# Retention and deletion Retention is how long Hangar keeps your uploads, outputs, checkpoints and job logs before Hangar deletes them. You can delete the data earlier, or lock the data for 7 years or until a date that you set. When you lock retention, no one can shorten the period, including Hangar. Locked retention costs a one-time price for each object. The job certificate shows what you chose and why. Every job certificate stays verifiable for at least seven years from issue. ## The choices | What | Kept by default | What you can choose | |---|---|---| | Uploads | 30 days after the last booking that used them | Delete earlier; keep for 7 years; keep until a date you set | | Outputs, checkpoints and job logs | 90 days | Delete earlier; keep for 7 years; keep until a date you set | | Job certificates, data movement records and tree heads | At least 7 years, and never deleted | Nothing to choose: these records contain no customer data | The default is to delete. The Privacy Act requires an organisation to destroy information that the organisation no longer needs (APP 11.2). Hangar stores only the data that you told Hangar to keep. When you choose 7 years or a date, you can name the rule that you are meeting, in your own words, for example "Health Records Act 2001 (Vic)". Your choice and your words go on the job certificate. A 7-year or dated retention is locked retention. No one can shorten locked retention, Hangar included. You can move a date later. You cannot move a date earlier. Hangar never deletes data before the date that you chose. You can delete your own data earlier at any time, unless the data is under a legal hold. ## The reminders Before a retention period ends, Hangar emails the owners of your organisation whose email address is confirmed. Hangar sends five reminders: | When | What the message says | |---|---| | 21 days before | Stored data is due for deletion, the exact deletion time, and the link into Hangar | | 14 days before | The same message | | 7 days before | The same message | | 3 days before | The same message | | 24 hours before | The same message, with the time in Melbourne time | The reminders at 21, 14, 7 and 3 days lead to paid retention, so each reminder has an unsubscribe link. The message 24 hours before is a service notice, and its purpose is the deletion time. That message has no unsubscribe link. It goes to every organisation, including an organisation that unsubscribed from offers. Hangar sends each reminder once for each object and day. Each reminder is a record on your organisation's chain. If the deletion time moves later, for example because a later booking used the upload, the reminders start again for the new time. A message never names the object. A message never contains your data, a log line, a digest or a price. The object, its price and the choice to keep it are in Hangar, behind sign-in, at the link in the message. ## Keep for 7 years in one click Every reminder has one link. The link opens a page that shows the object, the deletion time and the price of keeping the object for 7 years. An owner of your organisation, signed in with a passkey, presses "Retain for 7 years". Hangar then does these four things: 1. Hangar charges the price once, from your organisation's credit. 2. Hangar locks the object for 7 years with S3 Object Lock in `COMPLIANCE` mode, so no one can shorten the lock. 3. Hangar writes the change as a record on your organisation's chain. 4. Hangar emails your owners to confirm. The price is near the cost of archive storage in Sydney. The published starting price is A$0.03 for each gigabyte in the first year, rising 3% a year. That price is about A$0.23 for each gigabyte for the 7 years, and at least A$5.00 for an object. Prices include GST. The page states the price and the yearly rise that the page assumes. If your credit is too low, Hangar pauses the deletion for 7 days, tells you why, and takes you to the top-up page. Press the button again after the top-up. The pause happens once for each object. The link still works after the deletion. The link then shows the deletion record: when Hangar deleted the object, how, and the record's place in the public log. ## Deletion At the end of the retention period, Hangar deletes every stored version of the object. Hangar writes a signed deletion record that shows what Hangar removed and when. Hangar emails your owners when the deletion is done, with the link to the record. The deletion record, the movement records and the job certificates stay for at least 7 years. ## Legal hold A dispute, a regulator or a court can touch a job. Hangar then places a legal hold on the job's objects. A hold stops deletion at the retention date until Hangar lifts the hold. Two Hangar operators approve a legal hold, and two approve the end of the hold. Each approval is a record on your organisation's chain, and you can see both approvals in your account. Hangar sends no deletion reminders for an object under legal hold, because Hangar does not delete the object at its date. ## Export You can download any object that you hold at any time, with its data certificate. If Hangar ever stops operating, every customer with retained data receives a signed export. The export contains the data encrypted under your own key, the key material through the recovery procedure, and the certificate chain with the published tree heads. Your retention outlives the provider. The terms say this from the first day. ## Email from Hangar Hangar sends email from no-reply@gethangar.au, authenticated with SPF, DKIM and DMARC. Replies go to support@gethangar.au. Every message is a short notice. The notice says that something needs your attention and links into Hangar, where the details sit behind sign-in. A message contains no job, release, package, model, file or organisation name. A message contains no error text, no amount and no certificate detail. The sign-in email contains the sign-in code. A receipt says that your tax invoice is ready and links to the invoice. Every subject is generic, such as "Hangar: action needed". The subject of a notice, a reminder or an offer starts with the send date as YYMMDD. Messages have no images, no tracking and no links to anyone but Hangar. Hangar sends two kinds of message: - **Service messages** tell you about your account: bookings, jobs, certificates, credit, notices about security advisories and offline tiers, and the deletion notice 24 hours before a deletion. Service messages have no unsubscribe link, because they are about something that you need to know. - **Offers** are the reminders at 21, 14, 7 and 3 days that offer paid retention. Each offer has an unsubscribe link that works at once and needs no sign-in. An owner can turn offers on and off in settings. If a message to your address bounces, Hangar stops sending to the address. A person then contacts you for a working address.