1. Schedule

These are governance targets for implementation and review, not a claim that every historic record has already been swept. Legal holds and verified statutory duties override the targets only for affected records.

Category	Target period	End-of-period action
Rejected or incomplete applications	Up to 12 months; shorter where applicable law requires	Delete or irreversibly anonymise
CV, rates, availability and detailed expertise	Active relationship, then 6 months	Delete unless separately retained with a valid basis
Core account, assignment and delivery records	Active relationship, then 3 years	Delete or anonymise, subject to legal hold
Security and access logs	Where the CERT-In direction applies, relevant logs must be retained securely for at least 180 days within India; broader portal logs target no more than 1 year. Operational verification is pending.	Rotate securely after the applicable minimum unless needed for an incident or law
Notice and acceptance evidence	Relationship, then 3 years	Delete after claims period
Incident records	5 years after closure	Delete securely
Invoices, purchase orders, tax and payment records	8 years after relevant financial year	Delete securely when legal duties end
Hosting recovery copies	Provider/account cycle under verification	Document settings and prevent routine restoration of deleted data

2. Exceptions

A law, client instruction, active investigation, unresolved payment issue or documented legal hold may require a different period. The exception is limited to the relevant records, reviewed periodically and released when the reason ends. A policy preference alone is not a legal hold.

3. Deletion and account closure

Deletion means secure destruction or irreversible anonymisation, not merely hiding a record. On account closure, a user may request an export of their own task, delivery, invoice and payment-status records. Questions or objections should be sent to privacy@monisaenterprise.com.