Data Retention & Deletion Policy

This policy explains how long Xarazo retains different types of data, what happens when data is deleted, and how you can request early deletion.

Retention Schedule

Data Type	Retention Period	Deletion Method
Event photos	90 days from the event date	Automated deletion from Cloudflare R2 and database
Event metadata (name, date, slug)	90 days from the event date	Deleted with event record
Host email address	90 days from the event date	Deleted with event record
Guest names and optional emails	90 days from the event date	Deleted with event record
Payment records	As required by applicable financial regulations (typically 7 years)	Retained in Stripe; Xarazo stores minimal payment metadata
IP address logs	Not stored beyond the session	Not persisted to database

90-Day Storage Window

All photos and event data are retained for 90 days from the event date. After the 90-day window expires, photos are permanently and irreversibly deleted from our storage infrastructure (Cloudflare R2) and our database. We do not retain backups of expired photos.

Important: Download your photos before the 90-day window closes if you want to keep them. Once deleted, they cannot be recovered.

What Happens at 90 Days

When the 90-day retention period expires:

• All photos are deleted from Cloudflare R2 storage
• Photo records are removed from our database
• The event gallery becomes inaccessible
• Host and guest data associated with the event is deleted
• The event URL will return a "not found" response

No copies or archives are retained after deletion.

Early Deletion Requests

Hosts and guests can request early deletion of their event or photos at any time before the 90-day expiry. To request early deletion:

1. Contact us via our contact page
2. Provide your host email address and event name
3. Specify whether you want to delete specific photos or the entire event

We will process deletion requests within 72 hours of verification. Deletion is permanent and cannot be reversed.

Note: If you request event deletion before photo 11, your card was never charged — the hold is released instantly. See our Payment Policy.

Payment Data

Payment transaction records are managed by Stripe and retained per applicable financial regulations. Xarazo stores only a minimal transaction reference (Stripe payment intent ID) for hold management. This reference is retained per financial record-keeping requirements.

Right to Erasure

Under GDPR and NDPR, you have the right to request erasure of your personal data. Submit your request via our contact page. We will respond within 30 days.

Related: Privacy Policy · Content License · GDPR · NDPR