Legal

Data retention, export, and deletion

This policy explains how AI Team, operated by Akii Technologies, Ltd, handles retention, export, deletion, backups, logs, legal holds, and connected access for managed Agent services.

Version and owner

Effective 2026-06-25. Owner: legal-compliance. Retention rules must be recorded before a client Agent goes live.

Retention depends on data class, Agent scope, signed agreement, legal obligations, security needs, and operational evidence requirements.
Each live Agent needs a documented retention rule linked to its compliance profile and AI system register.
Custom agreements can define stricter export, deletion, or retention commitments.

Retention classes

AI Team separates operational records so short-lived work data can be handled differently from audit, billing, and security evidence.

Setup, compliance screening, legal acceptance, approval rules, AI system registers, transfer assessments, and subprocessor approvals are retained while needed to evidence lawful operation.
Safe Agent run summaries, exception records, cost events, and dashboard records are retained according to operational need and client scope.
Billing, tax, payment, security, abuse-prevention, dispute, incident, and audit records can require longer retention.

Exports

Clients can request export of eligible account, setup, Agent configuration, operational, billing, and report data where technically feasible and legally permitted.

Exports can require organization ownership, administrator approval, identity verification, authority verification, and scope confirmation.
Exports may exclude platform secrets, security controls, internal detection logic, provider confidential data, and records belonging to another client.
Connected client systems remain the source of truth for records stored only inside the client's own accounts.

Deletion

Deletion requests are evaluated against service obligations, legal requirements, security needs, and connected-system responsibilities.

AI Team can delete or anonymize eligible account, setup, workflow, report, and support data according to the applicable agreement.
Deletion in AI Team does not automatically delete records from client-owned CRMs, mailboxes, ecommerce systems, HR systems, analytics accounts, or payment providers.
Destructive requests require authorization by an organization owner or approved administrator.

Backups and logs

Backups, logs, traces, and security records can follow delayed deletion cycles because they protect recovery, investigation, and service integrity.

Database backups and object-storage backups age out according to provider backup schedules and restore policies.
Security, access, webhook, audit, incident, and billing logs can be retained where needed to investigate abuse, outages, disputes, or data exposure.
Observability systems must avoid raw prompts, credentials, medical records, regulated finance records, and full customer exports.

Offboarding

Offboarding removes AI Team access from client-owned systems and confirms which vendor data remains outside AI Team control.

OAuth grants, API keys, service accounts, webhooks, and connected integrations should be revoked or rotated.
Client-owned vendor accounts remain governed by the client's provider contracts, retention settings, and deletion controls.
AI Team can provide reasonable support to identify connected access paths used by managed Agents.

Next step

Need a retention rule for a specific Agent?

Start setup review so AI Team can confirm the work, data class, connected systems, export needs, deletion limits, and retention rule before go-live.

Start setup Contact AI Team

Version and owner

Effective 2026-06-25. Owner: legal-compliance. Retention rules must be recorded before a client Agent goes live.

Retention depends on data class, Agent scope, signed agreement, legal obligations, security needs, and operational evidence requirements.

Each live Agent needs a documented retention rule linked to its compliance profile and AI system register.

Custom agreements can define stricter export, deletion, or retention commitments.

Retention classes

AI Team separates operational records so short-lived work data can be handled differently from audit, billing, and security evidence.

Setup, compliance screening, legal acceptance, approval rules, AI system registers, transfer assessments, and subprocessor approvals are retained while needed to evidence lawful operation.

Safe Agent run summaries, exception records, cost events, and dashboard records are retained according to operational need and client scope.

Billing, tax, payment, security, abuse-prevention, dispute, incident, and audit records can require longer retention.

Exports

Clients can request export of eligible account, setup, Agent configuration, operational, billing, and report data where technically feasible and legally permitted.

Exports can require organization ownership, administrator approval, identity verification, authority verification, and scope confirmation.

Exports may exclude platform secrets, security controls, internal detection logic, provider confidential data, and records belonging to another client.

Connected client systems remain the source of truth for records stored only inside the client's own accounts.

Deletion

Deletion requests are evaluated against service obligations, legal requirements, security needs, and connected-system responsibilities.

AI Team can delete or anonymize eligible account, setup, workflow, report, and support data according to the applicable agreement.

Deletion in AI Team does not automatically delete records from client-owned CRMs, mailboxes, ecommerce systems, HR systems, analytics accounts, or payment providers.

Destructive requests require authorization by an organization owner or approved administrator.

Backups and logs

Backups, logs, traces, and security records can follow delayed deletion cycles because they protect recovery, investigation, and service integrity.

Database backups and object-storage backups age out according to provider backup schedules and restore policies.

Security, access, webhook, audit, incident, and billing logs can be retained where needed to investigate abuse, outages, disputes, or data exposure.

Observability systems must avoid raw prompts, credentials, medical records, regulated finance records, and full customer exports.

Offboarding

Offboarding removes AI Team access from client-owned systems and confirms which vendor data remains outside AI Team control.

OAuth grants, API keys, service accounts, webhooks, and connected integrations should be revoked or rotated.

Client-owned vendor accounts remain governed by the client's provider contracts, retention settings, and deletion controls.

AI Team can provide reasonable support to identify connected access paths used by managed Agents.