# MicroExtract Retention and Deletion Policy

**Approved for publication. Effective only when published as an approved version in MicroExtract.**

## 1. Objective

This Policy describes the retention and deletion framework for MicroExtract operated by WORKFLOW AUTOMATION PTE. LTD.

MicroExtract retains information only for as long as reasonably required for customer use, security, support, billing, legal obligations and reliable operation.

## 2. Standard self-service retention

| Plan | Source documents | Generated artifacts and job history |
| --- | ---: | ---: |
| Free | 7 days | 7 days |
| Pro | 30 days | 30 days |
| Business | 90 days | 90 days |
| Enterprise | 365 days | 365 days |

The production retention worker derives these periods from the approved MicroExtract plan catalog and applies them only to standard public Free, Pro, Business and Enterprise entitlements.

Internal pilot and non-public plans are excluded from automatic deletion by this policy unless separately configured.

## 3. Templates and configuration

Customer templates and mapping/configuration assets may be retained while a workspace remains active because they are required to provide the configured Service.

They are removed through the account or workspace deletion process unless retention is required for legal, dispute, security or compliance reasons.

## 4. Account deletion

Customers may submit an account deletion request through the available account controls.

A deletion request:

1. requires explicit confirmation
2. is recorded against the authenticated user and tenant
3. remains approval controlled
4. does not directly perform destructive deletion from the customer interface

For a valid verified deletion request, the operational target is completion from active systems within 30 days, except where information must be retained for legal obligations, billing, fraud prevention, security investigation, dispute resolution, legal hold or another lawful purpose.

## 5. Backups and disaster recovery

The production Supabase project is hosted in Singapore on the Pro plan.

Supabase provides rolling daily database backups with 7 days of availability for Pro projects. Provider database backups do not include objects stored through the Supabase Storage API.

MicroExtract additionally maintains a same-region warm logical DR copy into the MicroExtract staging recovery environment. The current DR ledger records a 30-day retention lifecycle and verified logical copies for production MicroExtract tenants and storage objects.

Accordingly, data deleted from active systems may remain in protected database backups for up to the provider backup window and in MicroExtract warm logical DR copies for up to 30 days. Backup or DR copies are not used for ordinary customer processing and should only be used for legitimate recovery, security or legal requirements.

## 6. Security and diagnostic logs

Security, availability and diagnostic logs are normally retained for up to 180 days.

A longer period may apply where reasonably required for a security investigation, dispute, legal hold, regulatory requirement or incident response.

## 7. Billing, tax and commercial records

Billing, tax, accounting and transaction records may be retained for at least the period required by applicable Singapore law, including applicable statutory record-keeping periods.

Deletion of a customer workspace does not require deletion of records that Workflow Automation Pte. Ltd. is legally required to retain.

## 8. Legal holds and exceptions

Normal deletion may be suspended where information is reasonably required for:

- litigation or anticipated litigation
- regulatory or law-enforcement requirements
- fraud or security investigations
- contractual dispute resolution
- statutory record keeping

Only information relevant to the exception should be retained for as long as reasonably necessary.

## 9. Automated enforcement

MicroExtract uses a production retention worker scheduled daily.

The worker:

- authenticates through an internal secret-backed control
- derives history days from the approved plan catalog
- acts only on public Free, Pro, Business and Enterprise plans
- processes terminal jobs only
- removes source and generated storage objects before deleting corresponding job records
- limits each tenant pass to a bounded batch
- leaves internal pilot plans untouched unless separately configured

The automated retention policy does not bypass the separate approval-controlled account deletion workflow.