Data Retention Policy
Last updated: April 5, 2026
This policy outlines how M&R Edge Studio (operated by Michelle & Rich Essence Ltd) retains, archives, and deletes user data. We comply with the UK General Data Protection Regulation (UK GDPR), Nigeria's Data Protection Act (NDPA), and applicable platform-specific requirements from Meta and TikTok.
1. Data Retention Schedule
| Data Category | Retention Period | Legal Basis |
|---|---|---|
| User account & profile | Duration of account + 30 days | Contract performance |
| Project content (scripts, media) | Duration of account + 30 days | Contract performance |
| Analytics & usage data | 12 months rolling | Legitimate interest |
| OAuth tokens (social platforms) | Until disconnection or expiry | Consent |
| Payment records | 7 years | Legal obligation (tax/accounting) |
| Support tickets | 2 years after resolution | Legitimate interest |
| Audit & security logs | 12 months | Legitimate interest / legal obligation |
| Webhook event logs | 30 days | Legitimate interest |
| Health check history | 7 days | Operational necessity |
| Rate limit records | 2 hours | Operational necessity |
| Script cache | 24 hours | Performance optimisation |
| Newsletter subscription | Until unsubscribe | Consent |
2. Automated Data Cleanup
We employ automated database functions to enforce retention limits:
- Webhook events — Automatically purged after 30 days
- Rate limit records — Cleaned up after 2 hours of inactivity
- Health check history — Pruned to a 7-day rolling window
- Script cache — Expired entries removed every 24 hours
- Expired OAuth tokens — Flagged as inactive and purged during scheduled maintenance
3. Third-Party Platform Data
Data obtained from third-party platforms (Meta, TikTok, LinkedIn, Pinterest) is subject to additional retention rules:
- Platform User IDs and usernames — Retained only while the platform connection is active
- Published post references — Retained for analytics purposes (12 months) then anonymised
- Platform tokens — Deleted immediately upon user disconnection or deauthorization webhook
- Content posted via our platform — Remains on the third-party platform; we only store metadata references
4. Your Data Rights
Under UK GDPR and NDPA, you have the right to:
- Access — Request a copy of all personal data we hold about you
- Rectification — Correct inaccurate data via your profile settings
- Erasure — Request deletion of your account and all associated data
- Portability — Export your data in a machine-readable format (JSON)
- Restriction — Request that we limit processing of your data
- Objection — Object to processing based on legitimate interest
To exercise any of these rights, visit the Data Deletion page or email privacy@mredgestudios.com.
5. Backups & Archival
- Database backups are retained for a maximum of 30 days and are encrypted at rest
- When data is deleted from the live database, it may persist in backups for up to 30 days before being overwritten
- Backup data is never used for analytics, marketing, or any purpose other than disaster recovery
- After the backup retention period, deleted data is permanently and irreversibly removed
For questions about data retention, contact privacy@mredgestudios.com.
© 2026 Michelle & Rich Essence Ltd. All rights reserved.