Data Retention Schedule
Last updated: 13 October 2026 · Data Protection (General) Regulations 2021, Regulation 19
The Data Protection Act does not set fixed retention periods. It requires that personal data is kept only as long as needed for its purpose (section 39). The periods below are the longest LangoHub keeps each type of record.
- Estates can choose shorter periods for their visit records in Manage → Privacy & compliance.
- When a period ends, records are deleted automatically by a nightly job.
| Record | Purpose | Retention | Counted from | At the end |
|---|---|---|---|---|
| Visit records (name, phone, ID number, unit, times, plate, notes) | Identification at entry; security investigations | 12 months, or shorter if the estate chooses | Check-in time | Deleted |
| Visitor and vehicle photos | Same as visit records | 12 months, or shorter if the estate chooses | Check-in time | Deleted from storage, including thumbnails |
| ID images from ID scanning | Reading name and number only | Not stored by LangoHub (the AI provider may keep it up to 30 days for abuse monitoring) | — | Discarded by LangoHub immediately after reading |
| Guest pre-registrations and access codes | Letting pre-cleared guests in | 12 months, or shorter if the estate chooses. Unused codes: 30 days after the expected visit | Creation, or expected visit date for unused codes | Deleted |
| Frequent-visitor suggestions (repeat-visitor prefill) | Speeding up repeat check-ins | 12 months, or shorter if the estate chooses | Last visit | Deleted |
| Domestic-staff passes | Recurring access | While active, then 12 months | Deactivation | Deleted |
| Incident reports | Security follow-up | 12 months, or shorter if the estate chooses | Report date | Deleted |
| Blacklist entries | Preventing repeat incidents | Until the expiry date, maximum 12 months; may be renewed only after a manager reviews it | Entry date or renewal | Deleted |
| Legal hold | Records needed as evidence for a specific incident or claim (Act, section 40(3)) | Until the hold is released; reviewed every 6 months | Hold date | Retention resumes |
| Message logs (WhatsApp and SMS delivery status, phone numbers) | Proving delivery; troubleshooting | 90 days | Sending | Deleted |
| Audit log (who did what in the system) | Security and accountability | 24 months | Event | Deleted |
| Data-subject requests and their outcomes | Showing we complied with the law | 3 years | Closure | Deleted |
| Personal-data breach records | Act, section 43(8) | 5 years | Closure | Deleted |
| User accounts (managers, guards, residents) | Access to the service | While active; deleted within 30 days of account deletion or removal | Removal | Deleted, or anonymised in old records |
| Estate account after cancellation | Export, then deletion | 30 days to export, deletion within the next 30 days | Subscription end | Deleted |
| Invoices, payments, M-Pesa records, commissions | Tax and accounting (Tax Procedures Act) | 5 years | End of the financial year | Deleted |
| Acceptance records for the Terms and policies | Proof of agreement | Life of the account plus 5 years | Account closure | Deleted |
| Signed sales rep and sales manager contracts | Proof of the agreement and commission terms | While in force, then 5 years | Contract ended or replaced | Deleted |
| Sales leads and visit notes | Business-to-business sales | 24 months after last contact | Last activity | Deleted |
| Sales representatives' GPS check-ins | Verifying visits and commission | 24 months | Check-in | Location removed |
| Demo and contact requests | Replying to enquiries | 24 months after last contact | Last contact | Deleted |
| Backups | Disaster recovery | Rolling; overwritten in the provider's normal backup cycle | — | Overwritten |
Review and audit
- Annual review. We review this schedule at least once a year, and whenever we add a feature.
- Shorter periods. Estates can shorten their periods at any time.
- Requests for early deletion. Requests to delete data earlier are handled under our Privacy Policy, section 11.