Data Retention + Offboarding Policy

1. The commitment

Three things never change about the data you bring to or create on LetzCharter:

You own your data while you’re here. Your fleet, your pricing rules, your service-area map, your booking history, your customer list, your per-booking margin data — all yours.
You can take it with you, anytime. One-click export produces a ZIP archive containing your full data set in CSV + JSON. No wall, no “reach out to support,” no fee.
You can leave, anytime after the pilot non-cancellable period. Self-service offboarding, 30 days’ written notice. See your Founding Partner agreement at /legal/pilot-terms for the cancellation terms specific to your tier.

The rest of this document spells out what happens to your data after you offboard — minute by minute, day by day. We want the timeline on the record so no operator wonders afterward whether something was kept that shouldn’t have been or deleted that should have stayed.

2. The retention timeline

From the moment you confirm offboarding on /operator/settings/close-account, the following sequence runs. The timeline is the same for every operator, regardless of tier, tenure, or reason for leaving.

Day 0 — Confirmation

Account marked for offboarding; export triggered

Pending bookings must be resolved (completed, cancelled, or reassigned) before confirmation; the offboarding form blocks otherwise. On confirm, a one-click data export is triggered automatically and emailed to you as a download link. Your account flips to offboarded — warm retention; you can still log in but cannot accept new bookings.

Days 0–30 — Warm retention

Everything is kept; you can reactivate at any moment

During this window your operator profile, fleet, pricing rules, service area, booking history, contact details, and uploaded documents remain stored on our systems untouched. The window covers the standard chargeback period for any final-month bookings and gives you time to rescind if you change your mind. Click Reactivate in the offboarding-confirmation email or from /operator/settings to restore the account in full — no data loss, no re-onboarding.

Day 30 — PII anonymization

Personally-identifying fields are scrubbed

A scheduled job runs nightly and processes operators past day 30. For each one it:

Replaces your legal name and DBA with an anonymized handle (e.g. “Operator #1234”) on every historical record.
Removes contact email, phone, mailing addresses, and Stripe Connect account ID from operator records.
Removes operator-uploaded documents — logos, certificates of insurance, business licenses — from both the database and cold storage.
Replaces vehicle photos with stock images keyed to vehicle type, or removes them entirely where stock isn’t available.

The job is idempotent and audit-logged. After it runs, re-onboarding under the same legal entity creates a new operator record — there is no PII left to restore.

Day 30 onward — Aggregate retention

Anonymized booking history and aggregate metrics persist

After anonymization we retain:

Booking records, with your identity replaced by the anonymized handle. Customers who booked through your operator still see their own booking history; operator-side identifying details no longer surface.
Aggregate platform metrics — total bookings, gross merchandise value, lane-pair statistics — for trend analytics and reporting.

These records are not personally identifying and are retained indefinitely unless you submit a separate written request to remove them. (Bookings touching pending payouts or open disputes are excluded from removal until those resolve.)

3. What is and isn’t covered

Covered by this policy: operator account data created by you or about you on the LetzCharter platform — fleet, pricing, service area, business contact details, uploaded documents, operator profile copy, vehicle photos.

Not covered by this policy:

Your customers’ personal data. Customers who booked through you own their own data. Customer-side deletion requests are handled under our separate customer-facing privacy policy. Your offboarding does not delete customer accounts.
Payout, tax, and financial records. We retain transaction-level records as required by applicable tax law and Stripe Connect’s record- keeping obligations. These are not used for marketing or operational purposes after offboarding.
Sales Partner attribution records. If a Sales Partner referred you, the partner-side attribution row is preserved for the partner’s earnings audit trail per the Sales Partner Program Terms §3. Your operator-side identifying data is still anonymized per §2 above.
Aggregated metrics already published. Anonymized statistics published before your offboarding — for example, a public lane-pair popularity dashboard — are not retroactively redacted.

4. Re-onboarding

Within 30 days (warm-retention window): click Reactivate from the offboarding confirmation email or your account-closure screen. Your full account restores — fleet, pricing, history, identity — exactly as it was. Your locked rate and tier are preserved per the Founding Partner agreement.

After 30 days (post-anonymization): your prior account is no longer recoverable — there is no PII left to restore. To rejoin LetzCharter you re-enroll through the standard /apply flow, and your terms reflect the program version current at that time. Your prior locked rate does not carry forward automatically; if Founding Partner enrollment has closed by the time you return, standard marketplace rates apply.

5. How this policy can change

This document is itself versioned per the meta-rule on /commitments:

Each enrolled operator’s policy is the version stamped to their enrollment. v1 governs offboardings initiated under v1.
The policy is reviewed annually each May. Either the current version stands or a new version is published.
Before any new version takes effect, all enrolled operators receive at least 90 days’ notice by email and operator-portal banner. The notice describes what changed and what stays the same for existing enrollments.
Changes are forward-only. LetzCharter never reduces the terms of an existing offboarding window after it has begun. An offboarding started under v1 completes under v1 even if v2 is published before day 30.

6. Questions and disputes

Anything about your offboarding, your retained data, or a request to remove aggregated records: reach out via /contact and we’ll route to the right team. All retention- related decisions are audit-logged; we will show you the log if asked.