Retention & Destruction Schedule
Version 2026-09-27.1
Draft prepared by the Nobility team on 2026-09-11; counsel review pending. The timings below describe how the system is actually built and are enforced by automated sweeps and a tested deletion routine, except where a row says the shop does it itself in the app. Counsel review may tighten the language; the product already honours these windows. This is the public retention schedule and destruction policy for the face data described in our Privacy Policy. It is kept by Nobility, 205 Glastonbury Blvd, Glastonbury, CT 06033 (hello@nobilitybarbershop.com).
Photos and face data
| Data | Where it lives | Kept for |
|---|---|---|
| Try-on selfies (and any reference photo) | Processed in memory only; sent to Google's Gemini API transiently | Never written to our storage. Discarded when your preview renders or the request fails. |
| Hair and face description produced by the AI read pass (text) | In memory only | Discarded when the preview finishes. Never saved to the database. |
| Selfie fingerprint (keyed one-way hash of the photo file — not an image, cannot be reversed) | Database: one copy on the upload record, one on the preview record | Used so an identical upload is not charged twice. The upload record's copy is erased by the sweep no later than 24 hours after the upload. The preview record's copy is erased when that preview is deleted (see the two preview rows below), and any copy whose preview is already gone is erased by the sweep no later than 24 hours after the upload. Both are erased immediately when you revoke photo consent or delete your account. |
| Unsaved previews (show your face) | Our private storage (Cloudflare R2) | Deleted by the automated sweep within 24 hours of being made. Unsaving a saved preview makes it unsaved: it goes within 24 hours of being made, or at the next sweep (within minutes) if it is already older. Orphaned preview files older than 24 hours are also reclaimed by the sweep. |
| Saved previews (show your face) | Our private storage (Cloudflare R2) | Until you unsave them (then as for unsaved previews), revoke photo consent, or delete your account — revoking and deleting your account delete them immediately — and never longer than 365 days after you saved them: the sweep deletes a saved preview and its fingerprint automatically by then. |
| Signed-out demo previews | Returned to your browser only | Nothing is stored. |
| Barber catalog photos | Our private storage (Cloudflare R2); location metadata (EXIF/GPS) stripped on upload; sent to Google's Gemini API as the reference image when a client previews that style | Shown while the style is live. A photo taken down on its own (for example after a report) comes off every page and its file is deleted from our storage at that moment; its record, marked as taken down, stays until the style is retired. Retiring a style deletes its photos from our storage at that moment and removes their records, a taken-down photo's record with the rest; a file the storage refuses to delete keeps its record so the next retire finishes the job. |
| Client visit photos (before/after, taken by your barber) | Our private storage (Cloudflare R2); EXIF/GPS stripped on upload | Until the barber replaces or removes them or you delete your account. If you never created an account, the shop deletes them on request within 30 days, from your client page in the app (deleting the client record deletes every visit photo file with it). |
Everything else
| Data | Kept for |
|---|---|
| Account profile (email, phone, date of birth, role) | Your email, phone, date of birth and the sign-in identifier the account was created under are all removed on account deletion. The row itself stays, de-identified: what is left on it is an internal id, your role, the date the account was created, the date it was deleted, and a marker that the age check had been passed — nothing that names you. The role is kept so linked records (appointments, the shop's client book, audit rows) stay consistent. The sign-in identifier is removed from our copy as well as at Clerk. Under-13 sign-ups are hard-deleted entirely, including the sign-in at Clerk. |
| Consent records (type, policy version, dates, IP, browser) | Retained as legal evidence. IP address and browser are removed on account deletion; the type/version/dates remain. No photo is ever part of a consent record. |
| Signed-out demo consent evidence (keyed hash of network address + browser, version, timestamp) | Retained with the audit log as evidence that consent was given; contains no image and no name. |
| Barber's records about you (client book: name, contact, tags, notes, visit history, formula notes) | Until you delete your account; then the row becomes "Deleted client" keeping the visit and no-show counts, the total spent and the date of the last visit, and the dated visit rows stay without their photos or formula notes. If you never created an account, the shop deletes the record on request within 30 days, from your client page in the app — the record, its visits, notes and photo files; the deletion is audit-logged without your details. The shop's record that an offer text or email went to you is kept with your number or address removed from it, unless another client record at the shop has the same number or address, in which case the two cannot be told apart and it is left as it is. |
| Appointments | Retained as business records; your identity, note and opted-in text number are removed on account deletion. The shop owner and the shop's admins can download the shop's bookings as a spreadsheet (booking time, appointment details, and the client's name, email address and phone number; never booking notes). A downloaded spreadsheet is the shop's own copy, outside the automated sweeps; each download is recorded in the audit log. |
| Waitlist requests (which barber and day you asked about, and whether we told you a spot opened) | Deleted 30 days after the day you asked about, and sooner if you remove the request or delete your account. |
