Data retention schedule
Version 1 · Effective from Nov 2, 2026
This schedule is a draft prepared for review by a Bangladeshi advocate.
The Personal Data Protection Act 2026 (section 18) says we must keep personal data no longer than needed for its purpose, and section 19 requires us to keep a register of our processing for at least five years. The Digital Commerce Operation Guidelines 2021 and the Bangladesh Bank MFS Regulations 2022 require sales and payment records to be kept for six years. This schedule says what we keep, for how long, and why.
| Data | Kept for | Why | What happens after |
|---|---|---|---|
| Account profile (name, email, mobile, WhatsApp, password hash) | While your account is open | To run your account | Removed or anonymised when you delete the account or we close it |
| Orders, payments, TrxIDs, refunds | 6 years from the transaction | Record-keeping duty (Digital Commerce Guidelines 2021; MFS Regulations 2022, cl. 18.1; tax rules) | Deleted; after account closure these records are kept without your name or contact details |
| Consent records (policy version, time, IP) | While your account is open, and with the order records for 6 years | To prove acceptance (Contract Act 1872; PDP Act 2026, section 19) | Deleted with the account when there are no orders; otherwise anonymised |
| Library, lesson progress, downloads | While your account is open | To deliver what you bought | Deleted on closure |
| Career intake answers and plan | While your account is open | To build and update your plan | Deleted on closure; quiz answers from visitors who never created an account are deleted after 24 months |
| Consultation bookings, questions, summaries, package job profiles | While your account is open | To run and follow up your calls | Deleted on closure (the payment record stays, see above) |
| Support chats and tickets | While your account is open | Your support history | Deleted on closure |
| One-time SMS codes and SMS delivery logs | 90 days | Security and abuse prevention | Deleted automatically |
| First-party analytics (visitor and session records) | 26 months; the fm_vid cookie 13 months | Understand and improve the site and marketing | Deleted automatically; unlinked from your account on closure |
| Portal notifications | 12 months | Messages in your account | Deleted automatically |
| Data export files you requested | 7 days after they are ready | So only you can download them | Deleted automatically |
| Audit log — records of who viewed, searched or exported your data, and of logins | 12 months (details then removed) | Security; your right to know who accessed your data | Details removed; the chained record of the event stays |
| Audit log — records of changes to your account, payments, refunds and roles | 6 years at least | Financial and legal accountability | Personal details removed when your account is closed; the record of the change stays |
| Server backups (where kept) | Rotated within 30 days | Disaster recovery | Deleted on rotation; deletions propagate on the next cycle |
Deleting your account (Account → Settings → Your data) removes everything in the "deleted on closure" rows at once and anonymises the rest. Legal holds: where a dispute, complaint or lawful order requires it, we keep the relevant records until it is resolved.
This schedule carries a version number and effective date at the top and is reviewed at least once a year.