LimnPrivacy Policy
How long data is kept
What Limn removes on a clock, what it keeps until you delete it, what happens when an account closes, and how far back a restore reaches.
- Last updated
- November 6, 2026
On this page
Most of what a workspace puts into Limn is kept until somebody deletes it. A few things run on a clock, and those are listed below with the period the software enforces. Where nothing removes something automatically, this page says so rather than implying a schedule that does not exist.
Contacts, conversations, calls, appointments, jobs, quotes and invoices are kept for as long as the workspace wants them. Nothing expires them unless the workspace chooses it: an owner can have deleted contacts erased once they have been in the trash for 30, 90 or 365 days.
Deleting one hides it from everybody in the workspace straight away, and a deleted contact can be put back from the trash. The record itself is removed when the workspace is removed, or when the contact is erased.
Erasing is how a business answers a person who asks it to delete what it holds about them. It removes the person's name and contact details, their conversations, calls, notes, form answers and website visits. Invoices, quotes, jobs and signed documents stay, because a business has to keep them, and they point at a contact that no longer says who it was. An erased contact cannot be put back.
Assistant customer and background-work events
30 days
A daily pass removes older events in batches. Customer events hold an outcome and record reference. Staff conversation threads stay until the business is deleted.
Page views from a website carrying the visitor snippet
90 days
A nightly pass deletes every view older than that, across every workspace.
A sign-in link for the customer portal
15 minutes
It stops working after that. A link that was used is deleted a day later, and a link that expired is deleted by the daily pass.
A signed-in customer portal session
30 days
The session ends then, and the daily pass deletes the ended session.
A password reset link, or the link that cancels an account deletion
30 minutes
After that the link is refused and can be asked for again.
A sending domain that was added and never verified
7 days
The record is deleted and the name is free for somebody else to claim.
A request asking a customer to put a card on file
14 days
The link expires. Nothing on it was a card number: those are typed on the processor's own page.
A personal photo or note deleted from the private journal
30 days
Hidden the instant it is deleted; the file itself is removed a month later.
An entry in a workspace's activity log
365 days
The daily pass deletes older entries. An entry another feature still uses stays: the one an undo restores from, a refund request or receipt on a payment, who created a contact, and an account or workspace closing.
The step-by-step record of a finished automation run
90 days
The run stays in the automation's history. The daily pass deletes the record of each step.
A call to an automation's incoming webhook
90 days
The daily pass deletes the record of each call once it has been handled.
An account is deleted from Settings, under Profile. Asking starts 7 days in which signing in is refused and an emailed link undoes the request.
After that a daily pass removes the person: the account, every sign-in session, saved devices, and the sign-in links attached to them. Where that person was the only member of a workspace, the workspace goes with them — every contact, conversation, message, appointment, job and invoice in it — because a workspace nobody can reach is not a deletion, it is an orphan.
Once the 7 days are over, the request can no longer be undone. A workspace with a lot in it is emptied in parts first, so its removal can finish up to a week later.
A workspace with more than one member is not removed this way. Somebody else still works there, so the account leaves and the workspace stays.
A recorded call and its transcript stay with the workspace until the workspace deletes them. The audio is held by the company that carried the call, listed on the subprocessors page.
Files a workspace uploads — photographs, documents, video — sit in a private store that no address on the public internet reaches. Closing a workspace removes the records that point at those files, and then the stored files themselves, within a day of the records.
The database can be restored to any moment in the last 24 hours. Past 24 hours there is no earlier copy to restore from, which is the same fact read the other way: a deletion is gone for good one day after it happens.
When something breaks, a report goes to the company that collects them, and the record of a background job goes to the company that runs it. Both keep what they receive on their own schedules. Error reports carry the fault and where in the code it happened; request contents, email addresses and account details are stripped before anything is sent.
An owner can download everything a workspace holds from Settings, under Organization. It is offered beside the delete button on purpose: leaving with your records should not need a request.
Questions about any of this go to support@launchwithlimn.com.