Data Retention Policy
Effective October 2, 2026
How long Conferus keeps each kind of data, and how it is deleted.
| Data | How long we keep it |
|---|---|
| An organization's data in Conferus (members, dues, events, donations, books, files, emails) | While the subscription is active, then 90 days after it ends; then deleted |
| A member record the organization deletes | Deleted right away (members with payment history are archived instead, to keep the books complete) |
| Staff user accounts | While the user belongs to an organization; then with the organization's data |
| Signed Organization Agreements and Data Processing Addendums | For the life of the account and 7 years after it ends |
| Conferus's own billing and tax records | 7 years |
| Content review and abuse report records | For the life of the account and 2 years after it ends |
| Support conversations | With the organization's data |
| Newsletter subscriptions | Until the subscriber unsubscribes or deletes their data |
| Login rate-limit records | Replaced as each time window passes |
| Error reports and hosting request logs | Per the provider's retention, up to 90 days |
| Website analytics (page views and page-speed measurements) | Up to 400 days, then deleted |
| Database backups | Overwritten on the hosting provider's rolling schedule |
1. Principles
We keep personal data only as long as needed to provide the service, meet legal and accounting obligations, resolve disputes and enforce our agreements. Organizations control the data they store in Conferus and can correct or remove it at any time; this policy describes what Conferus does on its side.
2. Retention schedule
The table on this page lists each kind of data and how long it is kept.
3. Organizations' own records
Organizations are responsible for keeping their own records for as long as their laws require (for example, the IRS generally expects nonprofits to keep financial records for at least 3 to 7 years). Before ending a subscription, an organization should export what it needs to keep: member records, reports and its accounting journal.
4. Deletion
When data reaches the end of its retention period it is permanently deleted from the live database, and removed from backups as they are overwritten. An organization can ask for earlier deletion of its account by writing to privacy@conferus.net; we will confirm when it is done. We may keep data longer when the law requires it or while it is needed for a legal claim or investigation.
5. Review
We review this policy at least once a year and when we change how we store data.
Questions? Write to legal@conferus.net.