Data Retention & Deletion Policy

1. Introduction & Scope

CloudNexus is committed to processing your data responsibly, transparently, and in strict compliance with applicable data protection regulations including GDPR, CCPA, and SOC 2 Type II. This policy outlines how long we retain different categories of data, how deletion is executed, and your rights regarding your information.

This policy applies to all customer accounts, infrastructure deployments, support interactions, and billing records processed through CloudNexus services.

2. Data Retention Periods

Retention timelines are strictly categorized by data type and usage context. Once a retention period expires, data is automatically queued for secure deletion.

3. Deletion Process

CloudNexus employs a tiered deletion architecture to ensure data is permanently removed while maintaining system integrity and compliance.

• Soft Deletion (Grace Period): Marked for deletion within 24 hours. Remains inaccessible but recoverable for 7 days to prevent accidental loss.
• Hard Deletion: Overwritten using DoD 5220.22-M standards across all primary and secondary storage clusters.
• Replica & Cache Purge: Automatic propagation to CDN edges, database replicas, and analytics pipelines within 48 hours.
• Immutable Backups: Excluded from immediate deletion where legally required or contractually agreed upon.

4. User Rights & Self-Service

You maintain full control over your data throughout your relationship with CloudNexus. The following rights are available via your dashboard or upon request:

• Right to Access: Export all personal and infrastructure data in JSON, CSV, or PARQUET formats.
• Right to Rectification: Update inaccurate profile, billing, or contact information instantly.
• Right to Erasure: Request complete deletion of account and associated infrastructure data.
• Right to Portability: Download configuration manifests and deployment templates for migration.
• Right to Restriction: Pause processing while disputes or verification procedures are underway.

5. Legal & Compliance Exceptions

Certain data may be retained beyond standard periods to satisfy legal, regulatory, or contractual obligations. These exceptions are narrowly scoped and documented:

• Law Enforcement & Subpoenas: Data preserved under court order or legal process in the relevant jurisdiction.
• Fraud & Abuse Prevention: Access patterns and IP logs retained for up to 24 months to secure platform integrity.
• Contractual SLAs & Disputes: Performance metrics and ticket history maintained until final resolution or statute of limitations.
• Tax & Financial Reporting: Invoices, payment tokens, and tax certificates retained per local fiscal regulations.

We will never share your data with third parties except as required by law or with your explicit consent. All preservation notices are logged and auditable.

6. How to Request Data Deletion

Initiating a deletion request is straightforward. Follow these steps to ensure complete and secure removal:

All requests are processed within 30 calendar days as required by GDPR Article 17. You will receive a formal deletion certificate via email upon completion.

7. Contact & Data Protection Officer

If you have questions about this policy, need assistance with data export, or wish to exercise your privacy rights, our team is available to help.