The agency's book
- Clients, households, policies, appointments, tasks, and documents stay in the app until the agency deletes them. Desk notes added to a client's activity history can't be deleted. The Notes field on the client's own record can be edited like the rest of the record. If a client is added with notes and no source, those first notes are also copied into the client's first activity line, which stays.
- Text threads (the words of texts sent, received, or written and not sent), budget and utility reviews, field visit lists and their attachments, and Scope of Appointment forms Spaces Ink prepares for a client have no automatic timer and no self-serve delete yet. Ask us to remove them. A signed copy of one of those forms follows the 10-year rule below and isn't removed on request during that time.
- An opt-out reply, such as STOP or NO, on a person's text thread also hides that person's open tasks of four kinds: "Phone follow-up", "Send text", "Next-day follow-up", and "Follow up". Other tasks stay.
- Emails and letters written in the space, sent or not, are kept with the recipient, the subject or mailing address, and the full text. They have no automatic timer and no self-serve delete yet, and deleting their client doesn't remove them. Ask us to remove them.
- Call logs keep the outcome, the notes, and any recording reference. A call logged on the Calls page also writes its outcome and notes to the client's activity history, and that line stays even if the call log is removed. A call or note saved with Pemby's Add notes writes no activity line, and its words also stay in that Pemby chat. A message Pemby removes, as the privacy page describes, is never saved as a call note or call log. Logging a recorded call through Pemby also keeps a call-recording consent record, which holds the recording reference given, whatever the answer on permission. That record follows the consent rules below, so removing the call log doesn't remove the reference. Call logs have no automatic timer and no self-serve delete yet. Ask us to remove them.
- When a spreadsheet row is held back because it has no name or ZIP code, we keep every column of that row as uploaded, including any Social Security or Medicare number column, so leave those columns out. Held rows have no automatic timer and no self-serve delete yet. Ask us to remove them.
- Deleting a record in the book hides it from the app. The row stays in the database. Every client added in the app starts with a line in their activity history. Our admin tool won't remove a client for good while that client has a consent record, activity history, or a kept document, so a deleted client's record stays, hidden, with the kept records listed below. We handle a request to delete a client's information as the law that applies requires.
- Consent records, including Scope of Appointment and call-recording consents, can't be edited or deleted in the app or with our admin tool. A change is a new record. People can't edit or delete a client's activity history in the app or with our admin tool either. Some lines follow the record they describe: editing a policy rewrites the line for its latest change, and editing a closed task in the app rewrites its closed line. The line's time becomes the time of the edit. Spectre Spaces itself also updates some of its own lines in place, such as the opt-out, START, or YES line in the client's activity history, which a later reply of the same kind on that text thread can rewrite, and the line listing the email addresses held for a call request, which adds each new address.
- Consent records and the documents attached to them as evidence can't be deleted at any age, so they are kept at least 10 years, our house policy. A signed Scope of Appointment copy is kept for 10 years from when it is stored in Spectre Spaces, and it can't be changed or deleted during that time. Nothing deletes any of them automatically.
- Each client's activity history and consent records stay when the broker who wrote them leaves, and when the client is deleted from the book.
- Every text that reaches an agency's number, and every HELP reply we send, goes into a text log with the phone number, the words, and the time. So does a STOP, NO, or START a broker records on a text thread. The text log can't be changed or deleted, and it has no timer. A STOP stays on that number until the person texts START or UNSTOP, or the broker on their text thread records that they replied START. A START lifts the STOP only for that agency, and it is not permission to text.
- Some events also go to the agency's audit trail: each attempt to send a text from the agency's number, each Pemby text a person approves, each texting unlock check, each opt-out reply (such as STOP or NO) and each START, texting consent changes, and client deletes. The audit trail records the kind of action, which record, when, and who acted when someone at the agency did, never the content. A STOP, NO, or START a broker records on a text thread is marked as recorded on the thread, without the broker's name. The texting consent change a recorded reply causes is also recorded without a name. HELP replies and other incoming texts are in the text log only. A text sent from a broker's own phone through a text link never reaches us; only the unlock check before it is written. The audit trail can't be changed or deleted, in the app or with our admin tool, and it has no timer.
- Lead submissions are kept as received, including any consent text, time, IP address, and browser details they carry. There is no automatic timer and no self-serve delete yet. Ask us to remove them. A Meta lead-form call request added to a book from the Leads page, the dashboard, or Pemby keeps its call-request line, which can't be changed, and the lead's record, which people at the agency can still edit or hide. Neither has a timer, and our admin tool won't delete them.
- Pemby chats, saved preferences, workflow runs (including any inbox previews or calendar events Pemby read for you), and the workflow steps Pemby saves for each broker after a workflow finishes without an error have no automatic timer and no self-serve delete yet. Ask us to remove them.
- Removing a person's seat turns their account off. The account record stays so the agency's history still makes sense. An account that has written activity history or a consent record can't be deleted, in the app or with our admin tool.
