This page describes how long FlashTower retains data, how customers can export it, and how deletion works. It forms part of the Privacy Policy and the Data Processing Addendum.
1. Retention schedule
| Category | Retention |
|---|---|
| Account and organization data (profiles, members, settings, inventory, findings, remediation, policies, reports) | Life of the account plus 30 days, unless deleted earlier on request |
| Completed assessments, with their findings, evidence records, and reports | The retention period each organization configures (30 days to 10 years; 2 years by default), and no longer than the life of the account plus 30 days |
| Audit logs (security-relevant account and administrative events) | 1 year after creation, or longer where an enterprise Order Form so provides |
| Guard records (recommendations, approvals, denials, automation policies, outcomes) | Life of the organization's account; deleted with the organization's data |
| Database backups | Rolling backups of up to 7 days; deleted data ages out of backups on that cycle |
| Billing and tax records | As required by law, generally 7 years |
| Support tickets and correspondence | 2 years after the ticket is closed |
| Operational system events | Up to 90 days |
| Anonymous free-scan aggregates | Aggregate results only (no answers or personal information); anonymous identifiers cleared after 180 days |
2. Export
Organization Owners can request an export of their organization's data from organization settings at any time during the subscription, and for 30 days after termination. Reports can also be downloaded individually from the application.
3. Deletion on request
Organization Owners can request deletion of their organization's data from organization settings, and any user can request deletion of their account by emailing privacy@flashtower.com. FlashTower confirms deletion requests by email before deleting anything and completes deletion from active systems within 30 days of confirmation. Deleted data ages out of rolling backups within up to 7 days thereafter.
4. After termination
After a subscription ends or an account is closed, Customer Data remains available for export for 30 days. FlashTower then deletes it from active systems, and it ages out of backups on the rolling backup cycle.
5. Exceptions
FlashTower may retain data for longer where required by law, to comply with a legal hold, to resolve disputes, to enforce its agreements, or to preserve evidence of a security incident, and only for as long as that purpose requires. Aggregate statistics that do not identify any organization or person are not subject to deletion.
Contact
FlashTower is operated by Boostlete LLC, 1620 N Carpenter Rd, Suite D46, Modesto, CA 95351. Privacy and legal notices: privacy@flashtower.com. Security: security@flashtower.com. Support: support@flashtower.com. Billing: billing@flashtower.com. General inquiries: hello@flashtower.com.