Data Handling & Retention Policy

Overview

This policy explains how DecisionOps Ltd collects, stores, processes, and deletes personal and business data. It is intended to be read alongside our Privacy Policy. All data handling is performed in accordance with UK GDPR and the Data Protection Act 2018.

Data types, storage, and retention

Storage security

All data is stored on AWS infrastructure in the eu-west-2 (London) region. Data is encrypted at rest using AES-256 and encrypted in transit using TLS 1.3. Access to production databases is restricted to authorised personnel only, with multi-factor authentication enforced and all access logged.

Deletion on account cancellation

When you cancel your DecisionOps subscription:

• Your account remains accessible until the end of your paid billing period.
• After your subscription ends, your account is placed in a 30-day grace period. You can reactivate your account within this period without losing data.
• After 30 days, all personal data and pipeline/decision data is permanently deleted from our systems, with the exception of billing records (retained for 7 years for legal compliance).
• You may request immediate deletion at any time by emailing ops@decisionopshq.com.

Data export

You can export your data at any time from within your account settings. Exports include:

• All pipeline data (Revenue OS): lead records, engagement history, recovery actions, and outcomes — in CSV or JSON format.
• All personal decision data (Personal OS): journal entries, goals, Life Score history, and habit logs — in JSON format.

Export requests are processed immediately for accounts below 100MB. Larger exports are prepared within 24 hours and delivered by email link.

Third-party data processors (sub-processors)

We share data with the following sub-processors, all bound by data processing agreements and equivalent data protection standards:

Data requests

To submit a data subject access request (DSAR), request erasure, or ask any question about how we handle your data: