Data Retention Policy

Effective Date: October 16, 2026 · Last Reviewed: October 16, 2026 · Next Review Date: October 16, 2027 · Version: 2.0
Policy Owner: Privacy Officer · Approved By: Matthew Bromwich, CEO and Privacy Officer

1. Purpose and scope

This policy explains how long Core Innovation Corp. (operating as Bridgit, askbridgit.ai) ("Bridgit", "we") keeps the information processed through the Bridgit platform, how it is deleted, and how you can ask us to delete it. It supports PIPEDA Principle 4.5 (limiting use, disclosure and retention) and, where it applies, GDPR Article 5(1)(e) (storage limitation) and Article 17 (right to erasure).

It covers all data held in the Bridgit platform: account data, content created in the platform (forms, projects, activities, uploaded files), session data, audit logs, consent records, AI usage records and billing records, and data handled by our subprocessors.

Our principles:

• Keep only what we need, for as long as we need it.
• Give every category of data a defined retention period, or say plainly where one has not yet been set.
• Let you request deletion at any time, subject to the legal exceptions below.

No personal health information. Bridgit is not designed to hold personal health information. Do not enter personal health information (as defined under Ontario's PHIPA or other applicable law) or patient identifiers anywhere in Bridgit, including AI features, unless your organization has a written agreement with Bridgit that expressly permits it. Bridgit does not have a technical filter that detects or blocks such information.

2. Where data is stored

Data Location: Google Cloud Montréal (northamerica-northeast1), Canada, for all customers. Other regions are not currently offered. This includes the production database, the application, uploaded files and application logs.

Automated database backups are stored in the Montréal region.

Some data is processed outside Canada by our subprocessors when you use certain features (see section 7).

3. Retention schedule

Retention periods are configured in the platform; automated enforcement is not yet in place, and expired records are deleted or anonymized (audit logs: flagged for review) when the retention job is run.

The audit log records successful sign-ins, each failed sign-in and sign-outs, with IP address and browser (kept 90 days, as above). Record views in the application are not yet recorded; the record-view period applies once they are.

Application error logs (request details, with tokens, email addresses and other secrets removed) are kept for 30 days and deleted when the retention job is run.

The retention job never deletes user accounts or organization content on its own: those categories are off by default and run only if a system administrator explicitly enables them.

Audit logs are protected. Audit log entries cannot be changed or deleted through the application; database controls block updates and deletions. When a retention period ends, expired entries are flagged for review rather than altered.

4. Deleting your account

How to request deletion

1. In the app: Settings → Account → request account deletion. You will receive an email confirming the scheduled deletion date.
2. By email: if you cannot sign in, email the Privacy Officer at info@askbridgit.ai from the address registered to your account. If you cannot do that, we will ask for other details to confirm you own the account.
3. Through your organization administrator: your organization administrator can ask the Privacy Officer (info@askbridgit.ai) to delete your account on your behalf.

What happens

• Grace period: a 30-day grace period (cancellable), then deletion by the weekly deletion job within 7 days. You can cancel at any time during the grace period from your account settings, and we send a reminder email before the deletion date. Before deletion you can transfer templates you own to another user and download a copy of your personal data (Settings → Data Management → Download My Data).
• Deletion: a weekly deletion job, run on Sundays, deletes accounts whose grace period has ended, so your account is deleted within 7 days after the grace period ends. You receive confirmation by email.

What is deleted, kept or unlinked

Deleted:

• Your user account (email address, password hash, MFA settings)
• Your sessions
• Your consent records
• Your organization memberships, permissions, pending invitations and join requests
• Your personal template preview copies
• Your user profile (name, title and other profile details you entered)

Other personal records attached only to your account (outside any organization's workspace) may remain, unlinked from any account; ask the Privacy Officer to remove them.

Kept, with your identity removed:

• AI usage records: your account link is removed and your IP address and browser are replaced.
• Billing records: your account link and Stripe invoice links are removed; the financial record is kept for tax purposes.

Kept by your organization: content you created in an organization's workspace (forms, projects, activities and uploaded files) belongs to that organization. It stays with the organization after your account is deleted, with your account link removed.

Kept for their retention period: audit log entries about actions you took are kept for the periods in section 3, marked as belonging to a deleted account. They are needed for security and accountability.

Backups: deleted data leaves the daily backups within 7 days. Full database exports taken before each production release are stored in Montréal and are kept with no automatic expiry today. Data in them remains until they are deleted.

