Spacestack Data Retention Policy
Last updated on October 18, 2026.
Spacestack is provided by Crown Point Media, LLC. This policy explains the retention schedule for staff accounts, client portal identities, organizations, venue and customer records, documents, payments, messages, attachments, and system information. It supplements our Privacy Policy and Terms of Service.
Purposes and responsibilities
We retain information to provide the service, support customers, secure the platform, maintain necessary business records, and meet applicable obligations. Venues generally determine why their client and event information is processed; we provide the service under our agreement with them. We separately manage our own subscription, account, security, and support records.
The periods below are default schedules, subject to applicable law, documented preservation needs, and any agreed lawful variation. Seven years is not a universal legal minimum or maximum. A venue is responsible for identifying its own obligations and exporting records it needs before its workspace recovery period ends. Its bookkeeping duties do not automatically require us to retain its entire workspace after service ends.
Workspace cancellation and recovery
Canceling renewal preserves normal access through the verified paid or trial access period, subject to the Terms and any applicable billing grace period. The 90-day recovery window starts when service actually ends, not when cancellation is first requested.
During that window, authorized users have read-only access, and owners can export retained data or reactivate through verified billing. Existing authorized clients can read and download records already shared with them. New edits, bookings, signatures, uploads, client payment initiation through Spacestack, ordinary messages, public inquiry submissions, and ordinary reminders stop. Essential billing, security, closure notices, and existing payment-provider obligations are handled separately.
We notify owners when service ends and 30 days and 7 days before the recovery deadline. After the 90-day window, ordinary workspace data is removed from active systems within 30 days. Limited records may remain where a specific lawful retention basis applies. Files can expire sooner under their own schedules, and an export or read-only visit does not restart retention. Recovery is not guaranteed once deletion begins.
An authorized permanent-deletion request may waive the ordinary recovery period after verification. Legal rights and applicable earlier request deadlines continue to apply. A valid subscription is not closed solely because users have not recently signed in. An abandoned signup that never activated service or established a business relationship is eligible for removal after 30 days, with advance notice where a verified address is available. An activated trial receives the same 90-day post-service window as a paid workspace.
Personal accounts and team access
Removing a team member ends their access to that organization immediately and preserves necessary business history. It does not delete their personal account or membership in another organization. Closing a personal account revokes sessions and integrations immediately, with a 30-day ordinary recovery period followed by removal of unnecessary personal information within 30 days.
Business records may preserve the minimum identity information needed to explain an action or signature. They do not require preserving a live account, password, avatar, or unrelated profile information. A last organization owner must transfer ownership or close the organization as part of account closure. Archiving a venue preserves retained history and is separate from permanent deletion and subscription billing changes.
Retention schedule
These periods apply while the workspace remains available. Workspace closure can end the processing purpose sooner: ordinary customer content follows the closure schedule even if its usual category period has not elapsed. Specific lawful exceptions and scoped legal holds take precedence for the records they cover.
| Information | Default period | Conditions |
|---|---|---|
| Active workspace settings, venues, catalogs, and templates | While needed to provide the subscribed service. | Unused versions and unreferenced files are removed sooner. Remaining ordinary content follows the workspace closure schedule. |
| Staff accounts, profiles, avatars, and preferences | Account lifetime, with a 30-day recovery window after ordinary account closure. | Unnecessary personal information is removed from active systems within 30 days after recovery ends. Necessary business attribution is retained separately. |
| Client portal identities and access | While an authorized relationship or access to a retained record requires it. | Access ends when authorization ends. A signature's identity snapshot follows the document without requiring a live client account. |
| Unconverted inquiries, lost leads, and unrelated prospect contacts | 24 months after the last meaningful customer interaction; spam submissions for 30 days. | Owners receive 30 days' notice before routine prospect deletion. An ongoing relationship requires a recorded purpose and annual review. |
| Completed or canceled bookings and events | 7 years after the booking file closes. | Only information needed for the booking, agreement, accounting, or dispute purpose is retained. Unrelated sensitive details are removed sooner. |
| Signed documents, signatures, and associated evidence | 7 years after the booking file closes, or after a standalone agreement's obligations end. | Required consent, attribution evidence, material revisions, and incorporated files stay with the agreement. Applicable longer requirements or legal holds can change the period. |
| Issued invoices, payments, receipts, credits, refunds, and tax records | 7 years after the end of the fiscal year to which the record last relates. | Unsettled disputes and applicable longer requirements are handled separately. Financial records use the organization's actual fiscal year. |
| Spacestack subscription agreements and necessary billing notices | 7 years after the end of the fiscal year to which the relationship or billing event last relates. | We retain necessary accepted disclosures and transaction evidence under our own lawful retention basis; duplicate payloads and unnecessary metadata expire sooner. |
| Unsigned drafts and draft invoices | 24 months after meaningful activity or closure of the associated opportunity, whichever is later. | Future bookings and ongoing negotiations remain active. Drafts needed as evidence follow the associated record's schedule. |
| Routine message text and necessary sender or recipient information | 2 years after the later of the event end or last substantive message. | Specific messages needed as contract, financial, or dispute evidence may be preserved with that record. |
| Routine message attachments | 1 year after the latest of event end, last substantive message, or the attachment's upload. | A file incorporated into an agreement or required evidence is preserved with that record before routine removal. A minimal removal notice can remain with its message. |
| Files and images forming part of a signed document | The same period as the document. | Required file dependencies are preserved together. Ordinary attachment expiry does not remove a protected agreement exhibit. |
| Completed tasks, task comments, routine notes, and their files | 2 years after completion or last substantive activity, whichever is later. | Active tasks and future bookings remain active. Evidence needed for a longer-lived record is preserved with that record. |
