Data Retention Policy

Retention principles

Watchful applies the same five principles to every data category we process:

• Necessity. Data is retained only for as long as necessary to deliver the Services, meet a legal obligation, or protect a legitimate interest that has been balanced against your rights.
• Subscriber control. For data captured by Subscribers' cameras and sensors, the Subscriber sets the retention period within the Platform. We act as a processor and follow their configuration.
• Default minimization. Where no Subscriber configuration applies, we default to the shortest period that is operationally and legally viable.
• Auditability. Retention windows, deletion jobs, and exceptions are logged and reviewed under our SOC 2 controls.
• Secure disposal. When the window ends we permanently delete or irreversibly anonymize the data — not just archive it.

Retention schedule

The table below covers the data categories Watchful processes directly. Subscriber-configured retention overrides our defaults where applicable.

Where a longer period is required by law (for example, a litigation hold or regulatory retention duty), we retain the affected records for the legally required period and then dispose of them.

Subscriber-configurable retention

Subscribers control the retention window for their video, audio, analytics, and incident records inside the Platform. They can set shorter windows than our default, or longer windows where their own legal obligations require it. When a Subscriber:

• Reduces the retention period — affected records are removed in the next scheduled deletion run, typically within 24 hours.
• Extends the retention period — only data created after the change is kept longer; previously expired data does not return.
• Terminates their contract — Subscriber data is deleted in accordance with the retention schedule above, except where Watchful is required to retain a specific record by law or contract.

Deletion & anonymization

When a record reaches the end of its retention window, Watchful:

• permanently deletes the primary record from production storage on a scheduled basis;
• invalidates references to the record in indexes, search systems, and caches;
• retains an aggregated, irreversibly de-identified summary only where required for billing, capacity planning, or product analytics; and
• allows the corresponding entry in our 35-day backups to age out naturally on its rotation schedule.

De-identification is performed using techniques that prevent re-identification when combined with other data we hold; we do not rely on simple pseudonymization to claim deletion.

Legal holds & exceptions

Retention windows pause when one of the following applies:

• an active or reasonably anticipated legal claim, regulatory investigation, or law-enforcement request;
• an open security investigation where the record is needed to understand or contain an incident;
• a Subscriber-issued litigation hold for footage on their own cameras; or
• a statutory retention obligation that exceeds the default schedule (for example, financial records).

Holds are documented, owner-assigned, and reviewed at least quarterly. When the hold is released, the affected records re-enter the standard deletion schedule.

Your rights

You can ask Watchful to delete personal information we hold about you ahead of the schedule above, subject to legal exceptions, by opening a data subject request. If your request relates to footage of you on a Subscriber's camera, please contact the Subscriber — they are the data controller for that footage. We will assist them in fulfilling verified requests.

Contact Us

Questions, requests, or concerns about this policy? Pick the right channel and we'll route your message to the team responsible.