Last updated: 2026-10-05. Effective: 2026-10-05.
This notice explains how long Solidmatics Inc. (“Solidmatics”, “we”, “us”, “our”) keeps the information handled in Kodanote, and what makes it go away. “Kodanote” or the “Service” means the Kodanote website at https://www.kodanote.com, the web dashboard, the iOS and Android apps, our APIs, and related services. It is published at https://www.kodanote.com/legal/data-retention/.
It adds detail to Section 6 (Data Retention) of our Privacy Policy at https://www.kodanote.com/legal/privacy-policy/. The two documents are meant to say the same thing. If they ever differ, the Privacy Policy governs. Capitalized terms that are not defined here, such as User Content, Connected Platform, Organization, Organization Admin, AI Features and Recording, have the meaning given in the Terms of Use at https://www.kodanote.com/legal/terms-of-use/.
Table of Contents
- Scope
- Retention Schedule
- Removing a Channel and Automatic Disconnection
- Deleting an Account or an Organization
- What Deletion Does Not Do
- Legal Holds and Other Exceptions
- Requests and Contact
- Changes to This Notice
1. Scope
1.1 What this notice covers
This notice covers personal information and User Content held by Solidmatics, and held by our sub-processors on our behalf, in connection with Kodanote. The current sub-processors are listed at https://www.kodanote.com/legal/gdpr/#sub-processors. It does not cover information that has been anonymized so that it no longer relates to an identifiable person.
It does not cover information held by third parties that act under their own terms rather than on our behalf, such as Connected Platforms, app stores, and the web font service described in Section 5.1 (Sub-processors and service providers) of the Privacy Policy. Their own policies decide how long they keep what they receive.
1.2 Who decides
For User Content and data received from Connected Platforms, the customer Organization is the controller and Solidmatics acts as its processor, as described in Section 1.3 (When we act on behalf of a customer organization) of the Privacy Policy. Members of the Organization decide when most of that content is deleted, using the controls in the Service. The periods below describe what happens when they do, and what happens if they do nothing.
1.3 How to read the schedule
“Until deleted” means until a member of the Organization deletes the item in the Service, or until the Organization’s data is deleted as described in Section 4 (Deleting an Account or an Organization), whichever comes first. “While the Organization’s workspace exists” means we keep the record until the Organization’s data is deleted under Section 4 (Deleting an Account or an Organization), unless you ask us to delete it sooner at [email protected]. Deleting the Organization in the organization settings does not end this period, because it does not delete the Organization’s data from Kodanote. Where we say a record has “no automatic cleanup today”, no process removes it on a timer, and it stays until someone asks us to delete it or the Organization’s data is deleted.
2. Retention Schedule
| Category | What it includes | How long we keep it, and what deletes it |
|---|---|---|
| Account identity and membership | Name, email address, password hash, multi-factor settings, profile picture, session details, organizations you belong to, your role, invitations | Held by our authentication provider until you delete your account, when the provider deletes it. Organization membership is removed when you leave an Organization or it is deleted in the organization settings. Our own database stores only your user identifier on the records you create. |
| Posts not yet sent | Post text, target channels, schedule, time zone and attached file references for posts that have not been sent to any Connected Platform | Until deleted. |
| Published post records | For posts sent to at least one Connected Platform: the post text, target channels, schedule, time zone, attached file references, the platform’s post identifier and public URL, and any error message the platform returned | Kept while the Organization’s workspace exists. These records cannot be deleted in the Service. You can ask us to delete them at [email protected]. Shorter deadlines for some platforms are set out in Section 2.4 (Platform-specific disclosures) of the Privacy Policy. For YouTube and Google Business Profile, the identifier, link and status that Google returned for a post are refreshed from Google at least every 30 calendar days or deleted, and are deleted within 7 calendar days after the channel is removed. The text and settings you wrote stay. |
| Ideas | Idea text and the list of files attached to it, including each file’s name and type, and the strategies it is filed under, if any | Until deleted. Files uploaded directly to an idea do not appear in the file library. Deleting an idea also deletes the files uploaded into it, together with their previews, any AI image description and any transcript, unless another idea or a post still uses the same file. Once no idea and no post uses a file uploaded into an idea, an hourly cleanup deletes it with its preview, description, transcript and stored copies, but never before the file is 24 hours old. A file removed before its idea was saved therefore goes about a day after upload, usually within the hour after that, and an older file goes within about an hour of being removed from the last idea that had it. Files from the file library that were attached to an idea stay in the library when the idea is deleted or the file is removed from it. There is no separate delete action for a file uploaded directly to an idea, and you can ask us to delete one at [email protected]. |
| Strategies (content plans) | Each strategy’s name, brief, content language and status (active or paused), the formats it produces, the channels it is meant for and the personas picked for each channel, the audiences it is written for, its Do and Avoid rules, source links with their notes, the library files it refers to, including each file’s name and type, and the library folders it refers to, including the name each folder had when it was added. A strategy refers to channels, personas and audiences by identifier only and keeps no copy of their content | Until deleted. Deleting a strategy does not delete any file, folder, idea, persona or audience. Ideas filed under it stay and are no longer filed under that strategy. If a file or folder a strategy refers to is deleted from the file library, the strategy keeps its name (and a file’s type) and shows it as unavailable until it is removed from the strategy. A channel, persona or audience that is removed or deleted stops showing on the strategy straight away, and the strategy drops its identifier the next time it is saved. |
