Data retention and GDPR right to erasure

Summary

Torqueflow keeps your operational data for 90 days after your subscription is suspended (so reactivating within that window restores everything as it was), then permanently deletes it. Financial records - invoices, VAT data, billing audit logs - are retained for 6 years after deletion to meet HMRC requirements. You can also request immediate deletion of personal data under your GDPR right to erasure.

This article explains the timeline, what is kept versus deleted, and how to request earlier deletion.

Prerequisites

• You are the owner of the organisation.
• For an immediate-deletion request, you have considered the consequences (you cannot reactivate after deletion completes).

What happens automatically

Event	What happens
Subscription cancelled	A 30-day grace period starts. Your data is fully accessible during this time.
Grace period ends	Your subscription moves to “suspended”. Day-to-day staff access is blocked but data is retained for another 90 days.
90 days after suspension	Operational data is permanently deleted. Financial records (invoices + VAT data + billing audit logs) are archived for HMRC retention - access is restricted to Torqueflow Support only.
6 years after deletion	Archived financial records are also deleted.

If you reactivate the subscription at any point before the 90 days expires, the data is restored unchanged - you carry on as if nothing happened.

Steps

Reactivate before deletion

1. Go to Settings > Billing and pick the plan you want.
2. The subscription transitions back to active immediately.
3. The data-retention timer is cleared. Your records are unchanged from when the suspension began.

Request immediate deletion (GDPR right to erasure)

If you want your data permanently removed before the 90-day timer expires, you can request immediate deletion under the GDPR right to erasure.

1. Email Torqueflow support at the address shown in Settings > Billing > Cancellation.
2. Confirm in writing that you want immediate deletion and that you understand the consequences (irreversible; cannot reactivate after deletion completes).
3. Support sets your data-retention end date to within 30 days of the request, in line with the GDPR statutory window.
4. The next overnight retention sweep (runs at 05:00 UTC) processes your deletion.
5. You receive a confirmation email when deletion completes.

Financial records (invoices, VAT data, billing audit logs) are still retained for the 6-year HMRC requirement even after a GDPR-erasure request - this is a legal exception and overrides the right-to-erasure for those specific records. Personal data on those records (names, addresses, contact details) is anonymised where possible.

Expected Outcome

• After 90 days of suspension (or 30 days for a GDPR-erasure request), all operational data is permanently deleted.
• The garage’s invoices, VAT-relevant records, and billing audit logs are kept for 6 years for HMRC compliance, with access restricted.
• Reactivating the subscription at any point before the 90 days expires fully restores access.

Troubleshooting

Problem: I cancelled my subscription and want to undo it. Cause: The cancellation triggers the data-retention timeline, but data is intact during the grace period and the 90-day suspension that follows. Fix: Go to Settings > Billing and resubscribe. Everything restores immediately.

Problem: I want my data deleted but I can still see it in my account. Cause: A GDPR-erasure request takes effect on the next overnight sweep after the new retention end date, not in real time. Fix: Wait for the next 05:00 UTC retention sweep after the date support set for you. The deletion-confirmation email lands once it completes.

Problem: I’ve been told my financial records are kept for 6 years - is that GDPR-compliant? Cause: The 6-year retention is a legal HMRC requirement that overrides the GDPR right to erasure for the specific records that fall under it. Fix: None - this is the legal position. Personal data on those records is anonymised where possible.

Permissions

Action	Required role
Cancel a subscription	Owner
Reactivate a suspended subscription	Owner
Request GDPR-erasure	Owner (request goes via support, not via UI)
Access archived financial records	Torqueflow Support only

Notes

• The retention sweep runs at 05:00 UTC every day. Deletions happen during this window.
• If you have only just cancelled and you change your mind, the easiest path is to resubscribe via Settings > Billing. Use the GDPR-erasure path only when you genuinely want the data gone.
• The cancellation flow walks through this timeline at the time of cancellation. See Cancelling your subscription for the cancellation steps themselves.
• Ownership-of-data questions for joint-venture or franchise arrangements can be complex. Get in touch with support before requesting deletion if you are unsure who owns the data.