Data, retention and backups
Last updated October 31, 2026
Draft. This page is waiting for legal review and may change before launch.
What Datacenter LLC keeps to run Datacenter, for how long and where. It matches our privacy policy and the code that deletes data.
Where data lives
Datacenter runs on Cloudflare. Accounts, sites, links and profiles are in Cloudflare D1. Page views, clicks and heatmaps are in Workers Analytics Engine. Uploaded logos and our backups are in Cloudflare R2. D1 and R2 encrypt data at rest. We have not pinned the data to one country or region.
How long we keep it
| What | How long | Where |
|---|---|---|
| Raw page views, events and clicks | Up to 3 months | Analytics Engine |
| Heatmap clicks and scroll depth (no visitor id) | Up to 3 months | Analytics Engine |
| Daily stats totals | Your plan's history: 30 days on Free, 2 years on Solo, Studio and Agency, while the account is open on Custom | D1 |
| The salt behind visitor hashes | Replaced daily, deleted within 2 days | D1 |
| Anonymous visitor profiles (90-day tracking) | 90 days after the last visit | D1 |
| Account, sites, links, goals, customer profiles | While your account is open, or until you delete them | D1 |
| An imported list while it runs (encrypted, only the columns kept) | Until each part is imported or the import ends; at most 7 days | D1 |
| Visits on a customer profile | 2 years | D1 |
| Customers and orders read from Wix or Shopify | As customer profiles. Wix data stays after the app is removed; Shopify data is deleted 48 hours after uninstall | D1 |
| The Wix or Shopify app login (encrypted) | Until the app is removed or the account is deleted | D1 |
| A buyer's random id kept against a store order (90-day tracking) | 30 days, or until the Wix app is removed | D1 |
| Call recordings | 12 months, or until deleted | Our phone provider |
| Automation step history | 90 days after a run ends | D1 |
| Conversions sent to ad platforms | 30 days after they are sent | D1 |
| Global Privacy Control signal for a random id | 13 months | D1 |
| Your data download | 7 days | R2 |
| Checklist sign-ups never confirmed | 7 days | D1 |
| Sign-in sessions | Up to 30 days | D1 |
| The account activity log: who changed what, when, the city and country, and the network part of the IP address | 90 days | D1 |
| Sign-in and sign-up attempts, with their IP address | 1 day | D1 |
| Error records (no personal data) | Samples 30 days, counts 90 days | D1 |
| Health checks | 14 days; daily summaries 400 days | D1 |
| Nightly backups | 30 days | R2 |
| Monthly backups | 12 months | R2 |
| Billing records | As long as tax law requires | Stripe |
Backups
- Every night after 03:00 UTC, Datacenter copies its database to a private R2 bucket. We keep each night's copy for 30 days, and the first copy of each month for 12 months.
- Backups leave out sign-in sessions, one-time sign-in links, rate-limit records and the daily visitor salts.
- Contact details in customer profiles stay encrypted inside backups. The key is a Cloudflare secret and is never in a backup.
- Cloudflare also keeps a point-in-time history of the database for 30 days (D1 Time Travel), so we can rewind it to any minute in that window.
- Something you delete can stay in a backup until that backup expires: up to 30 days, or up to 12 months in a monthly copy. If we ever restore a backup, we delete again what was deleted after it was made.
- A restore goes into a separate database first and is checked before anything is replaced.
Errors and uptime
When something breaks, we keep the kind of error, the route (such as /app/s/:id, never the full address), the status and a keyed hash of the account and site. We never keep the request body, cookies, the query string, email addresses or IP addresses with it. Our checks run every 15 minutes, and their results are on the status page.
Who helps us run Datacenter
| Company | What for | When |
|---|---|---|
| Cloudflare | Hosting, the database, event storage, backups, our email, the human check on sign-up and sign-in (Turnstile), DNS lookups and Workers AI | Always |
| Stripe | Payments and invoices: Datacenter never sees your card number. Also reads sales from a Stripe account a customer connects | When you pay, or connect Stripe |
| Anthropic | Datacenter Assistant on Solo, Studio, Agency and Custom | When an account holder uses the Assistant |
| Twilio | Texts from automations, call tracking numbers and call recordings, and the business details US carriers ask for (when shipped) | When a customer turns on texts or call tracking |
| Amazon Web Services | Amazon SES and SNS: email from a customer's own domain, and the replies, bounces and complaints that come back (when shipped) | When a customer sets up their own sending domain |
| Google Safe Browsing | Checks short link destinations, the address only | When a link is made, then daily |
| Meta, for our own ads | If you sign up after clicking one of our Meta ads: that you signed up, started a trial and made your first payment (with its amount), your email and account id as SHA-256 hashes, your IP address, browser and the ad's click id, so Meta can measure and improve our ads (when shipped) | When you sign up from one of our Meta ads, never with Global Privacy Control or from the EEA, the UK or Switzerland |
| Have I Been Pwned | Checks new passwords against breaches, the first five characters of a hash only | When you set a password |
| Google, GitHub | Sign in with them: your account id, verified email and name | When you choose to |
| Apple, Google, Mozilla and Microsoft push services | Phone and browser alerts you turn on. The alert is encrypted so the push service cannot read it | When you turn on phone alerts |
The privacy policy says what each one receives. This is the subprocessor list our data processing agreement refers to. We email account holders before we add one.