| Files and previews | Uploaded images, video, PDFs, documents and audio, their file names and metadata, generated previews, audio duration, the AI image description, and transcripts of audio and video uploaded into ideas | Files in the file library: until deleted. Files uploaded directly to an idea: see Ideas. The AI image description and any transcript are stored with the file and deleted with it. Deleting a file removes its record, the stored file and its preview, and cancels any post not yet sent that uses it. If our storage provider fails to remove the stored copy, the failure is recorded, and you can ask us at [email protected] to confirm removal. An idea that had the file attached keeps the file’s name, shown as unavailable, until the idea is deleted or the attachment is removed. |
| Temporary files | Files uploaded as temporary, which carry an expiry time | Removed automatically after they expire. The expiry is 24 hours by default and can be set between 60 seconds and 30 days when the file is uploaded. An hourly cleanup removes expired files, usually within about an hour after they expire. |
| Uploads never confirmed | Files whose upload was started but never confirmed as complete | Removed automatically by an hourly cleanup once they are more than 24 hours old. |
| Connected Platform account records | The identifier, display name, username and profile picture link of each connected account, its connection status and the reason for any disconnection. On Facebook each connected account is a Page. For Meta platforms we also keep the identifier Meta gives the person or account that authorized the connection, and when they did, to match deletion requests from that person. The list of Pages a Facebook login manages is read when you choose Pages and again whenever that login is reconnected, and is not stored. On Google Business Profile each connected account is a business location, and we keep the identifiers and names of the location and of its account. The list of accounts and locations a Google sign-in manages is read when you choose locations and is not stored | Until the channel is removed in the Service, you ask us to delete them at [email protected], or the Organization’s data is deleted under Section 4 (Deleting an Account or an Organization). The record of a Facebook, Instagram or Threads channel is also deleted, in the background and normally within a few minutes, when Meta tells us that the person or account that authorized the channel removed Kodanote or asked Meta to delete their data. If that deletion cannot be completed at first, we keep the request and try again at growing intervals. An automatic disconnection keeps them (see Section 3 (Removing a Channel and Automatic Disconnection)), except for YouTube and Google Business Profile, where a channel that is not reconnected is deleted within 30 calendar days of the day our access ended. While a YouTube channel or Business Profile location is connected, its record is refreshed from Google at least every 30 calendar days. Platform-specific deadlines are in Section 2.4 (Platform-specific disclosures) of the Privacy Policy. |
| Data read from Google (YouTube and Google Business Profile) | Comments on your YouTube videos and reviews of your business on Google, with the display name and profile picture of the person who wrote them; the status of videos and posts published through Kodanote; YouTube analytics and Business Profile performance figures | Kodanote reads comments and reviews from Google when you use those features. Any stored copy of a comment or a review, and any stored Business Profile performance figure, is deleted no later than 30 calendar days after we read it. The status of published videos and posts is refreshed from Google at least every 30 calendar days or deleted, and we check at least every 30 calendar days that each one still exists on Google. YouTube analytics figures may be kept for as long as the channel stays connected and authorized, which we check with Google at least once a day. All of it is deleted within 7 calendar days after the channel is removed in the Service or you ask us at [email protected], and within 30 calendar days of the day Kodanote’s access is revoked in the Google Account, or otherwise ends, unless the channel is reconnected first. See Section 2.4 (Platform-specific disclosures) of the Privacy Policy. |
| Platform access credentials | OAuth access and refresh tokens for each connected account | Held by the connection-management service until the last channel that uses the connection is removed in the Service, or the Organization’s data is deleted. For Facebook, Instagram and Threads, they are also deleted when the last channel that uses the connection is deleted after a notice from Meta (see Section 3 (Removing a Channel and Automatic Disconnection)). For a Google sign-in, once nothing else in Kodanote relies on the same Google authorization, we also tell Google to revoke it. A Google connection that stops working and is not reconnected is deleted within 30 calendar days of the day our access ended. A Facebook login from which no Page was added is deleted about an hour after it was connected. A Facebook Page’s own access token is fetched when a post goes out and kept only in memory for that post. Our main database stores only a connection identifier. The connection-management service also stores the Organization and user identifiers attached to each connection, which are deleted with the connection, and may keep operational logs of the requests it makes to platforms for us under its log settings. You can ask us at [email protected] for the period that currently applies. |
