Last updated: 24 June 2026
Data retention schedule
This schedule sets out how long clmSpace, operated by Rated Counsel Limited, keeps each category of data and where it is held. It supports our privacy policy and data processing agreement, and aligns with the controls in our security white paper. Under the GDPR the customer is the controller and Rated Counsel Limited is the processor, acting on the customer’s documented instructions.
We keep data only for as long as we need it to provide the Service and meet our legal obligations. Deletion is available on request and through administrative tools, and we commit to deleting client content within 30 days of termination on request.
| Data category | Where it is held | Retention period |
|---|---|---|
| Source contract documents (PDFs, templates, drafts) | Your own SharePoint or Google Drive, read in place through connectors; clmSpace keeps no separate copy | Retained by you under your own retention policy; connector access is removed on termination |
| Derived structured contract data (agreements, obligations, citations, lifecycle records) | A tenant-scoped Neon Postgres store in the United Kingdom (AWS London) | Retained for the life of your subscription; deleted within 30 days of termination on request and available on request through administrative tools |
| Verification and override audit records (acting user, timestamp, before and after values, reason) | With the structured contract data, in the tenant-scoped United Kingdom store | Retained with the related agreement for the life of your subscription; deleted within 30 days of termination on request |
| Account and authentication identifiers | Resolved from Microsoft Entra ID single sign-on; platform sessions are issued per sign-in | Platform sessions expire by default after 8 hours; account records are kept for the life of the account and removed within 30 days of termination on request |
| Operational and security logs | Cloud platform logging in the United Kingdom | Retained for approximately 90 days, then aged out |
| AI inference data | Anthropic, United States, under our commercial agreement | Not used to train models; retained by Anthropic for up to 30 days for abuse monitoring |
| Website analytics | Vercel Web Analytics and Speed Insights (anonymous, cookieless) | No personal data is stored; the source IP and user-agent are discarded immediately after deriving an anonymous identifier |
| Demo requests and support correspondence | Our business systems | Retained for as long as needed to respond and for our legitimate business records, then deleted |
How deletion works
On termination, and at any time on documented instruction, we delete or return customer contract data in line with our data processing agreement. Source documents stay in your own SharePoint or Google Drive, so you keep direct control of that store; derived structured data is held in a tenant-scoped store that we delete as part of the same process. Administrators can also remove agreements and their derived data through the platform’s admin tools.
International transfers
Hosting, structured contract data, and the read model are in the United Kingdom. The one routine transfer outside the UK and EEA is AI inference by Anthropic in the United States, covered by the UK International Data Transfer Agreement referencing the EU Standard Contractual Clauses on a processor-to-processor basis. The full register of who processes customer contract data, with locations, is on our sub-processor list.
Questions
For any question about retention or to request deletion, write to privacy@clmspace.com.