Developer docs · Reference

Data retention & export

A plain-English breakdown of what data SalesThumb stores, how long we keep it, why, and how to get it out. This page covers the technical details; see /privacy for the legal privacy policy.

Infra on SOC 2 Type II providersSelf-serve CSV/JSON export540-day PII auto-redaction on quotes/invoicesDeletion on request

Retention by data category

Periods below apply to data stored in the SalesThumb platform. Third-party processors (Rainforest and Stripe for payments, Resend for email, R2 for media) have their own retention policies which may differ.

Data category	Retention period	Reason
Appointments, quotes & invoices Appointments, quotes, invoices, line items, totals Kept for the life of the account (no automatic purge)	Kept for the life of the account (no automatic purge)	Business and tax record-keeping. On an explicit deletion request, PII fields (signatures, notes) are anonymized; totals and line items are kept as your financial history.
Quote/invoice sign-off PII Customer approval & completion signatures, quote/invoice notes Auto-redacted 540 days after creation	Auto-redacted 540 days after creation	PII stops being needed once the standard chargeback-dispute window has long closed; the invoice/quote record itself is kept.
Payment records Payment transactions, refunds, processor charge IDs Kept for the life of the account (no automatic purge)	Kept for the life of the account (no automatic purge)	Tax and PCI-adjacent record-keeping.
Customer & vehicle records Customer profiles, vehicle make/model/VIN, contact info Kept for the life of the account (no automatic purge)	Kept for the life of the account (no automatic purge)	Active business data. Removed only via an explicit deletion request, not automatically on subscription cancellation.
Tint compliance waivers Signer name, signature, IP address at sign-time Signer identity auto-redacted 10 years after signing	Signer identity auto-redacted 10 years after signing	The compliance record (state, VLT values, violations) is kept for citation defense; the signer's identity isn't needed that long.
Payment-agreement acceptances Who accepted the Payment Processing Agreement, which version, when, from what IP/browser Kept through a deletion request; name/email/IP/browser auto-redacted 7 years after acceptance	Kept through a deletion request; name/email/IP/browser auto-redacted 7 years after acceptance	Our payment processor requires documented proof that your shop agreed to the Payment Processing Agreement, so this is the one record we keep rather than erase on a deletion request (GDPR Art. 17(3)(b)/(e)). On such a request we still clear the IP address and browser user-agent — they aren't needed to prove consent. The agreement name, version and acceptance date are kept indefinitely; they don't identify anyone.
Media & photos Job photos captured in the app No fixed window yet	No fixed window yet	A storage-lifecycle process exists but isn't enabled by default today. Export via Settings → Data if you need to keep copies.
Audit logs Who changed what, login events, API key usage, permission changes Kept indefinitely today (no automatic purge)	Kept indefinitely today (no automatic purge)	Security investigation and compliance. Logs are append-only and cannot be modified.
API keys Shop API keys, restricted-scope keys Deleted immediately on revoke	Deleted immediately on revoke	Security. Once revoked, a key cannot be recovered.
Webhook delivery logs Request payload, response status, retry history per delivery Kept indefinitely today (no automatic purge)	Kept indefinitely today (no automatic purge)	Debugging history.
Session & auth tokens User session tokens Revoked immediately on logout or admin action	Revoked immediately on logout or admin action	Security hygiene. There is no automatic inactivity-based expiry today.

Data portability & export

You own your data. SalesThumb provides two export paths:

Self-serve CSV export

From Settings → Data, export CSV files for:

Customers — name, email, phone, notes, created date
Vehicles — year, make, model, VIN, license plate, linked customer ID
Appointments — date, service type, status, technician, customer, vehicle
Invoices — line items, totals, payment status, paid date
Payments — amount, method, reference, linked invoice

Downloads are generated on demand as CSV or JSON — no waiting, no email delivery. A separate scheduled-export feature (also in Settings → Data) can run these on a recurring basis if you need an ongoing feed.

Full account data export

For a complete bundle covering your account and staff profile beyond what the self-serve export above covers, use the data request form (choose "Send me a copy of my data") with the email address on your account. You can also email info@roffik.com from the account owner address instead — include your shop name and the export scope you need.

Filing the request is self-serve either way; fulfilling it is still a manual step on our side today, so we don't promise a fixed number of days — the form aims for about 30.

Account closure

Canceling your subscription stops billing and disables login access for your shop — it does not automatically delete any data. Your records stay in place, unchanged, until you either reactivate or ask us to delete them (see below).

If you want your data deleted rather than just the subscription canceled, that's a separate, explicit request — see Deletion requests below. Export anything you need from Settings → Data before requesting deletion; once processed, it can't be undone.

Deletion requests (GDPR / CCPA)

To request deletion of your account and its associated personal data, use the data deletion form (choose "Delete my personal data") with the email address on your account. You can also email info@roffik.com from the account owner address instead, with the subject line "Deletion request — [shop name]".

Either way, requests are reviewed and processed by our team — this is a manual, admin-mediated step today rather than a fully automated flow, so we don't promise a fixed number of days (the form aims for about 30). Processing anonymizes personal information (names, contact details, signatures) across customer, staff, and related records. Underlying financial/transaction records (invoice and payment totals, line items) are kept as your business's financial history rather than deleted outright, consistent with standard record-keeping practice — only the personal identifiers on them are removed.

One thing we keep: your Payment Processing Agreement acceptance

Our payment processor requires us to hold documented proof that your shop agreed to the Payment Processing Agreement. That acceptance record — the agreement name, the version you accepted, the date, and the name and email of the person who accepted — is not erased by a deletion request. We rely on GDPR Art. 17(3)(b) (legal obligation) and Art. 17(3)(e) (legal claims) for this, because erasing it would destroy the evidence that the agreement was ever made.

We keep it narrowly, not indefinitely:

Processing a deletion request doesclear the IP address and browser user-agent captured at acceptance — those aren't needed to prove consent.
The accepting person's name and email are kept, because they are the proof of who agreed — and they are automatically redacted 7 years after the acceptance date. That 7-year figure is the standard financial-record retention window; no processor contract specifies a different one.
The agreement name, version and acceptance timestamp are kept indefinitely. On their own they identify no one.
Request a full account data export and the acceptance rows we hold about you are included in that bundle, along with this same explanation — so nothing is retained that you can't see. (The self-serve Settings → Data export covers customers, vehicles, appointments, invoices and payments only; acceptance records come through the full export.)

For questions about data residency, sub-processors, or DPA execution, contact info@roffik.com.

Notes for developers

If you are building an integration on top of SalesThumb, keep these retention facts in mind:

Webhook delivery logs are available via the dashboard for 90 days. Design your endpoint to be idempotent and log payloads on your side if you need longer replay history.
API keys are deleted immediately on revoke — no grace period. Revoked keys return 401 instantly.
Deleted records return 404 from the API once removed. There is no soft-delete concept exposed to the API.
Self-serve exports (/api/export/[entity]) are capped at 50,000 rows per request and return a 413 above that — there is no pagination cursor for this endpoint today. For larger shops, request a full export instead (see above).

Questions about your data?

Email info@roffik.com for export requests, deletion requests, or DPA inquiries.

More developer docs

Docs home REST API reference Webhooks