A number without the other two won't answer a customer.
Is 30 days a standard retention period?
It's the most common figure in the pages we hold, but it usually applies to one kind of data, like deletion on request or a backup cycle, not to everything a vendor holds. Read the sentence around it.
Do backups count as deleted data?
Several vendors below say they don't, keeping encrypted backups for a further period after a deletion. Where a vendor says nothing about backups, that silence is what its page says. Ask what happens to the copies.
Where do these retention periods come from?
Pages the vendors publish: privacy policies, data processing agreements, terms and trust pages. Each is quoted with its URL and the date we read it. Nothing is summarized or converted between units.

Answer a questionnaire

More for this job.

See every resource

This is not legal advice. The pages quoted are published documents read on the dates shown; your negotiated contract governs over anything here. Everything on this page is free to read, and corrections are free to request.