Data protection
Retention and Deletion Commitments
Effective September 2, 2026 · Version 2026-09-02
Docket keeps Customer Data only for the service, professional-review continuity, security, and legal recordkeeping. These are the default periods unless a firm’s written order, legal requirement, preservation hold, or verified shorter-retention request applies.
| Record | Default period | What happens next |
|---|---|---|
| Public assessment requests and pre-engagement inquiries | Up to 12 months after the last substantive contact | Delete or de-identify unless the request becomes an engagement, a legal or security exception applies, or a minimal contact-suppression record is needed to honor an opt-out. |
| Active engagement records | While the assessment or investigation remains active | Move to the completed-engagement period after final package delivery, or to deletion after a verified request. |
| Completed source records, evidence, questions, and workpaper versions | 7 years after final delivery | Delete from active systems unless the firm requests a shorter period, renews retention, or a legal hold applies. |
| Incomplete free assessments and abandoned drafts | 180 days after the last firm or system activity | Delete after a notice to the firm’s account email when reasonably practical. |
| Account, firm, client-directory, and membership records | For the customer relationship, then 30 days | Delete or de-identify, except identifiers preserved in required security, billing, or professional audit records. |
| Authentication and security telemetry | Up to 24 months | Delete or aggregate unless needed to investigate abuse, an incident, or a legal claim. |
| Firm and workpaper audit actions | 7 years from the related action or final package, whichever is later | Delete with the related professional record unless law or a hold requires more time. |
| Billing, promotion, terms-acceptance, and tax records | 7 years after the transaction | Delete or retain only the minimum legally required fields. |
| Support communications and transactional-email records | Up to 24 months after closure or delivery | Delete or de-identify unless tied to an unresolved case, incident, or legal obligation. |
| Deleted data in backups | Up to 90 additional days | Age out through the backup cycle; restored backups remain subject to the original deletion request. |
Deletion requests
A person who submitted a public assessment request may request its deletion, and an authorized firm administrator may request deletion of a client, engagement, or account, by emailing privacy@docketcrypto.com. Docket will acknowledge the request within five business days, verify identity and any required firm authority, identify applicable exceptions, and complete deletion from active systems within 30 days. Docket will confirm completion in writing.
Before deletion, the firm may request an export of available source inventory, answers, evidence references, workpapers, review history, and audit records. Deletion is irreversible after backup copies expire.
Limited exceptions
Docket may retain narrowly scoped information longer when required by law, payment and tax recordkeeping, fraud or security investigation, a litigation or regulator preservation hold, or the firm’s documented professional-workpaper instruction. Docket will restrict retained data to the applicable purpose and delete it when that exception ends.
AI and other providers
Docket does not use Customer Data to train AI models, and its configured model route does not permit model providers to train on it. OpenRouter prompt and response logging is disabled. The current underlying model provider may retain request content for operational or abuse monitoring for up to 30 days unless a shorter or zero-data-retention control applies. Other providers retain only the data sent to them under their own published schedules; Docket limits those requests to the minimum described in the subprocessor list.
Public blockchain records
Deleting a wallet address or transaction from Docket removes Docket’s association, analysis, and stored copies according to this schedule. It cannot remove the underlying public blockchain transaction, block-explorer record, or information independently held by another party.
Firm-specific schedules
A firm may request a shorter operational period or a longer professional-workpaper period in writing. Docket will confirm whether the requested schedule is technically and legally supportable before it applies. A firm-specific written schedule controls over these defaults for that firm.