How long each kind of record is kept, the reason, and what happens when the time is up. Every period here is applied by a nightly job, not by hand.
What this covers. Records you keep in CleanFlo about your
clients and staff, where you are the controller and we process them for
you under the DPA; and your own account, where we are
the controller. Rows marked staged are
applied by a job that started in October 2026 and is being checked
against a dry run before it deletes anything. Questions:
privacy@cleanflo.io.
How it works
Jobs run every night in the early hours, UK time. Each one works in
limited batches and writes a record of what it did. Nothing financial is
ever deleted by age while you have an account. You can delete your own
records sooner at any time, and you can export everything to CSV first.
On a phone, the CleanFlo app for iPhone, iPad or Android keeps a copy of
recently viewed data for up to 24 hours so it works without signal, and
clears it when you sign out. Uninstalling the app removes it too.
Your business records
Data
Kept for
Why
Then
Invoices, payments and quotes you raise to your clients
While your account is open
You are the controller and HMRC requires you to keep them for 6 years after the end of the financial year they relate to. We never delete them by age, so they are there for as long as you need them.
Deleted with your account when it closes (see below). Export them first: the export covers every invoice.
Timesheets, clock-in records, pay runs, mileage claims and expenses
6 years after the pay period or entry date
HMRC payroll records and National Minimum Wage records (at least 3 years). We keep 6 so they match the period for the rest of your financial records. Locked entries cannot be changed or deleted inside the period.
Deleted automatically.
Accident book and incident records, with witnesses
3 years from the incident
RIDDOR record-keeping (3 years), and the 3-year limitation period for a personal-injury claim.
Anonymised: names, injury details and witness details are cleared. The incident stays as a statistic in your safety record.
Risk assessments, method statements and other H&S documents
While your account is open
These are your evidence of safe working, often needed for at least 3 years. We never delete them by age.
Deleted with your account when it closes.
Right-to-work document copies
2 years after employment ends
Home Office guidance: keep for the employment plus 2 years, then destroy.
File and record deleted.
Fit notes
3 years after the absence ends
The medical document is no longer needed. The absence dates still matter for holiday pay and continuity of employment.
File deleted. The absence dates are kept.
Waste transfer notes and signed copies
2 years; hazardous waste consignment notes 3 years
Waste duty of care (2 years) and hazardous waste rules (3 years).
File deleted, then the note.
Job photos staged
2 years after the job
Proof of the work for questions and complaints. After 2 years nobody is still asking.
File and record deleted.
Location data
Data
Kept for
Why
Then
Clock-in and clock-out locations on jobs
2 years after the job
Settles whether a visit happened. Data minimisation: the job is kept, the location is not.
Coordinates cleared. Whether a location was given or declined is kept.
Lone-worker alert locations staged
12 months after the alert is resolved
Needed while an alert is open and for any review after it. Open alerts are never touched.
Coordinates cleared. The alert is kept as a safety record.
Logins, links and devices
Data
Kept for
Why
Then
Password reset, sign-in and one-time tokens staged
7 days
Single-use and short-lived. Expired ones have no purpose.
Deleted.
Revoked login tokens staged
30 days after being revoked
Kept briefly in case a sign-in problem needs investigating.
Deleted.
Login sessions staged
90 days without use
A device unused for 3 months should not stay signed in.
Deleted. That device is signed out and signs in again next time.
Push notification subscriptions staged
12 months after the person last signed in, with no session open
A device that nobody uses should not keep receiving notifications. Devices the push service rejects are removed at once.
Deleted.
Staff invitations not accepted
90 days after the invite expires or is revoked
Holds a name and contact details for someone who may never have joined.
Deleted.
Client portal sessions
30 days after the session expires
The session has ended. A new link starts a new one.
Deleted.
Client portal PIN attempts staged
30 days
Kept only to slow down guessing, as a hashed IP address.
Deleted.
Expired H&S document share links staged
90 days after the link expires
Can name the person the document was shared with.
Deleted.
Logs and messages
Data
Kept for
Why
Then
Error logs and diagnostics
12 months
Long enough to find a fault that recurs, no longer.
Deleted.
Email delivery log and delivery events
12 months
Answers "did my email arrive?" for weeks, not years. The delivery events half is staged.
Deleted.
Daily briefing send log staged
90 days
Stops the same briefing being sent twice. Only recent days matter.
Deleted.
App usage events staged
12 months
How the app is used (installs, language, offline sync), to fix and improve it.
Deleted.
Activity feed staged
24 months
A notification stream. The records it describes keep their own history.
Deleted.
Signup funnel events staged
24 months
Lets us compare signups year on year.
Deleted.
Contact form submissions staged
12 months
The period our privacy policy already states for an enquiry.
Deleted.
Our record of retention runs staged
6 years
Evidence that this schedule actually runs, kept as long as the longest record it covers.
Deleted.
Your account
Data
Kept for
Why
Then
A closed account: everything above, plus logins
30 days after you close it, or after your subscription ends
Time to export your data or change your mind. If a subscription simply ends we write to you first and always give at least 7 days' notice.
Permanently deleted, including every login. Backups age out within 35 days.
A signup that never subscribed staged
12 months after signup, then a warning email, then the 30 days above
An account nobody is using should not hold data indefinitely. We email the owner first, with a link to subscribe or export, and closing starts no sooner than 14 days after that email was sent. No email sent, no closure.
Closed, then deleted as above.
Our invoices to you for CleanFlo
At least 6 years after the end of our financial year
HMRC. These are our records, held by Stripe, and are not deleted with your account.
Kept by Stripe; we never delete them within the period.
