1. Principles
- Tenant isolation by design. Each customer’s data lives in a dedicated, logically isolated tenant. Deleting or expunging one tenant’s data never affects another customer.
- Deletion is permanent (hard delete). Our primary analytical store performs hard deletes; deleted data is not retained in a “recycle bin.”
- Complete across the stack, in one window. A single deletion operation removes the targeted data from every layer that holds it — primary store, derived/semantic layers, caches, search indexes, object storage, and backups — within the same 30-day window (see §5), not just the front-end view.
- Verifiable. We can provide written certification of deletion signed by an authorized officer on request.
- Least retained. We retain only what we are legally required to retain, plus de-identified or aggregated data that cannot reasonably be linked to an individual.
2. Types of Deletion We Support
2.1 Full deletion at contract termination or expiration
Upon termination or expiration of the Agreement, and at the customer’s choice, we will delete or return all Customer Personal Data within 30 days (or a longer period the customer reasonably requests to facilitate migration), except where retention is required by applicable law. Platform, API, and MCP access is disabled, integrations are disconnected, and the customer’s tenant and its underlying data — including backups — are removed within the same window.2.2 Targeted expungement during the term (on request)
At any time during the term, a customer may instruct us to expunge a defined subset of their system-of-record data. Supported scopes include, individually or in combination:- By data subject — all records relating to one or more individuals (e.g., a departed employee exercising a right to erasure).
- By category of personal data — a class of fields such as direct identifiers (name, email, employee ID), compensation and equity data, demographic/diversity fields, or other PII categories.
- By source system — all data ingested from a specific connected system (e.g., a particular HRIS or ATS).
- By time range — records within a specified effective-date or ingestion-date window (for example, “expunge all data with effective dates in Q1 2025”).
2.3 Data-subject requests routed through the customer
Because the customer is the controller, individual access/correction/deletion requests should be raised with the customer. The customer then submits the request to us as a §2.2 expungement (typically “by data subject”), and we assist in fulfilling it within the timelines below.3. What Gets Deleted (Scope Across the Platform)
A deletion or expungement removes the targeted data from each of the following layers that holds it:4. How to Submit a Request
- Who can request: a customer’s designated administrator or authorized contact.
- How: email privacy@humanintelligence.com (or open a request through your Support channel) with the subject “Data Deletion Request.”
- What to include:
- The scope (termination deletion, or a §2.2 targeted expungement).
- For targeted expungement: the specific data subjects, categories/fields, source systems, and/or time range in scope.
- Whether you require written certification of deletion.
- Verification: to protect against unauthorized deletion, we verify that the request comes from an authorized contact before we act.
5. Timelines
Deletion is a single operation covering all copies of the targeted data — primary store, derived and semantic layers, caches, search indexes, object storage, and backups — completed within the 30-day window. Until the operation completes, any remaining copies are isolated and protected from further processing and are not used to restore the deleted data.
6. Exceptions and Retained Data
We may retain limited data after a deletion or expungement where:- Required by law — e.g., tax, accounting, or other legal-hold obligations. Such data is isolated, access-restricted, and deleted when the obligation lapses.
- De-identified / aggregated — information that cannot reasonably be linked to an individual or to the customer may be retained for lawful purposes such as platform operations and reporting.
- Access audit logs — for data expunged during the term, we retain the audit logs recording who accessed that data prior to its deletion. These form a tamper-evident security and compliance record and are not removed by a term-time expungement. They record access events (identity, time, action) rather than the deleted personal data content itself.
- Minimal security/audit metadata — we may retain non-content audit metadata (e.g., that a deletion occurred, when, and by whom) as evidence of compliance. This does not include the deleted personal data itself.