Data Retention and Deletion

Data Retention and Deletion

1. In short

As of 3 Nov 2026:

• Call records, transcripts, recordings and contacts are kept for the life of the customer's workspace unless the customer deletes them. Retention settings that delete automatically are In place (since 4 Nov 2026); a period applies only once an Admin sets one. A copy of each call is also kept in a separate working store, with no expiry; retention settings, erasure and offboarding do not remove it.
• Some data already expires on its own (section 2).
• A person can ask Graine to erase their personal data (section 4). A customer can delete its own data.
• From 13 May 2027 the DPDP Rules require personal data, traffic data and processing logs to be kept at least one year, then erased (Rule 8(3)). A sealed one-year copy that cannot be read through the product is Being rolled out.
• After a contract ends, Graine deletes the customer's data from live systems within 30 days of the customer's written instruction (section 6). The copy of each call in the separate working store is not deleted by this.
• Call recordings are stored in the United Kingdom today.

2. What is kept, and for how long

When memory is on, it keeps names and health-related facts. This is a platform-wide setting.

3. What the customer controls

A customer can delete its call records, recordings, contacts and members, decide whether memory is on and how long it lasts, and turn on transcript redaction per agent. Retention settings that delete recordings, transcripts (including transcript copies in a call's variables, tool-call logs, collected answers, extracted data and a contact's last-call summary) and contact data after a period the customer chooses are In place (since 4 Nov 2026). Until an Admin sets a period, those records stay until the customer deletes them. These settings do not remove the copy of a call kept in the separate working store (section 2).

4. When a person asks for erasure

Write to founders@graine.ai with "Data request" in the subject, or use the form at www.graine.ai/privacy-policy. Graine may ask you to confirm who you are first. Graine aims to answer within 30 days and never takes more than 90 days (Rule 14(3)).

• Where Graine is the Data Fiduciary, for example for dashboard account details and the requests people send it, Graine erases the data and tells the person what it kept and why.
• Where Graine processes data for a customer, the customer decides. Graine passes the request to the customer and helps it act.
• Graine keeps what another law requires: billing records for several years, and the one-year minimum in section 5 from 13 May 2027.

A tool that finds, exports, corrects and erases one person's data across calls, transcripts (with tool-call logs, collected answers, extracted data and a contact's last-call summary), recordings and contacts in one step is In place (since 4 Nov 2026), and each request is tracked against the legal dates. It covers the main database, recording storage and memory, and does not erase the copy of a call kept in the separate working store (section 2). One person's agent memory can also be erased on its own.

5. The DPDP one-year minimum

Rule 8(3) requires a Data Fiduciary to keep personal data, the traffic data connected with it and the logs of its processing for at least one year from the date of the processing, then erase them, unless another law requires longer. Rule 6(1)(e) asks for logs and personal data to be kept for a year so that unauthorised access can be investigated. A Data Fiduciary that uses a cloud processor must make sure the processor keeps them too. These duties apply from 13 May 2027.

So an erasure request made soon after the processing may not remove every copy at once. Graine's design is to make the data unreadable through the product at once, and to hold a sealed copy until a year has passed from the date of the processing, then erase it. Nobody can read the sealed copy through the product. It is Being rolled out, and no date is set.

6. When a customer leaves

1. Export. The customer exports what it needs from the dashboard or the API before the contract ends.
2. Deletion. On the customer's written instruction after the contract ends, Graine deletes the customer's data from live systems within 30 days. The copy of each call in the separate working store is not deleted by this.
3. Backups. Copies in backups age out on our providers' normal cycle. Monthly snapshots of the primary database are kept for 12 months under our database provider's current settings.
4. Confirmation. On request, Graine confirms the deletion in writing.
5. What stays. Billing records, which tax law requires Graine to keep, anything else another law requires and, from 13 May 2027, the sealed copy in section 5. The copy of each call in the separate working store also stays today.

Workspace offboarding, which exports and then deletes a workspace's data and produces a deletion record, is In place (since 4 Nov 2026). It does not delete the copy of each call in the separate working store.

7. Where recordings are stored

Call recordings are stored in the United Kingdom, with a third-party object-storage provider. For Indian data that is a transfer outside India. An India storage option for recordings is Planned; no date is set.

8. In place and being rolled out

As of 3 Nov 2026:

9. Contact

Erasure and other data requests, grievances (Grievance Officer), and deletion on contract end: founders@graine.ai, or the form at www.graine.ai/privacy-policy.

Related documents

• Privacy Notice
• Data Subject Rights
• Security Overview
• Sub-processor List

Revision history