Retention and Deletion Policy

We keep personal data only while it is needed for the service, a customer’s documented settings, security, disputes or legal obligations. A customer controls business records in its workspace and should choose retention appropriate to its purpose and notices.

Call records, recordings, transcripts, messages, delivery events, AI outputs and attribution evidence remain available according to workspace settings, the active contract and deletion requests. A record can be retained longer where it is needed to establish, exercise or defend legal claims, investigate misuse or obey a lawful requirement.

Active account and role information is retained while access is needed. Deleting an individual account removes or anonymises its profile and personal settings through the normal deletion cycle. Device push registrations are removed on sign-out where possible and invalid tokens are retired. API keys are stored as non-reversible hashes and deactivated keys remain represented in security audit history.

Invoices, payments, tax records and supporting transaction evidence are kept for the periods required by UK tax and company law. Number-registration, identity, porting and fraud-prevention evidence is retained while necessary for the number, an unresolved request, a dispute or a legal and network obligation.

Deletion removes data from active use. Encrypted backups and technical logs may retain protected copies for a limited recovery or security cycle before automatic expiry. Data subject to a legal hold is isolated and retained only for that purpose.

Workspace owners can use available controls or contact info@callbullet.com. Individuals should normally contact the business that controlled the call or message. We verify requests and explain where a record cannot yet be deleted or where another organisation controls it.