Legal

How long we keep things, and what deletes it

How long ApplySafer keeps each kind of personal data, why, and what deletes it.

Last updated 4 October 2026

Each period below is applied by scheduled jobs that run every hour and record what they removed, or by the erasure process when you ask us to delete your account. Where something has no fixed end date, it is in its own section further down with the reason - that section exists because the sentence you have just read was not true of everything, and the honest fix was to say which things it is not true of rather than to soften the sentence. If legal proceedings are started about something, we preserve what those proceedings need before its period ends. ApplySafer stores no CV, no card details and no location history. We do not collect salary or interview submissions. Why we hold each item is explained in the privacy notice.

Your account

Account detailsUntil the account is erased: Email address, password hash, account type, the version and date of the Terms you accepted, and an employer's name. On erasure the name, email, password and sign-in credentials are deleted; a blocked record with no contact details remains (holding the account type, role, creation and email-confirmation dates, and the version and date of the Terms accepted) so the account cannot be used again.
Sign-in sessionsUntil the session expires: Expired sessions are deleted automatically, and every session is revoked when an account is erased.
Emails we tried to send you90 days: The masked address, subject and whether it sent. Message bodies and sign-in codes are never stored.
Notifications90 days: In-app notices about your account or content.

Reviews and replies

Published reviews and repliesWhile published: A review you withdraw comes off public view at once. Erasing your account replaces your reviews, and your replies on them, with a removal notice straight away. Replies an employer representative posted on behalf of a company stay as that company's statement.
Reviews that are not publishedWords removed 730 days after the last decision: The title and every message of a review that was rejected, withdrawn, hidden or removed are replaced with a removal notice 730 days after the last decision on it — sooner if the author erases their account. This waits while a complaint file about that review still exists.
Posting record for each review or reply730 days from posting: Date and time, the IP address and browser user-agent it was sent from, the exact words, and a salted one-way hash of the account email. Kept so that a legal complaint about a published statement can be answered (limitation for defamation is one year from publication, and the court can extend it). A defamation complaint places the record on hold; the hold is released when the complaint file is deleted, and the record is then deleted on its own schedule. When your account is erased, the plain email and name are removed from this record straight away.
Defamation complaint files24 months after the complaint is closed: The complainant's name, email, notice and the IP address and browser user-agent it came from; the steps we took; and, if the poster gave them, the poster's response, full name and postal address. A file that is never closed is deleted 6 years after it was received. If legal proceedings are started, we preserve what they need before these periods end.
Admin audit records6 years: Who made an administrative or moderation decision, when and why, and sometimes a snapshot of what changed (which can include a name, email or review title). Snapshots about a person are cleared when that person's data is erased; the record of the decision itself is kept.
Moderation event logFor as long as the service runs: A tamper-evident log of moderation and complaint events: what happened, when, and internal reference numbers. It holds no review text, IP address or contact details, and exists as proof the process was followed.

Reports and complaints about content

Content reports, complaints and appeals24 months after resolution: What was reported, the reason, any details and contact email given, our decision with reasons, and a one-way code made from the reporter's connection (or account) with a secret key, used only to count different reporters.

Applying for jobs

Your CV and answersNot kept: Emailed to the employer and never written to our database, file storage or logs. The message sits in our outbound mail server's queue only while it is being delivered — normally seconds; if the employer's mail server is unavailable it is retried for up to five days and then discarded.
Record that an application was sent400 days: The job and employer, the employer inbox it was sent to, when, whether it was delivered and the mail server's reference or failure reason, a salted one-way hash of your email address, and the CV file's size, type and a fingerprint that cannot be used to rebuild it. No name, CV or answers.
Your email address after a failed send30 days: Only if delivery failed, so we can tell you. Otherwise it is not kept at all.

Employers

Company claimWhile the claim is active: The company, verification level and history. When the employer's account is erased the claim is revoked and the work email is removed from it and from its verification code records.
Verification code records30 days after the code expires: The address a code was sent to and whether it was used.
Claim evidence730 days after the claim ends: The IP address and browser user-agent when the claim was made, the work email and the officer name asserted. Kept to deal with impersonation or disputes about who spoke for a company.
Claim disputes730 days after the decision: Who raised the dispute, the details given, the IP address it was sent from, and the decision.
Job advertsUntil deleted; then 400 days: A deleted advert is taken off the site at once and its application inbox and screening questions are wiped. The rest of the record is purged 400 days after deletion, when the last application receipt pointing at it has gone.
Billing event records6 years: Plan changes, amounts and dates, kept for accounting and tax law. Stripe keeps its own payment records under its own policy.

