Developer docs · Reference

Data retention & export

A plain-English breakdown of what data SalesThumb stores, how long we keep it, why, and how to get it out. This page covers the technical details; see /privacy for the legal privacy policy.

Infra on SOC 2 Type II providersSelf-serve CSV/JSON exportScheduled PII auto-redaction on quotes/invoicesDeletion on request

Retention by data category

Periods below apply to data stored in the SalesThumb platform. Third-party processors (Rainforest for payments, R2 for media) have their own retention policies which may differ.

Data portability & export

You own your data. SalesThumb provides two export paths:

Self-serve CSV export

From Settings → Data, export CSV files for:

Customers — name, email, phone, address, company, tags, marketing opt-in, spend totals, created date
Vehicles — year, make, model, VIN, license plate, linked customer ID
Appointments — start/end time, status, service, bay/installer, customer, vehicle, linked quote/invoice
Quotes — number, status, subtotal, tax, discount, total, deposit, sent/approved/declined dates
Invoices — number, status, subtotal, tax, discount, total, deposit applied, balance, due and paid dates (line items aren't included)
Payments — amount, tip, method, status, processed date, linked invoice
Job photos — one row per photo with linked job, customer and vehicle IDs, file name/type, dates, and a download link that expires after 24 hours (a list of links, not the image files; on-demand only, not scheduled)

Downloads are generated on demand as CSV or JSON — no waiting, no email delivery. A separate scheduled-export feature (also in Settings → Data) can run these on a recurring basis if you need an ongoing feed.

Full account data export

For a complete bundle covering your account and staff profile beyond what the self-serve export above covers, use the data request form (choose "Send me a copy of my data") with the email address on your account. You can also email hello@salesthumb.com from the account owner address instead — include your shop name and the export scope you need.

Filing the request is self-serve either way; fulfilling it is still a manual step on our side today, so we don't promise a fixed number of days — the form aims for about 30.

Account closure

Canceling your subscription (email hello@salesthumb.com or use the contact page; self-serve cancel arrives with self-serve billing) stops billing — it does not automatically delete any data. Your records stay in place, unchanged, until you either reactivate or ask us to delete them (see below).

If you want your data deleted rather than just the subscription canceled, that's a separate, explicit request — see Deletion requests below. Export anything you need from Settings → Data before requesting deletion; once processed, it can't be undone.

Deletion requests (GDPR / CCPA)

To request deletion of your account and its associated personal data, use the data deletion form (choose "Delete my personal data") with the email address on your account. You can also email hello@salesthumb.com from the account owner address instead, with the subject line "Deletion request — [shop name]".

Either way, requests are reviewed and processed by our team — this is a manual, admin-mediated step today rather than a fully automated flow, so we don't promise a fixed number of days (the form aims for about 30). Processing anonymizes personal information (names, contact details, signatures) across customer, staff, and related records. Underlying financial/transaction records (invoice and payment totals, line items) are kept as your business's financial history rather than deleted outright, consistent with standard record-keeping practice — only the personal identifiers on them are removed.

One thing we keep: your Payment Processing Agreement acceptance

Our payment processor requires us to hold documented proof that your shop agreed to the Payment Processing Agreement. That acceptance record — the agreement name, the version you accepted, the date, and the name and email of the person who accepted — is not erased by a deletion request. We rely on GDPR Art. 17(3)(b) (legal obligation) and Art. 17(3)(e) (legal claims) for this, because erasing it would destroy the evidence that the agreement was ever made.

We keep it narrowly, not indefinitely:

Processing a deletion request does clear the IP address and browser user-agent captured at acceptance — those aren't needed to prove consent.
The accepting person's name and email are kept, because they are the proof of who agreed — and they are automatically redacted 7 years after the acceptance date. That 7-year figure is the standard financial-record retention window; no processor contract specifies a different one.
The agreement name, version and acceptance timestamp are kept indefinitely. On their own they identify no one.
Request a full account data export and the acceptance rows we hold about you are included in that bundle, along with this same explanation — so nothing is retained that you can't see. (The self-serve Settings → Data export covers customers, vehicles, quotes, appointments, invoices, payments and job photo links only; acceptance records come through the full export.)