Response time

We respond to deletion and other personal-information requests within 30 days, extendable by up to 30 more days with written notice. If we cannot delete some of your data for a legal reason (section 5), we will tell you which data, why, and, if known, when the exception ends, and we will delete everything else.

5. Legal holds and exceptions

We may need to keep data beyond its normal retention period when:

• litigation is pending, threatened or reasonably anticipated;
• a regulator or government authority is investigating or has requested preservation;
• a court order, subpoena or preservation letter requires it; or
• the law requires it (for example, tax records).

A legal hold is placed and released by a Bridgit system administrator and can cover a specific user, organization, project or date range. The retention job checks for active holds before acting and skips any data under a hold, recording the skip in its retention log. We keep held data only as long as the legal matter requires, and limit it to data relevant to the matter. Your deletion request stays on file and proceeds once the hold is released.

These exceptions are permitted by PIPEDA Principle 4.5 and, where it applies, GDPR Article 17(3)(b) (legal obligation) and 17(3)(e) (legal claims). You can contact the Privacy Officer if you believe a hold is inappropriate.

6. Backup and recovery

Backup and recovery specifications: Cloud SQL automated daily backups (7 most recent retained, GCP-managed). A full database export is taken automatically before each production deployment, and the deployment does not proceed if the export fails. Point-in-time recovery is not enabled. Recovery Point Objective (RPO): up to 24 hours (most recent daily backup or pre-deployment export). Recovery Time Objective (RTO): Bridgit has not tested or committed to a recovery time objective. Application revisions can be rolled back within minutes. Full database exports taken before each production release are stored in Montréal and are kept with no automatic expiry today. Automated database backups are stored in the Montréal region. Backups are not held offline or in a separate account; they are protected by Google Cloud access controls limited to named Bridgit administrators.

All stored data, including backups, is encrypted at rest by Google Cloud (AES-256, Google-managed keys).

7. Subprocessors and data outside Canada

Bridgit does not currently hold signed data processing agreements with these subprocessors. Each provider's commercial / API terms apply, including no training on API data and retention as published by that provider (currently up to 30 days by default).

Bridgit controls retention of data stored in Google Cloud. Retention by the other subprocessors is governed by their terms, and we cannot delete data they hold on our instruction faster than those terms allow. Because AI requests are processed outside Canada, do not include personal health information or patient identifiers in them.

We give customers at least 30 days' notice before adding a subprocessor that processes customer content. The full list is maintained in our Vendor Management Policy: https://askbridgit.ai/api/v1/legal/policies/vendor-management-policy

Other AI providers. Anthropic (Claude) and OpenAI are the AI providers configured in production and used routinely. The platform also supports Google (Gemini), Cohere, Mistral, Perplexity, DeepSeek and Microsoft Azure OpenAI; these are available but are not currently enabled in production. Enabling one, platform-wide or for an organization that selects it, would add a sub-processor that processes the request content (in the United States, or the location stated in the notice) under that provider's commercial / API terms, and we would give customers at least 30 days' notice first.

8. Contact and complaints

Privacy Officer: Matthew Bromwich, CEO and Privacy Officer, info@askbridgit.ai, for questions about retention, deletion requests, access requests and complaints. We respond to formal requests within the times in section 4.

Security issues: info@askbridgit.ai

If you are not satisfied with our response, you can complain to:

• Office of the Privacy Commissioner of Canada: https://www.priv.gc.ca, 1-800-282-1376
• Ontario health-sector customers: where Bridgit handles personal information on behalf of an Ontario health information custodian, questions should first go to that organization, and complaints may be made to the Information and Privacy Commissioner of Ontario (https://www.ipc.on.ca, 1-800-387-0073).
• Quebec residents: Commission d'accès à l'information du Québec, https://www.cai.gouv.qc.ca, 1-888-528-7741
• EU residents (where GDPR applies): the data protection authority in your country.

9. Review and changes

This policy is reviewed at least annually, and sooner if we add data categories, subprocessors or services, or if the law changes. We notified users of this version by email and with a notice in the platform when it was published. We give notice of future material changes by email to active users and a notice in the platform, at least 30 days before they take effect.

Related policies: Privacy Policy, Data Protection & Consent Policy, Vendor Management Policy, Incident Response Policy, Terms of Service.

Contact: info@askbridgit.ai