Data Retention Policy

This policy explains what KortzLab keeps, why we keep it, and how long it stays.

It is written to be checkable. Every category below corresponds to something the website or the internal dashboard actually stores, and nothing is listed here that the system does not collect.

---

1. Principles

We apply four rules to everything we hold.

• Collect only what is needed. Every field on every form exists because it changes how we can help you. There are no optional trackers gathering data in the background.
• Keep it only while it is useful. Records are retained while they serve the purpose they were collected for, and while any legal, accounting or contractual obligation requires it.
• Reduce what is identifiable. Where a record only needs to be counted rather than attributed, we store a one-way hash instead of the original value.
• Delete rather than archive indefinitely. Data with no remaining purpose is removed, not moved to a quieter table.

---

2. What We Hold

2.1 Contact messages

Submitted through the contact form: your name, email address, phone number if you provide one, the subject, the message, and any files you attach.

Kept while we are dealing with your message and afterwards as a record of the conversation, so that if you come back to us we know what was already discussed.

2.2 Project inquiries

Submitted through the Inquire Now form: your name, company name if given, email address, phone number if given, the project type, the services you selected, your budget range and timeline where provided, your description of the project, any reference link, any additional notes, and any files you attach.

Kept while we assess and respond to the inquiry, and afterwards where the inquiry led to a proposal or an engagement.

2.3 Job applications

Submitted through the careers pages: your name, email address, phone number, location, LinkedIn and portfolio links, your cover letter, and your CV.

Kept while the role is open and while the application is under consideration. If you would like your application removed at any point, ask us and we will remove it.

2.4 Client and project records

Where an inquiry becomes a project, we hold the agreement, the scope, the correspondence, and the materials needed to deliver and support the work.

Kept for the duration of the engagement and afterwards where an obligation, a support arrangement or a legal requirement applies.

2.5 Website analytics

Our analytics are first-party. We record the page path, the referring site's host name, a coarse device, browser and operating system category, and a visitor hash.

The visitor hash is salted with the current date, so the same person on two different days produces two unrelated values and cannot be followed between them. No raw IP address is stored. Nothing is recorded at all unless you have allowed analytics through the cookie banner.

2.6 Security and audit records

Administrative actions in our dashboard — sign-ins, publishing, status changes, uploads, role changes — are recorded in an append-only audit log. Entries hold the actor, the action, the affected record, the result, and a salted hash of the IP address.

Audit entries are never edited or deleted. That is the point of them: a log that can be rewritten is not evidence of anything. They are kept as long as the system is operating.

2.7 Account records

Dashboard accounts hold a name, an email address, a role, an account status, the time of the last sign-in, and a password hash. We cannot read or recover a password; we can only replace it.

Kept while the account exists.

---

3. What We Do Not Keep

• Raw IP addresses. Where an address is needed for abuse protection or auditing, only a salted one-way hash is stored.
• Passwords in a readable form. Passwords are hashed with Argon2id.
• Payment card details. This website does not process payments and no card data passes through it.
• Cross-site tracking data. There are no third-party advertising or analytics scripts on this website.
• Secrets in logs. Credentials, tokens and file contents are redacted before anything is written to a log.

---

4. Retention Periods

[TBD — requires confirmation]

A specific retention period for each category has not been finalised, and this policy will not state one until it has been. Publishing a number we do not yet apply would be worse than publishing none.

Until the periods are confirmed, the principles in section 1 govern: data is kept while it serves its purpose and while any legal or contractual obligation applies, and is removed once neither is true.

If you need to know how long we currently hold a specific record, ask us and we will tell you what is actually the case.

---

5. Deletion Requests

You can ask us to delete information we hold about you.

Write to support@kortzlab.pro and tell us what you would like removed. We will confirm what we hold, remove what we can, and explain plainly if anything must be retained — for example because a legal, accounting or contractual obligation applies to it.

Two things cannot be removed on request:

• Audit log entries, because they are append-only by design and exist to record that something happened.
• Records we are required to keep, for as long as that requirement lasts.

---

6. Backups

Backups exist so that data can be restored after a failure. A record deleted from the live system may persist in a backup until that backup is rotated out of use. Restored data is subject to the same retention rules as the original.

---

7. Changes to This Policy

We may update this policy. The Last Updated date above reflects the most recent change. Where a change materially affects how long we keep your information, we will say so rather than relying on the date alone.

---

8. Contact

Questions about retention, or a request to delete something:

• Email: support@kortzlab.pro
• Phone and WhatsApp: +971 54 297 5998

Related documents: the Privacy Policy sets out how information is collected and used, and the Information Security Policy sets out how it is protected.