| Connection event records | Event notices about platform connections that the connection-management service sends us: connection identifier, platform, event type, error text and the identifier of the user who made the connection | Kept while the Organization’s workspace exists. No automatic cleanup today. You can ask us to delete them at [email protected]. Events that we cannot match to an Organization contain only the connection identifier, platform, event type and reason, and are also kept with no automatic cleanup today. |
| Meta removal and deletion requests | A record of each notice Meta sends us when a person removes Kodanote in their Facebook, Instagram or Threads settings or sends Meta a data deletion request: the platform, whether it was a removal or a deletion request, the confirmation code, when we received the notice and when we completed it, and, until the request is processed, the identifier Meta gives the person. The record is not linked to an Organization | The identifier Meta gives the person is erased as soon as the request is processed. The rest of the record is kept after that, which for a deletion request keeps the status page that Meta links to working. No process removes it on a timer, and deleting an Organization’s data does not remove it. |
| Background job records | Records of background tasks such as publishing a post or processing a file, which carry Organization, post and file identifiers and, for failed tasks, the error message | For each task queue, we keep the most recent 100 completed and 1,000 failed jobs. Older records are removed automatically as new jobs run. |
| Application logs | Server logs with IP address, request details, timestamps, error details and the identifiers of the Organization, the user, and the files and posts involved, and in some entries file names; authentication headers and cookies are redacted | Kept by our hosting provider and, for our AI Features, by the runtime that hosts them, for the period its log retention settings allow, then deleted by that provider. You can ask us at [email protected] for the period that currently applies. |
| Error reports | Where error monitoring is enabled: error messages, the page or request involved, browser and operating system, and recent in-app actions | Kept by our error-monitoring provider for the period its retention settings allow, then deleted by that provider. |
| Backups | Copies of our database and file storage made by our hosting and storage providers | Where our providers keep backup copies, they remove them on their own schedules. Deleted data can remain in a backup copy until that copy expires. |
| AI processing | Images sent for description, the sound of audio files and videos uploaded into ideas, sent for transcription, and messages in the assistant chat where the assistant is available | Image descriptions and transcripts are stored with the file (see Files and previews). Describing an image or transcribing a recording or video does not create a stored conversation. The sound we send for transcription is prepared from a temporary copy of the file, and we delete both as soon as that transcription attempt ends. The runtime that hosts our AI Features may keep records of AI runs, such as usage logs and, where run tracing is enabled, the inputs and outputs of a run, under its retention settings. Assistant chat threads, where the assistant is available, are kept by that runtime under its retention settings. The AI routing service and model providers may keep inputs and outputs for a limited period under their own terms. Our speech-recognition provider keeps the sound it receives, including the sound of videos, and the transcripts it returns under its own terms, which do not state a fixed period. When it sends a transcript back, we ask it to delete its copy of that transcript about a minute later, also when saving the transcript on our side failed, and we retry a few times if that request fails, as described in Section 4.3 (Training and retention at model providers) of the Privacy Policy. You can ask us at [email protected] for the periods that currently apply. |
| Recordings on the mobile apps | Voice notes and meeting Recordings, and a small file with the Organization and user identifiers and timestamps | Stored on your device until you delete them in the app. A Recording is uploaded to Kodanote only when you attach it to an idea, and the uploaded copy is then kept and transcribed like any other file uploaded directly to an idea (see Ideas). On iOS, Recordings are included in any device backup you have turned on, such as iCloud Backup, and Apple keeps that backup under its terms. |
| Support correspondence | Messages to [email protected] or [email protected], your contact details and our replies | As long as needed to handle the request, and afterwards as long as we need it as a business record, for example to show how a request was handled or to establish or defend a legal claim. |
| Business contact and marketing records | Contact details of customers, prospects, vendors and partners, and marketing opt-out records | For the length of the business relationship, or until you object to marketing. We keep a record of your opt-out so that we can continue to honor it. |
| Billing records | Where we offer paid plans: invoices, payment confirmations, billing contact details, and the type and last digits of the payment method | As long as tax and accounting laws require. The payment processor keeps full payment details under its own terms. |
| Organization data after a deletion request | All of the Organization’s User Content, files, channel records and platform connections | Deleted after an Organization Admin asks at [email protected], without undue delay and within 30 days, or within any shorter period that Section 2.4 (Platform-specific disclosures) of the Privacy Policy sets for data from a Connected Platform (7 calendar days for data from Google). See Section 4 (Deleting an Account or an Organization). |
| Information under a legal hold | Any category above | Kept for as long as the legal obligation, dispute or investigation requires. See Section 6 (Legal Holds and Other Exceptions). |
3. Removing a Channel and Automatic Disconnection
A platform connection can end in three ways, and they have different effects on stored data. YouTube and Google Business Profile follow stricter rules when you remove a channel and when a connection stops working on its own, noted below. Section 6.2 (Connected Platforms and disconnection) of the Privacy Policy and Section 7.4 (Removing a Connected Platform) of the Terms of Use describe all three.