| Payment records (amount, status, whether a Cash App link was sent) | Retained as business and tax records. No card, bank or Cash App account details are ever held. |
| Messages we sent you, tried to send, or have not sent yet (email/text ledger) | The record is kept whether the message went out, the provider refused it, or it is still waiting; the recipient address or number is removed on account deletion. The shop owner and the shop's admins can see it in the app with the address or number partly hidden; a barber sees only messages about appointments on their own calendar. |
| Messages we held back (which message, when, the appointment if any, the address or number, and why it was not sent: the number is on the do-not-text list, it was outside texting hours, text consent was no longer active, a daily message limit or the limit of 4 offer texts a month, counted over the last 31 days, was reached, you had unsubscribed, the unsubscribe link or the shop's postal address an email must carry was missing, or the provider refused it) | Deleted automatically 395 days after the record is made. The address or number is removed sooner, when you delete your account. A Cash App pay link that could be neither texted nor emailed is recorded the same way and deleted on the same schedule. The shop owner and the shop's admins can see these records in the app with the address or number partly hidden; a barber sees only those about appointments on their own calendar. |
| SMS opt-out list (phone number, date, how it was added — a STOP reply, or our texting provider telling us the number had already opted out with them) | Kept for as long as the number must stay suppressed, so it is never texted again. Not removed on account deletion — deleting it would let a number that said STOP be texted. Removed when that number replies START. Your data export lists any of your numbers that are on it. |
| Data-export bundles | One bundle at a time: a new request deletes the previous one. The sweep deletes every bundle no later than 24 hours after it was created and records the deletion in the audit log; the download link stops working shortly before that, so it never points at a deleted bundle. Deleting your account also deletes your bundle at that moment; if that step fails, the sweep's 24-hour limit still applies. |
| Audit logs (consent grants and revocations, deletions, exports, sweeps, moderation verdicts) | Retained for security and compliance review; identifying details are stripped from your events on account deletion. |
| Reports you file about a preview (which preview, what you wrote in the report, and how it was resolved) | Retained as the record of the safety review. Deleting your account removes your name from the report; the report itself and its outcome stay. |
| Abuse counters and held booking slots (how many previews or downloads came from one device or account in the current window, under a keyed one-way code — never the network address itself) | Counters are deleted by the sweep 48 hours after the window starts; a held slot is released the moment the hold expires, and its record is deleted by the next sweep, within 15 minutes while the runs are on time. |
| Server request logs (Vercel) | Metadata only, never image data; kept for the period set by our hosting plan. |
| Error reports (what broke, on which page, when, and how often; email addresses, phone numbers, network addresses and codes are removed before saving; never linked to your account) | Deleted automatically 30 days after the error last happened. |
| Usage analytics (scrambled visitor code made from your IP address — never the address itself — approximate location, pages visited, preview and booking events) — our database, only while usage analytics is switched on | Deleted automatically after 90 days. On account deletion the link to your account is removed. |
Vendor copies
Google's Gemini API processes your selfie and the reference image (a photo you add, or the catalog photo of the style you pick) to produce the preview. Under Google's paid API terms they are not used to train its models, but Google may keep inputs and outputs for a limited period to detect abuse, under its own terms. The finished preview, which shows your face, is sent to Gemini as well, to tell hair from face in it. Sightengine processes each finished preview, each photo a barber adds to a client's visit record, and each catalog photo the shop uploads, to produce the safety verdict, under its own terms. We have no deletion control over those vendor-side copies and do not call any vendor deletion API. When you delete your account we delete your sign-in at Clerk directly. Resend and our SMS provider keep their own delivery logs under their terms.
How deletion happens
An automated sweep runs every 15 minutes. It expires selfie records and erases their fingerprints within 24 hours, deletes unsaved previews (and their fingerprints) within 24 hours, deletes saved previews no later than 365 days after they were saved, reclaims orphaned preview files, and deletes export bundles within 24 hours; each of these goes on a run shortly before its deadline (up to 20 minutes early), never after it while the runs are on time. It also deletes waitlist requests 30 days after the day they asked about, drops expired abuse counters and expired booking holds, and deletes records of held-back messages 395 days after they were made. Revoking photo consent and deleting your account run the same tested purge routine right away. Connecticut law requires a business to stop processing sensitive data as soon as practicable, and no later than 15 days, after you withdraw consent; our purge of the copies we hold runs at once. Copies a vendor keeps under its own terms are described in "Vendor copies" above. Deleting means removing the database record or the stored file, so it can no longer be read or used. Every deletion is recorded in an audit log — that log is the proof this schedule is real.