Running the service

Usage counts90 days: Counts of searches, job views and applications. No person is identified in them.
Abuse and rate-limit counters7 days: Short-lived counters that stop flooding and brute-force attempts. For job applications they are keyed on a salted one-way hash of the connection's IP address and of the applicant's email address.
Server error log90 days: Technical error messages used to fix faults. They are not meant to hold personal information, but may occasionally include an identifier.
Moderation notices sent to reviewers730 days: The text of the notice telling a reviewer what happened to their review and how to appeal.
Deletion requests6 years after we act on the request: The record that a deletion was asked for and completed, kept as evidence that we complied.
Account restriction recordsWhile the restriction applies, then 730 days after it is lifted: The reason an administrator recorded for restricting an account, which is shown to the account holder.
Reports on old message threads730 days after review: In-app messaging has been removed; any reports made about old threads are deleted on this schedule.
Team invitations30 days after the invitation expires: Then the address and the invitation link are deleted.
Company, tribunal and news source cacheAbout a month after each fetch: Copies of public register responses and news search results, kept to avoid re-fetching. Tribunal search results are reduced to the respondent, case number and date before they are kept; decision documents and news article text are not fetched.
Unpublished tribunal and news items180 days: Items found but not published are deleted if nobody has approved them within this time.

If you apply for a job, or buy something

The statutory record of an application we relayed12 months after your last application: Your name and address, your date of birth only if you are under 22, which version of the terms applied, a fingerprint of the CV file with its size and type (never the CV itself), which employers we introduced you to and when, and what statutory enquiries we made. The law requires this of an employment agency, so an erasure request cannot shorten the 12 months - we tell you that rather than quietly keeping it. Applying again restarts the clock, because the law measures from when we last acted for you. Only created where an application was actually sent: browsing, or registering and never applying, creates nothing.
The cancellation-rights confirmation you gave when you paid6 years: The exact wording you agreed to beside the pay button, its version, a fingerprint of that text and the date. Kept for the same six years as a contract claim can be brought, because it is the evidence of what you were told before we started supplying.
Payments, refunds and chargebacks6 years: What was charged, when, and the Stripe reference. Tax and accounting records. A chargeback record keeps the amount, the reason code and the dates - no cardholder name or card number ever reaches us.

Things with no fixed end date, and why

An unresolved content reportWorked until it is resolved; identifiers removed after 3 years: A report nobody has resolved does not expire, because it still has to be dealt with - ageing it out of existence would be worse than keeping it. After three years we strip the reporter's contact address and the report text and keep the fact of the report, which is the Online Safety Act record.
An open dispute about who speaks for a companyWorked until it is decided; IP address removed after 3 years: As above: the dispute stays, the network address it came from goes.
A live company claimWhile the claim is live; IP and browser removed after 3 years: The evidence that a claim was genuine is kept while the claim is live, because an impersonation claim would turn on it. After three years that claim is long time-barred, so the IP address and browser go and the claim carries on.
An account restriction730 days after it is lifted; reason removed after 6 years if it is not: A restriction that is never lifted keeps the fact of it; the reason we wrote at the time is removed.
Administrator action log6 years: Who did what, when and why. Snapshots of your details inside those entries are cleared when you erase your account; the entry itself is the record that the action happened.
Moderation trail on reviewsKept, and deliberately: An append-only, hash-chained log of each moderation step: references, states, counts and dates. It carries no email address, no name, no IP address and no post text - which is why it is kept. It is the proof that we followed the process and that evidence was deleted on its stated schedule rather than quietly destroyed.

Retired features

In-app messages (retired)365 days from the message: No new messages can be sent. Any remaining message text is replaced with a removal notice after a year.
Stored application snapshots (retired)180 days after the application closed; 365 days at most: No new records are created. Any that exist are removed on this clock, with recruiter notes about them.

Questions about retention, or a request to delete your data sooner: write to privacy@applysafer.com.