You remove the channel. A member of the Organization removes the channel on the Channels page and confirms by typing the channel name. We then delete the stored record of that platform account. If no other channel in the Organization uses the same platform login, we also delete the platform connection and its access credentials at the connection-management service. One Facebook login can carry several Pages, so removing one Page keeps the login while another Page from it is still a channel in Kodanote, even a disconnected one, and the login is deleted with its last Page. Records of posts already sent through that channel stay in the Organization’s post history, and posts still waiting to go out to that channel fail and are not sent. For a YouTube channel or a Google Business Profile location, we also tell Google to revoke the authorization once nothing else in Kodanote relies on it, and everything else Google gave us for the channel is deleted within 7 calendar days: the identifiers, links and status of posts sent through it, any stored comments or reviews, and analytics or performance figures. What the Organization wrote in those posts stays. Connection event records for that channel are not deleted by this step; you can ask us to delete them at [email protected].
The person who authorized a Meta channel ends it at Meta. If the person or account that authorized a Facebook, Instagram or Threads channel removes Kodanote in that platform’s settings, or asks Meta to delete the data Kodanote received, Meta notifies us. We then delete the channels on that platform that the person or account had authorized when Meta’s notice reached us, in any Organization, and the platform connection and its access credentials once no remaining channel uses it. A channel they connect again after that is a new authorization, and it stays. This runs in the background, without anyone in the Organization confirming it, and normally finishes within a few minutes of Meta’s notice. If the deletion cannot be completed at first, for example because the connection-management service cannot be reached, we keep the request and try again at growing intervals. As when you remove a channel, records of posts already sent through a deleted channel stay in the Organization’s post history, posts still waiting to go out to it fail and are not sent, and its connection event records are not deleted. For a data deletion request, Meta shows the person a confirmation code and a link to a Kodanote page where they can see whether the request is done. The record we keep of each notice is described in Section 2 (Retention Schedule) under Meta removal and deletion requests. If Meta’s notice never reaches us, or does not say which person it concerns, nothing is deleted automatically and the next paragraph applies.
The connection stops working on its own. If a platform revokes or expires Kodanote’s access, or reports the connection as no longer working, we mark the channel as disconnected and keep all of its records so that you can reconnect without losing your history. We do the same when publishing to a channel shows that the platform no longer accepts our access, when a channel is reconnected with a login that cannot post to it or that opens a different account, and when a Facebook channel turns out to be a personal profile rather than a Page, because Facebook only lets us post to Pages. Nothing is deleted in this case, with two exceptions: the Google channels described in the next paragraph, and a disconnected Facebook, Instagram or Threads channel, which is still deleted as the previous paragraph describes if Meta’s notice arrives. Revoking Kodanote’s access in a platform’s own settings has the same effect, except on Facebook, Instagram and Threads, where the previous paragraph applies. To delete the stored account record after an automatic disconnection, remove the channel in the Service or email [email protected].
Google is the exception. A YouTube channel or Google Business Profile location that is disconnected, whether because you revoked Kodanote in your Google Account at https://security.google.com/settings/security/permissions or because Google ended or expired our access, is kept only so that you can reconnect it. If you do not, we delete the channel record, its access credentials and all data Google gave us for it as soon as possible and within 30 calendar days of the day our access ended. Section 2.4 (Platform-specific disclosures) of the Privacy Policy has the full rules for Google data.