For questions about data residency, sub-processors, or DPA execution, contact hello@salesthumb.com.

Notes for developers

If you are building an integration on top of SalesThumb, keep these retention facts in mind:

Webhook delivery logs are available via the dashboard, which shows the 50 most recent deliveries per subscription (older ones are kept but not shown). Design your endpoint to be idempotent and log payloads on your side if you need longer replay history.
API keys stop working immediately on revoke — no grace period. Revoked keys return 401 instantly.
Deleted records return 404 from the API once removed. There is no soft-delete concept exposed to the API.
Self-serve exports (/api/export/[entity]) are capped at 50,000 rows per request and return a 413 above that — there is no pagination cursor for this endpoint today. For larger shops, request a full export instead (see above).

Questions about your data?

Email hello@salesthumb.com for export requests, deletion requests, or DPA inquiries.

More developer docs

Docs home REST API reference Webhooks

Data category	Retention period	Reason
Appointments, quotes & invoices Appointments, quotes, invoices, line items, totals Kept for the life of the account (no automatic purge)	Kept for the life of the account (no automatic purge)	Business and tax record-keeping. On an explicit deletion request, PII fields (signatures, notes) are anonymized; totals and line items are kept as your financial history.
Quote/invoice signatures Customer approval & completion signatures, service/liability waiver signatures Auto-redacted 5 years after the later of job completion and the end of any warranty on that job (kept while a lifetime warranty is in place)	Auto-redacted 5 years after the later of job completion and the end of any warranty on that job (kept while a lifetime warranty is in place)	Proof of what the customer agreed to, kept for the period a contract or warranty dispute can still arise; the invoice/quote record itself is kept.
Quote/invoice notes Quote/invoice notes, internal notes, quote decline reasons Auto-redacted 540 days after creation	Auto-redacted 540 days after creation	Free-text notes stop being needed once the standard chargeback-dispute window has long closed; the invoice/quote record itself is kept.
Payment records Payment transactions, refunds, processor charge IDs Kept for the life of the account (no automatic purge)	Kept for the life of the account (no automatic purge)	Tax and PCI-adjacent record-keeping.
Customer & vehicle records Customer profiles, vehicle make/model/VIN, contact info Kept for the life of the account (no automatic purge)	Kept for the life of the account (no automatic purge)	Active business data. Removed only via an explicit deletion request, not automatically on subscription cancellation.
Tint compliance waivers Signer name, signature, IP address at sign-time Signer identity auto-redacted 10 years after signing, or later under the quote/invoice signature rule when that is longer	Signer identity auto-redacted 10 years after signing, or later under the quote/invoice signature rule when that is longer	The compliance record (state, VLT values, violations) is kept for citation defense; the signer's identity isn't needed that long.
Payment-agreement acceptances Who accepted the Payment Processing Agreement, which version, when, from what IP/browser Kept through a deletion request; name/email/IP/browser auto-redacted 7 years after acceptance	Kept through a deletion request; name/email/IP/browser auto-redacted 7 years after acceptance	Our payment processor requires documented proof that your shop agreed to the Payment Processing Agreement, so this is the one record we keep rather than erase on a deletion request (GDPR Art. 17(3)(b)/(e)). On such a request we still clear the IP address and browser user-agent — they aren't needed to prove consent. The agreement name, version and acceptance date are kept indefinitely; they don't identify anyone.
Media & photos Job photos captured in the app No fixed window yet	No fixed window yet	A storage-lifecycle process exists but isn't enabled by default today. Export via Settings → Data if you need to keep copies.
Audit logs Who changed what, login events, API key usage, permission changes Kept indefinitely today (no automatic purge)	Kept indefinitely today (no automatic purge)	Security investigation and compliance. The app only ever adds log entries, with one exception: when we process a data-deletion request, customer-identifying details are scrubbed from the matching entries. There is no database-level lock that makes the logs unchangeable.
