Data retention and subprocessors
One page with the numbers on it, because a retention promise you have to hunt for is not much of a promise.
Last updated . Applies to frisket.robomiri.com, operated by Robomiri.
The schedule
| What | Deleted after | Why that long |
|---|---|---|
| Files you upload | 2 hours | A job has to be able to read the file while it runs, and you have to be able to retry a failed conversion without re-uploading. Neither needs longer. |
| Converted files and generated documents | 24 hours | Long enough that a download link still works the next morning, short enough that we are not a copy of your records. |
| Verification reports and their reference numbers | 30 days | A report is evidence: whoever you sent it to must be able to check it against the reference number for a reasonable period. Reports contain the check result and the document hash, not the document. |
How the deletion actually happens
A sweep runs on a fixed interval and deletes everything past its window — from object storage and from the database record that points at it. It is a background job configured with the same numbers printed in the table above, which is the point: this page is generated from the same configuration the platform enforces, so the policy cannot drift away from the behaviour.
Deletion is not conditional on you asking. You can delete sooner from your account, and the sweep will not resurrect anything you removed.
What survives the sweep, and for how long
- Backups. Encrypted database backups rotate on a fixed schedule and expire within 30 days. A record deleted from the live system can persist in a backup until that backup expires. Backups are restored only to recover from a failure.
- Report references. A verification report keeps its reference number and the document hash for 30 days so a recipient can check it. The hash is a fingerprint: it proves a document matches, and it cannot be turned back into the document.
- Account and billing records. Kept while your account exists; invoices are kept for the statutory period, which is longer than anything else here and is not something we can shorten.
- Technical logs. Kept for 30 days for debugging and abuse investigation. They record which request happened, never what was in the document.
Subprocessors
These are every third party that processes data for us. The final column is the one worth reading: it says whether the content of your documents can reach them at all.
| Subprocessor | What they do for us | Where | Can they see document content? |
|---|---|---|---|
| Hetzner Online GmbH | Application hosting, database, and object storage | Germany (EU) | Yes |
| Stripe Payments Europe, Ltd. | Payment processing and billing records | Ireland (EU), with transfers to the United States under Stripe’s SCCs | No |
| Anthropic PBC | Model inference for extraction steps that need it | United States, under standard contractual clauses | Yes |
Additions are published here at least 30 days before they start processing. See the data processing agreement for your right to object, and the privacy policy for the rest.