4. Deleting an Account or an Organization
Section 6.4 (Account and organization deletion) and Section 8.7 (Deleting your account) of the Privacy Policy set out the full process. In short:
- Deleting your account. Our authentication provider deletes your identity and membership data, and you leave every Organization you belonged to. Content you added to an Organization that still exists is controlled by that Organization and stays with it, linked to your former user identifier.
- Deleting an Organization in the organization settings. This removes the Organization’s membership and workspace at our authentication provider. It does not by itself delete the Organization’s User Content, files, channel records or platform connections from Kodanote, and it does not by itself remove Connected Platforms or cancel scheduled posts. Remove channels and delete scheduled posts in the Service first, as Section 17.2 (Termination by You) of the Terms of Use explains. If you want the Organization’s data deleted from Kodanote, send the request described below before you delete the Organization in the organization settings, so that we can verify that you are an Organization Admin.
- Google channels are the exception to both. Deleting your account removes the YouTube channels and Google Business Profile locations you connected, and deleting an Organization in the organization settings removes all of its Google channels. Videos and posts still scheduled for them are not sent, and their Google data is deleted within 7 calendar days, as Section 2.4 (Platform-specific disclosures) of the Privacy Policy describes.
- Having an Organization’s data deleted from Kodanote. An Organization Admin emails [email protected] naming the Organization. We verify the request and complete the deletion without undue delay and within 30 days, or within any shorter period that Section 2.4 (Platform-specific disclosures) of the Privacy Policy sets for data from a Connected Platform (7 calendar days for data from Google). Deletion covers our database, our file storage, and the platform connections and access credentials held by the connection-management service.
After an Organization’s data is deleted, we keep only information we must retain to meet a legal obligation, resolve a dispute or enforce our agreements, kept apart from active data and only for as long as that purpose requires, and backup copies until they expire on our providers’ schedules.
5. What Deletion Does Not Do
- Deleting a post, file, idea, channel, Organization or account in Kodanote does not delete content already published on a Connected Platform. That content stays on the platform under its terms until you remove it with the platform’s own tools. Kodanote does not delete posts on platforms on your behalf. See Section 6.3 (Content published on platforms) of the Privacy Policy.
- Deleting an idea deletes only the files uploaded into it that no other idea or post uses. Files from the file library that were attached to it stay in the library, and an uploaded file that another idea or a post still uses is kept.
- Deleting a strategy does not delete the files or folders it refers to, the ideas filed under it, or the personas and audiences it uses.
- Removing a channel does not delete records of posts already sent through it. For YouTube and Google Business Profile, the identifiers, links and status Google gave us for those posts are deleted, and what you wrote stays.
- Deleting Google data in Kodanote does not delete or change anything on YouTube or on your Business Profile. Videos, comments, posts, reviews and replies stay on Google until they are removed there.
- Deleting your account does not delete an Organization or the content you added to it.
- Deleting a Recording in the app does not delete a copy you already attached to an idea, or remove the Recording from a device backup made before you deleted it.
- Deleted data can remain in backup copies until they expire, as described in Section 2 (Retention Schedule).
6. Legal Holds and Other Exceptions
We may keep information beyond the periods in this notice, or suspend a deletion, where we are required to by law, regulation, court order or other legal process, where we need it to establish, exercise or defend a legal claim, or where it is needed to investigate a security incident, fraud or abuse of the Service. We keep that information only for as long as the obligation or purpose requires, and then delete it under the schedule above. Section 11.4 (No Obligation to Store or Monitor) of the Terms of Use explains that you are responsible for keeping your own copies of User Content you want to retain.
7. Requests and Contact
To ask us to delete a record that cannot be deleted in the Service, to delete an Organization’s data, or to ask about any period in this notice, email [email protected]. We verify requests before acting on them, as described in Section 8.3 (How to exercise your rights) of the Privacy Policy. If your information is part of an Organization’s User Content, please contact that Organization first; we will support it in responding.
For account help and general questions, email [email protected].
Postal address: Solidmatics Inc., 1111B S Governors Ave STE 25028, Dover, Delaware 19904, USA.
8. Changes to This Notice
We update this notice when our retention periods or deletion processes change, and we change the “Last updated” date at the top when we do. The version published at https://www.kodanote.com/legal/data-retention/ is the current one.