Tools you connect
These receive data only when a customer connects them and turns sending on. The customer picks each one.
| Company | What for | When |
|---|---|---|
| Google Analytics | Past numbers a customer imports, read only (when shipped) | When a customer imports |
| Meta | Ad spend read in; conversions sent out, with hashed email and phone where the customer turned that on | When a customer connects it |
| Google Ads | Ad spend read in; conversions sent out (when shipped) | When a customer connects it |
| Microsoft Ads | Ad spend read in; conversions sent out (when shipped) | When a customer connects it |
| TikTok | Ad spend read in; conversions sent out | When a customer connects it |
| Ad spend read in; conversions sent out (when shipped) | When a customer connects it | |
| Ad spend read in; conversions sent out | When a customer connects it | |
| Snapchat | Ad spend read in; conversions sent out | When a customer connects it |
| Ad spend read in; conversions sent out | When a customer connects it | |
| X | Ad spend read in (when shipped) | When a customer connects it |
| HubSpot | Contacts and deals read in; email, name, phone, source and purchases sent out | When a customer connects it |
| GoHighLevel | Contacts and deals read in; email, name, phone, source and purchases sent out | When a customer connects it |
| Airtable | Profiles and orders written to a table: email, name, phone, source and purchases | When a customer connects it |
| Klaviyo | Email events read in; where each person came from written to their profile and to lists | When a customer connects it |
| Mailchimp | Campaign sends, opens and clicks read in; where each person came from written back | When a customer connects it |
| Attentive | Message events received; where each person came from and segments written back | When a customer connects it |
| Shopify | Orders and customers read in from the customer's store | When a customer connects it |
| Wix | Orders, new members and daily visit totals read in from the customer's Wix site; the tag added to its pages | When a customer adds the app |
| PayPal | Each payment notice from PayPal, returned to PayPal unchanged to confirm it is real | When a customer connects PayPal for orders |
| OpenAI | Monthly costs read in from the customer's own organization, with the admin key they paste; nothing else sent | When a customer connects it for investor costs, then daily |
| Vercel | Billing charges read in from the customer's own team, with the token they paste; nothing else sent | When a customer connects it for investor costs, then daily |
| Calendly | Bookings received, with the person's email and name | When a customer connects it |
| Google Tag Manager | The site's Datacenter tag added to the customer's own container and published, after a Google sign-in; nothing kept (when shipped) | When a customer chooses it |
| Google Search Console | Search clicks, impressions and position for the customer's own site, read only (when shipped) | When a customer connects it, then daily |
| Google Business Profile | Calls, direction requests, website clicks and views for the customer's own locations, read only (when shipped) | When a customer connects it, then daily |
| Slack, Microsoft Teams | Alerts, the digest, the weekly plan and report summaries posted to a channel the customer picks | When a customer adds a channel |
| The customer's identity provider | Single sign-on (OpenID Connect): the sign-in request, then the one-time code with our client ID and secret; it answers with who signed in, their email and name | When a customer on Agency or Custom sets up single sign-on, and each time someone signs in with it |
| Webhooks | Profiles and orders posted to an address the customer gives, such as Zapier or their own server, signed | When a customer adds one |
Some checks see only a domain name, never a person: crt.sh, rdap.org (certificate and domain expiry checks, the domain name only); European Central Bank (daily exchange rates, nothing sent); DNS hosts with one-click setup (add the DNS records a customer approves, for that domain only).
Deleting your data
What you delete in the app, or everything when you delete your account in Settings, Account, leaves the live database as the privacy policy says, within hours, and leaves our backups as they expire. Analytics Engine rows cannot be deleted one by one: they hold no IP address or email address, and expire within 3 months. To get a copy of your data, use Download my data in Settings, Account: a zip of JSON files, with CSV for profiles and links, kept for 7 days.