Privacy: what is kept about people, and erasing someone

Your application keeps records about people: customers, clients, staff. The Privacy tab tells you what it keeps, how long it keeps it, and what happens when somebody asks to be forgotten. Finding a person, handing them their records and erasing them all happen inside your application, where their records are.

To open it, go to your application's Settings, then the Privacy tab.

See what your application keeps

The tab has these parts:

• Where the data is stored: the region your application's data is kept in, chosen when the application was made.
• A person's records: each kind of record that is a person, such as a customer, what happens to their own record when they are erased, and which other records are theirs.
• A table of every kind of record, with its class (for example personal details or financial), whether changes to it are audited, how long it is Kept, and When a person is erased.

A person's records are worked out from your application's description of whose each record is. A record that only mentions a member of staff, such as the engineer on a job, is not that member of staff's.

How long records are kept

Divvent does not guess how long you must keep anything. How long a business must keep an invoice, or may keep an old enquiry, depends on the law and on your trade, so that decision is yours.

• If your application has no rule for a kind of record, the table says it is kept Until somebody deletes them.
• If it has a rule, the table says it in words, for example kept for six years from the invoice date, then deleted, or kept with the name and address cleared. Your application applies these rules each night on its own.

To add or change a rule, ask for it as a change (see Ask for a change). Because removing records a business may be obliged to keep cannot be undone, our team approves any change to what protects people's data.

What erasing a person does

Erasing follows the rules your application's description sets for each kind of record. For each kind, one of three things happens to the person's records:

• Deleted.
• Kept, with what names them cleared, for example the name and phone number wiped from a booking but the booking itself kept.
• Kept as they are, with a reason. Financial records, such as invoices and payments, are kept by default, because a business is usually required to keep them. Everything else is deleted by default.

Their sign-in to your application goes too, with every passkey and authenticator app, and any files that are theirs are removed from storage.

Erase a person, or hand them their records

This is done in your application, on its privacy desk, by one of its administrators. The Privacy tab names the roles that can, and Open the application's privacy desk takes you there. Your application must be in production for the desk to exist.

1. On the privacy desk, choose Who (if there is more than one kind of person), type their exact email address, reference or id, and press Find.
2. Choose the person. Before anything moves, the desk shows what erasing them would do, counted: for example 3 records deleted, 12 records kept with the name and phone number cleared, and 4 invoices kept as they are.
3. To give the person a copy of what you hold about them, press Download their records.
4. To erase them, type the word erase and press Erase their records. This cannot be undone.

It all happens at once, or not at all. The desk will not offer the button when an erasure cannot go ahead, and says why: for example when a record you keep still depends on one that would be deleted, or when one person has more than 200 records to erase. Ask for a change to how those records are handled, and try again.

Every erasure and every download is listed on the desk's log, in counts and never with the person's details. Download the audit trail (CSV) gives you the whole log.

Ask for an erasure from the portal

If you are an owner of the account, the Privacy tab also has Ask for a person to be erased. This sends your application one instruction to erase a person, exactly as described above.

1. Choose Who they are.
2. Enter Their id, sign-in address or reference, exactly.
3. Type the word erase and press Ask followed by your application's name to erase them.

It needs your passkey or authenticator app from the last five minutes, and it cannot be undone. Divvent never sees who is in your application, so the portal cannot tell you whether anybody matched. Your application records what it did, or why it did nothing, on its privacy desk's log.

What Divvent can see

Divvent reads your application's description, not its records. The Privacy tab is built from the description alone. Finding, exporting and erasing a person all happen inside your application. See Security, and what Divvent can and can't see.