- Billing events Stripe sends us are kept as Stripe sent them, with no automatic timer and no self-serve delete.
- Spaces Ink documents you upload and mark up, and meeting rooms, can be deleted by the people allowed to manage them. Deleting them removes them. Scope of Appointment forms Spaces Ink prepares for a client are kept apart from them, as above, and a signed copy stays for its 10 years.
- Agency Messenger is not turned on yet. When it is, messages stay until an agency admin removes them. A removed message leaves a placeholder. An admin can also delete a whole channel, which removes all its messages with no placeholder. Admins can set a retention period, but our code doesn't run that clean-up on a timer yet, so older messages are cleared only when we run it. A legal hold blocks deleting a channel, in the app and with our admin tool, and pauses the clean-up. It doesn't stop an admin from removing a single message, which still leaves a placeholder.
- Wallet card links expire after 30 days and can be turned off sooner.
Connections
- Medicare (Blue Button) and HealthSherpa are held. While they are held, nothing new is stored from them.
- Medicare (Blue Button): disconnecting removes the access tokens and the stored claim details of that client's most recent connection. If a client was connected more than once, ask us to delete the earlier connections. A short record stays: the Medicare patient and resource IDs, summary labels such as a coverage status or a claim date, and an audit line of the connection.
- Google: disconnecting deletes the stored sign-in tokens from Spectre Spaces.
Sign-in and devices
- App session: ends after 30 minutes without activity. App CSRF cookie: 1 year. Sign-in state for Google or Microsoft: 10 minutes. Invitations: 48 hours.
- Pemby's own web browser is turned off. When it is on, its session closes after 30 minutes without use.
- The offline copy of the book kept in your browser is cleared when you sign out of the app in that browser. Sign-out won't finish while edits are still waiting to sync. If the session ends another way, such as after 30 minutes without activity, or you close the tab, the copy stays in that browser until you sign in there again and sign out. Someone else signing in on that browser doesn't clear it. The app doesn't encrypt this copy the way it encrypts the vault, so always sign out on a shared computer.
This host (spaces.s2olutions.com)
These timers apply to what this site's own services keep: seat requests from the contact page, and this site's own sign-in service when it is used. Production sign-in goes to the app, so its timers above apply there.
- Sessions. A session record holds an email and an expiry. The record and the cookie are set to expire after 12 hours.
- A CSRF cookie lives in the browser for 1 hour. It is set when the home page or the contact page is opened, and when this site's own sign-in service is used.
- Contact notes. After a note is mailed, this host keeps a copy: name, email, phone, seat, and the note. That copy is set to expire after 30 days. The mailbox copy is outside that timer.
- If a send fails, a short error note is kept for 1 hour.
- An activation link is kept for 48 hours.
- Approved seats: name, email, role, agency name, a password hash, and whether the seat is active. These records, including copies from earlier versions of this site, have no expiry timer.
- Analytics outcomes: a kind, an agency name, a broker name, a broker email, a short label, who recorded it, and when. These records have no expiry timer. A person in charge can remove one. The label is refused if it looks like an email or a long number.
- Public pages on spaces.s2olutions.com load a Meta Pixel, id 3752929798220720. Our code sends a PageView event only; Meta's automatic event setup may also record basic page interactions. Meta's script also sets its own cookies on spaces.s2olutions.com (_fbp, and _fbc when you arrive from a Facebook link); Meta sets how long they last. This page does not load that pixel, and neither does the signed-in app. The copies of the privacy and terms pages at privacy.s2olutions.com and terms.s2olutions.com load no pixel. How long Meta keeps a PageView is set by Meta.
Copies at services we use
When a person sends a text, an email, or a letter, the service that carries it keeps its own copy: Twilio for texts from the agency's number, the sender's own Gmail or our mail relay for email, and Lob for letters. An appointment a person copies to Google Calendar stays in that calendar. Stripe keeps the agency's billing records. Texts sent from a broker's own phone stay on that phone. Those copies follow each service's own rules. Deleting a record in Spectre Spaces doesn't remove them, and our code doesn't delete anything there.
Logs and backups
Before our servers write a log line, they mask text shaped like email addresses, phone numbers, Social Security and Medicare numbers, dates, and street addresses. Our code sets no deletion timer for logs.
Our code sets no deletion schedule for backups, seats, or analytics outcomes. Production backups, and how long they are kept, are set in our hosting provider's settings, not in our code. Ask us about a specific record and we will check every copy we hold.
Plan Shop at form.s2olutions.com does not keep its own copy. Each request goes straight to the agency it names, and the lead rules above apply. Plan Shop requests sent before it began delivering straight to the agency went through leads.s2olutions.com, a separate S2olutions service. Copies of those older requests are kept in Cloudflare storage with no expiry timer. Ask us to remove them. The S2olutions website forms are covered by the company privacy page.