Data retention
A line manager or buddy without a work inbox will soon be able to get their check-ins by WhatsApp instead of email.
Update of 7 October 2026
Automatic deletion is not switched on yet. Some of the automatic deletion described on this page is built but switched off, and some of it is not built yet. We plan to switch on and build it after launch, and we will update this page, with the date, as each part starts.
Until then, nothing in the table below is deleted automatically. We keep the information until it is deleted, and we delete it when we are asked. A person, or the organisation they are with, can ask us to delete that person's information, and an organisation can ask us to delete all of its information. We do this by hand. We do not delete anything that the law requires us to keep, or that is under a legal hold.
The periods in the table are the periods we intend to keep to once automatic deletion is on. Until then they are our aim, and not yet what happens.
The rule of thumb: check-in data exists to support a person's first months, so we intend to keep it for the programme and a short tail, and then remove it. This is the aim of the storage limitation principle in Article 5(1)(e) of the GDPR, that personal data is kept in identifiable form no longer than is necessary for the purpose it was collected for. The update above says what is running today.
| Data | Kept for | Then, once automatic deletion is on |
|---|---|---|
| Check-in answers and notes | For a person who has left: the onboarding programme plus 12 months. For anyone else: while their record exists | Deleted |
| Follow-up (mark done) records | Same as check-in answers and notes | Deleted |
| Private word requests | Kept with the check-in they were sent with | Deleted with it |
| Notes the head of people writes about a new starter | While the starter's record exists | Deleted with the starter's record. No separate period is set |
| Starter profile and contact details (name, role, dates, and the email addresses of starters, managers and buddies) | While the account is open | Not deleted automatically. Deleted by hand when the organisation asks. A routine for closed accounts is not built yet |
| Unused check-in and invite links | 14 days | The link stops working after 14 days. The unused record is removed |
| Email delivery log | 12 months | Deleted |
| WhatsApp message log (the phone number a message was meant for, and whether it was delivered) | While the starter's record exists | Deleted with the starter's record. No separate period is set |
| A record of what each weekly email covered (which new starters it counted, and their marking at the time; never their answers or notes) | While the member's or the organisation's record exists | Deleted with it. No separate period is set |
| Safeguarding records (when a concern was picked up, its category, who was contacted and when it was handled) | No fixed period has been set yet | Not deleted automatically. We will set a period deliberately and state it here |
| Billing records | As tax law requires | Kept for that period. Deleting them is not built yet, so we will delete them by hand once it has passed |
| Pseudonymised signal history (weekly scores by topic, band, and broad role and seniority category, linked to the starter and organisation record) | While the linked starter and organisation record exist, to improve accuracy over time | Loses its link to any individual automatically once the starter or organisation record is deleted. It never includes a name, email address, job title text, or free-text answer |
Erasure requests are honoured ahead of this schedule. We do this by hand for now, save for anything the law requires us to keep. The automated sweep is not switched on yet. When it is, it will run weekly and its actions will be logged.
Separately from the check-in answers above, a narrower structured record is kept for longer: which topic scored where, in which week, and whether it was flagged, together with a broad role and seniority category. This is what allows the underlying model to be checked and corrected against real outcomes over time, rather than left as an untested assumption indefinitely. It does not include a name, an email address, a job title in free text, or any note someone wrote, and it is not linked back to a specific check-in answer once that answer’s own retention period above ends. It IS still linked, by reference, to the starter and organisation it belongs to, so it remains personal data under the GDPR (pseudonymised, not anonymised) for as long as that starter or organisation record still exists, with the same rights that apply to any other personal data we hold. Once the linked starter or organisation record is deleted, this history loses that link automatically and can no longer be traced back to any individual.After that link is lost, the history has nothing left that identifies anyone. We intend to delete it once it is more than 3 years old, once automatic deletion is switched on.
Records added on 7 October 2026
Updated 7 October 2026: the three records below were added to this policy.
Late joiner catch-up answers. When a starter joined partway through their first months, their own manager can answer four short questions about them, once. We keep the manager's four replies, who gave them and when. Only that manager can read them back, and they do not change anything Accolgo shows about the starter. We keep them on the same terms as that starter's check-in answers, described above. Once automatic deletion is switched on, we intend to delete them at the same time as those check-in answers. Until then we delete them by hand when we are asked. They are also deleted when the starter's record is deleted.
Contract end date. For a temporary starter, you can enter the date their contract ends. After that date Accolgo sends no more check-ins for them. We keep only the date, with the starter's record, on the same terms as that starter's check-in answers, described above. Once automatic deletion is switched on, we intend to delete it at the same time as those check-in answers. Until then we delete it by hand when we are asked. It is also deleted when the starter's record is deleted.
Away email records. Every four weeks Accolgo emails managers and buddies to ask whether they are away. So that the same email is not sent twice, we first record the email address, your account and the four-week period. We keep these records on the same terms as the other records on this page. Once automatic deletion is switched on, we intend to delete each of them 90 days after it is made. Until then we delete them by hand when we are asked. When an organisation is deleted, its away email records are deleted with it. If an email does not send, its record is removed straight away.