API keys Shop API keys, restricted-scope keys Disabled immediately on revoke; the revoked key record (name, prefix and a hash of the secret, never the secret itself) is kept for audit and hidden from your key list	Disabled immediately on revoke; the revoked key record (name, prefix and a hash of the secret, never the secret itself) is kept for audit and hidden from your key list	Security. A revoked key returns 401 at once and can't be re-enabled; only a hash of the secret is stored, so a key can never be recovered.
Webhook delivery logs Request payload and response status per delivery Your shop's outgoing webhook deliveries: kept indefinitely today (no automatic purge). Incoming provider webhooks (texts, calls, email and payment events we receive): payload content cleared 30 days after receipt; the delivery record stays	Your shop's outgoing webhook deliveries: kept indefinitely today (no automatic purge). Incoming provider webhooks (texts, calls, email and payment events we receive): payload content cleared 30 days after receipt; the delivery record stays	Debugging history.
Session & auth tokens User session tokens, with the signed-in device's IP address and browser user-agent Expire about 7 days after last use; deleted immediately on sign-out; revoked on admin action. 30 days after a session expires its IP address and browser are removed; of those long-expired sessions, only each person's most recent one is kept and the rest are deleted	Expire about 7 days after last use; deleted immediately on sign-out; revoked on admin action. 30 days after a session expires its IP address and browser are removed; of those long-expired sessions, only each person's most recent one is kept and the rest are deleted	Security hygiene. "Last seen" (on the Staff page and admin screens) comes from the most recent session record, so it survives expiry — but it can go blank right after someone signs out, because signing out deletes that session.
Failed sign-in attempts Email address tried, IP address, browser user-agent, failure reason Deleted 90 days after the attempt	Deleted 90 days after the attempt	Brute-force and account-lockout investigation; the lockout itself only looks back minutes.
Website, lead-form & sign-in-code network data IP address, browser user-agent and referrer captured with a lead or contact form, and the IP address on a customer sign-in code Cleared (or the sign-in code deleted) 30 days after capture	Cleared (or the sign-in code deleted) 30 days after capture	Abuse and spam investigation. The lead or contact record itself is kept.
Brand-website requests no location took Name, phone, email, message and ZIP code sent through an HQ organization's brand-website form when no location serves the area and HQ hasn't assigned it yet Contact details cleared 90 days after the request if HQ never assigns it (sooner on assignment or a deletion request)	Contact details cleared 90 days after the request if HQ never assigns it (sooner on assignment or a deletion request)	Gives HQ time to pass the request to a location. The ZIP code and routing outcome are kept for the routing report.
Signature, consent & Terms evidence IP address and browser recorded when someone signs a quote, invoice, waiver or inspection, consents to texts, or accepts our Terms Quote/invoice signatures: cleared 5 years after the later of job completion and the end of any warranty on that job (kept while a lifetime warranty is in place). Tint-law waivers: the same, but no sooner than 10 years after signing. Inspection sign-offs, text consents and Terms acceptances: no automatic deletion today	Quote/invoice signatures: cleared 5 years after the later of job completion and the end of any warranty on that job (kept while a lifetime warranty is in place). Tint-law waivers: the same, but no sooner than 10 years after signing. Inspection sign-offs, text consents and Terms acceptances: no automatic deletion today	Proof of who agreed to what, and when. Payment-agreement acceptances are listed separately above.
Admin session-end log entries The IP address of a session an admin ended, recorded in that audit-log entry Kept indefinitely today (no automatic purge), like other audit logs	Kept indefinitely today (no automatic purge), like other audit logs	Security investigation.
Error reports Technical error reports from failed requests, which can include a user ID and shop ID (failure text is redacted) Deleted 90 days after the error	Deleted 90 days after the error	Diagnosing bugs after the fact.
Franchise disclosure delivery tracking IP address and browser when a franchise disclosure document was first opened, first downloaded and its receipt acknowledged No automatic deletion today; cleared on a deletion request	No automatic deletion today; cleared on a deletion request	Proof that the disclosure document was delivered and received.
Shop sign-up attribution Campaign tags and the referring page (site and path only) when a shop signed up Kept indefinitely today (no automatic purge)	Kept indefinitely today (no automatic purge)	Understanding which marketing brings shops in. No contact details.