| Guest-level dietary, accessibility, and other sensitive event details | 90 days after the event or specific service purpose ends, whichever is later. | Only specific information covered by a documented dispute, hold, or other lawful exception is kept longer. |
| Task trash and other supported recoverable trash | 30 days after deliberate deletion. | An authorized permanent-delete request can skip recovery where permitted. Required business evidence and legal holds remain protected. |
| Routine activity history and in-app notifications | Necessary activity follows its retained record. Notifications expire 90 days after reading or dismissal, and no later than 180 days after creation. | Required billing and signing evidence is retained separately from disposable notification copies. Unnecessary personal metadata expires sooner. |
| Raw received email and duplicate provider payloads | 30 days after receipt. | Failed or pending processing is reviewed before expiry. Extracted messages and attachments follow their own schedules; specifically required evidence may be preserved separately. |
| Delivery diagnostics and payment webhook data | Routine delivery diagnostics: 90 days after the final outcome. Raw webhook payloads: 30 days. | Necessary proof of delivery follows its underlying record. Minimal processed payment-event IDs and transaction links follow the financial record to prevent duplicate processing. |
| Login links, session tokens, password reset data, and invitations | Credentials expire under the security policy. Expired or revoked credentials are purged within 30 days; closed invitations within 90 days. | Retention never keeps an expired credential usable. Necessary authentication audit evidence is stored separately. |
| Routine application, access, error, and authentication logs | 90 days after the event. | Specific incident or signing evidence follows its protected record. We minimize IP and device information and exclude credentials and full message or file contents from routine logs. |
| Routine support requests and attachments | 2 years after resolution. | Necessary financial, contract, security, or privacy-request evidence is retained under the appropriate category. |
| Privacy requests and minimal deletion records | 24 months after closure. | Excess verification information is removed after verification. A minimal deletion marker may remain as long as needed to prevent restoration or reimport. |
| Privacy and security incident records | 5 years after the later of discovery or incident closure. | Applicable legal requirements, investigations, and holds may require longer preservation of relevant evidence with controlled access. |
| Marketing consent and suppression information | Consent evidence while relied on and for 3 years after withdrawal; minimal suppression information while needed to honor the opt-out. | The purpose is reviewed annually. Retention does not authorize marketing, and linkable hashed identifiers remain personal information. |
| Temporary uploads and export archives | Unreferenced staged uploads: 24 hours. Other confirmed orphan files: 7 days. Export archives: 7 days after creation. | Export download links expire within 24 hours or sooner, with authorization checked at download. An export can be regenerated only while its source remains available. |
| Backups and noncurrent object-storage versions | Backups: at most 35 days after active-system removal. Noncurrent file versions: at most 30 days after replacement or deletion. | Backups are restricted to disaster recovery; required preservation copies have their own lawful purpose and expiry. |
| Anonymous aggregate statistics | While useful, if genuinely non-identifying. | Removing a name or hashing an email is not sufficient anonymization. Linkable information follows a personal-information schedule. |
Deadlines and expiry
A booking file closes after the event or definitive cancellation, when contractual obligations and associated payments, refunds, and disputes have ended or been settled. Unresolved files are reviewed annually; an unchanged open status alone does not justify indefinite retention. Financial records use the fiscal year to which they last relate. Reading a record, sending a reminder, or synchronizing a payment does not restart its clock.
Calendar-year and calendar-month schedules use calendar arithmetic. The one-year message-file schedule uses 365 days. Changes to displayed expiry dates are communicated in advance. Records are removed from ordinary access at expiry and deleted from active systems within 30 days, subject to applicable exceptions or an earlier legal deadline. Owners receive at least 30 days' notice before routine expiry of contract, financial, and booking records, with an export opportunity.
Required records and legal holds
Specific information may be preserved for an applicable legal obligation, dispute, investigation, legal hold, or another documented lawful purpose. We limit the scope, access, and duration of that preservation and review legal holds at least every 90 days. Retained legal records are restricted from ordinary editing and marketing use. An unresolved matter does not automatically preserve an entire workspace.
An agreement and its incorporated files, required signature evidence, and necessary financial support are preserved together. Ordinary attachment expiry does not erase a protected exhibit. When a hold ends, a record whose ordinary period has already elapsed becomes eligible for deletion; its retention period does not automatically restart.
Deletion backups and other copies
Deletion covers active database records, original and derived files, generated documents, exports, and applicable caches, indexes, and provider copies. Failed deletion operations are retried; they are not treated as completed removal. Backup copies are restricted to disaster recovery and expire within 35 days after active-system removal. Deletion instructions are reapplied before restored information becomes available.
For ordinary workspace content, the 90-day recovery window, up to 30 days for active-system deletion, and up to 35 days for backup expiry mean removal from ordinary backups by day 155 after service ends. Earlier category expiry still applies. Records covered by a specific lawful exception have a separate scope and deadline. Noncurrent file versions expire within 30 days after replacement or deletion.
A recipient can retain a copy already downloaded or delivered by email. Deleting information from Spacestack does not remove those independent copies. Payment processors and other independent providers may retain records under their own legal obligations.
Requests and policy changes
Contact admin@spacestack.io to request access, export, or deletion, or ask about a retention exception. We verify identity and authority and may coordinate with the venue responsible for the underlying client relationship. Requests are handled within applicable legal deadlines. A request does not erase another organization's records or another party's protected agreement.
We review the schedule annually and when the service materially changes. We provide at least 30 days' advance notice and an export opportunity before policy changes introduce new routine deletions of existing customer records, unless applicable law requires earlier action. We do not silently shorten a previously promised file-availability period. Any agreed lawful variation must identify its purpose and duration.