Data Retention & Classification Policy

1. Purpose & Scope

This policy establishes how Hypernova AI Inc. classifies data, sets retention periods, and ensures data is securely deleted when no longer needed. It applies to all data processed, stored, or transmitted through Hypernova AI services.

This policy supports compliance with GDPR (Article 5(1)(e) — storage limitation), CCPA, and HIPAA data retention requirements.

2. Data Classification

Classification	Examples	Controls	Retention
Public	Marketing content, blog posts, documentation	No special restrictions — published openly	Indefinite
Internal	User conversation history, AI-generated outputs, usage metrics	Authenticated access only, no external sharing without consent	Duration of account
Confidential	Customer PII (name, email, company), business data	Encrypted at rest & in transit, strict access control, audit logging	Account duration + 30 days post-deletion
Restricted	Passwords (bcrypt hash), payment tokens, health data	Hashed/encrypted, minimal retention, never logged as plaintext	Minimum required — deleted immediately upon account deletion

3. Retention Schedule

Data Type	Retention Period	Basis
Account data (name, email, profile)	Duration of account + 30 days after deletion request	Service delivery, deletion window for recovery
Conversation / AI interaction history	Duration of active account	Service feature — user controls deletion
Audit & security logs	2 years	Security investigation, compliance requirement
Server access logs	30 days	Operational debugging — short window, no PII
Payment records	7 years	IRS tax record requirement (26 CFR § 31.6001)
Incident response records	3 years	HIPAA / regulatory compliance
Employee records (if applicable)	7 years	Labor law compliance
Deleted account data	Purged within 30 days of deletion	GDPR right to erasure (Article 17)

4. Data Deletion Process

User-Initiated Deletion

Users may request account deletion via account settings or by emailing [email protected]
Deletion requests processed within 30 days of submission
Confirmation email sent upon completion

Technical Deletion Methods

Database records: Hard deletion (DELETE, not soft-delete) for personal data after retention period
Encrypted data: Cryptographic erasure — encryption keys destroyed, rendering data unrecoverable
Backups: Personal data excluded from backups after retention expiry at next backup rotation
Logs: Log rotation automated — server logs purged at 30-day mark

Exceptions

Data may be retained beyond standard retention periods if: (1) required by active litigation hold, (2) subject to regulatory investigation, (3) legally required by applicable law. Such exceptions are documented and reviewed quarterly.

5. Data Minimization

Hypernova AI collects only the data necessary to deliver the requested service. We do not sell personal data. We do not share personal data with third parties except:

The service providers listed on our Security page
When required by law or legal process (with notice where legally permitted)
With user consent for specific sharing purposes

6. Cross-Border Data Transfers

Recipient	Location	Transfer Mechanism	Data Type
Anthropic	United States	DPA + Standard Contractual Clauses	User conversation content (AI processing)
Stripe	US / EU	SCCs in place, PCI-DSS L1	Payment information (billing only)
Cloudflare	Global Edge / US	Adequate protection — GDPR compliant	Network traffic metadata
IONOS (server in the United States)	United States	N/A (US domestic)	All application data

Document Control

Version	Date	Author	Changes
1.0	January 1, 2026	Cale McMillin	Initial document
1.0.1	August 2026	Cale McMillin	Added cross-border transfer table

Data Retention & Classification Policy