How long we keep your data, and why.
This schedule hasn’t had formal legal review, and reflects Marketfolk’s own considered decision on each period below. Under UK GDPR there’s no single fixed retention period for most categories — the requirement is to keep personal data no longer than necessary for the purpose it was collected for, and to be able to justify the period chosen. The payment-record period reflects standard UK accounting-record practice, pending final accountant sign-off.
| Data category | Retention period | Why |
|---|---|---|
| Account data (email, role, profile details) | While the account is active, plus a limited period after deletion is requested to complete the deletion process and prevent immediate re-registration abuse | Necessary for the account to function; the short post-deletion window is operational, not a legal minimum |
| Applications (maker to market) | While the associated account is active, plus the same period as booking/payment records where an application resulted in a paid booking | Needed for both sides to see application history and for dispute resolution |
| Insurance certificates | Deleted when replaced by a newer certificate, or when expired and not renewed within a reasonable grace period | Matches our existing document-handling design, not a new decision |
| Payment and booking records (amount, date, booking reference — never card details, which Marketfolk never stores) | 6 years from the end of the relevant company financial year | Commonly cited UK practice for accounting-record-keeping obligations; the exact scope for a platform business is pending final accountant confirmation |
| Communications (booking threads, organiser broadcasts, contact form messages) | While the associated account or booking is active, plus a limited period after for dispute-resolution purposes | Needed to resolve a dispute raised shortly after an event |
| Marketing/waitlist opt-ins | Until you unsubscribe or opt out, or after 24 months with no response to any communication | PECR/UK GDPR requires marketing consent to stay current and withdrawable; stale, unresponsive contacts aren’t retained indefinitely |
| Server/security logs | 30 to 90 days for routine logs; longer only where needed for an active security investigation | Short retention is favoured unless there’s a specific reason to keep more |
What happens on account deletion
When you request deletion, your account and profile data is anonymised immediately, except where a record needs to be kept for one of the reasons above (an active dispute, a legal retention requirement on payment records). Where data must be retained for such a reason, it’s restricted from ordinary use, not left visible in the live system.
Processors and their own retention
Cloudflare, Resend and Stripe each hold data as separate processors or controllers under their own terms, referenced in our privacy notice. This schedule covers what Marketfolk itself retains directly; it doesn’t override or restate each processor’s own retention practice.