Customer Data Retention and Deletion Policy

Purpose

This policy defines how Typo retains, backs up, and deletes customer data throughout the customer lifecycle and following termination or expiry of a customer agreement. Typo retains customer data only for as long as reasonably necessary to provide its services and meet contractual obligations.

Data Retention During an Active Subscription

During an active customer subscription, Typo retains customer data required to provide the contracted services. This may include:

• Customer account and workspace information

• Integration metadata

• Engineering activity and analytics data

• Configuration and application settings

• User-generated or customer-provided data required for service functionality.

Typo does not retain customer source code unless explicitly required for a specific feature and agreed with the customer. Customer data is hosted within Typo's cloud infrastructure on Google Cloud Platform (GCP).

Backups

Typo maintains automated backups of relevant production systems and databases as part of its business continuity and disaster recovery processes. Backups are:

• Generated automatically

• Stored within secured cloud infrastructure

• Protected using appropriate access controls and encryption

• Used only for disaster recovery, system restoration, and business continuity purposes. Backup data is not used for normal application processing or analytics.

Backups are retained according to Typo's configured backup lifecycle and are automatically deleted or overwritten after the applicable retention period.

Data Retention Following Contract Termination

Upon expiry or termination of a customer agreement, Typo will delete the customer's production data within 45 days. During this period, customer data will not be used for any purpose other than completing account closure procedures or facilitating an agreed data export. After deletion is completed, the customer's production data will no longer be accessible through Typo's systems.

Data in Backups After Customer Deletion

Customer data may temporarily remain within encrypted system backups after deletion from production systems. Such backup copies are not accessed or processed except where required for disaster recovery or system restoration. If a backup containing previously deleted customer data is restored, Typo will ensure that the relevant customer data is deleted again as part of the restoration process. Backup copies containing deleted customer data will expire automatically in accordance with Typo's standard backup retention lifecycle.

Customer Data Export

Where requested before account deletion, Typo may provide customers with a reasonable opportunity to export relevant customer data. Once the applicable retention period has expired and deletion is complete, Typo may no longer be able to recover or provide the customer's data.

Deletion Process

Customer data deletion may include:

• Removal of customer accounts and workspaces

• Deletion of database records associated with the customer

• Revocation or deletion of integration credentials and access tokens

• Removal of customer-specific stored files or objects

• Deletion of customer-identifiable analytics data.

Deletion processes use administrative or automated procedures designed to prevent continued access to terminated customer data.

Policy Review

Typo periodically reviews its data retention and deletion practices to ensure they remain consistent with contractual commitments and operational requirements.