This policy explains SubmitSignal's production retention targets. Automated deletion controls will be verified before SubmitSignal accepts production customer data.
1. Our approach
SubmitSignal retains data only while it has a clear operational, security, contractual or legal purpose. Different categories have different periods because raw form data is more sensitive than the limited records needed to explain whether a conversion was delivered.
2. Standard retention periods
| Data category | Standard period | Why it is retained |
|---|---|---|
| Raw form payloads | Up to 30 days | Field mapping, setup validation and short-term troubleshooting. |
| Mapped event information containing personal details | Up to 90 days | Qualification, delivery, retries and customer-visible event history. |
| PII-light delivery and audit records | Up to 12 months | Delivery evidence, security investigation and service reliability. |
| Account and configuration data | While the account is active | Operate the account, connected sources, mappings and qualification rules. |
“Up to” means data may be removed earlier when it is no longer required. A shorter customer-configured period may be supported where available and agreed.
3. Account closure and deletion requests
When an account closes, NorthAxis will remove or de-identify customer-controlled data within a reasonable operational period unless continued retention is required for security, fraud prevention, dispute resolution or law.
Customers and affected individuals may request deletion by emailing privacy@northaxis.com.au. We may verify the requester's identity, authority and relationship to the relevant customer before deleting information.
4. Where information is stored
SubmitSignal uses Supabase for its primary database and authentication services. Primary stored application data, including account records and connected-form data, is hosted in Supabase's Sydney, Australia region. Server-side application functions hosted by Vercel are configured to run in Sydney, Australia.
Vercel's global content-delivery network may process and cache website requests or public application content near the visitor. Infrastructure, security and diagnostic information may also be processed by Supabase, Vercel or their service providers outside Australia as part of operating and protecting their services.
5. Backups, destinations and legal exceptions
Deleted information may remain temporarily in provider-managed backups until those backups rotate out or are deleted under the applicable provider schedule. Backup data is not used through ordinary product workflows and is restored only for recovery and continuity purposes.
Deleting information from SubmitSignal does not delete copies already sent to a customer-selected advertising platform. Customers must manage retention and deletion within those destination accounts separately.
We may retain a limited record longer where law requires it or where reasonably necessary to protect the service, establish legal claims, investigate abuse or resolve a dispute. When practical, that record will be minimised or de-identified.
6. Development and test data
SubmitSignal is currently under development. Test users should use fictional or authorised test data until NorthAxis confirms production readiness and automated retention controls. Development data may be reset or removed without notice.
7. Policy changes and contact
We will update the effective date when retention periods or material practices change. Questions can be sent to privacy@northaxis.com.au.