Data Processing and Retention

Version / effective date: 2026-10-04

Customer instructions and roles

For hosted customer content, the customer ordinarily acts as controller and Howard TechWorks as processor. For self-hosted content, the installation operator manages its own processing and retention. License validation and purchase records remain separate from the operator’s archive. This notice is not a substitute for an executed data processing agreement where one is required.

Processing agreement

Before entrusting personal data requiring GDPR Article 28 terms, request a DPA at support@howard-techworks.com. It must identify subject matter, duration, purposes, data categories and people; cover documented instructions, confidentiality, security, subprocessor authorization, rights assistance, breach assistance, return/deletion, and audit information. International transfers require an appropriate mechanism and assessment. Do not assume an unsigned template or this website alone establishes these arrangements.

Retention and deletion

Customers should minimize uploads and remove data they no longer need. Hosted cancellation does not immediately delete files. Request an export or deletion through support; identity and organizational authority are checked, and applicable holds or backup limitations are explained. Self-hosted operators control their own removal and backup rotation. Retention periods must reflect the actual deployment and legal requirements, rather than an unlimited keep-everything default.

Agreement evidence

We retain policy text, its version and SHA-256 checksum, acceptance time, agreement choices and the associated account or purchase. A checksum identifies the text; it is not proof of identity or a qualified electronic signature. California renewal evidence must be retained for the legally required period, including at least three years or one year after termination, whichever is longer when that law applies. Records are access-controlled and are not used for marketing.