Exactly what we hold, where, and for how long.
What we store, and where
| Data | Where |
|---|---|
| Account details — name, email, company | Supabase (United States) |
| Sign-in credentials and sessions | Clerk |
| Case submissions — supplier, brands, marketplace, notes | Supabase |
| Uploaded documents | Supabase Storage, private bucket |
| Research evidence and findings | Supabase |
| Delivered reports and PDFs | Supabase Storage, private bucket |
| Audit and access logs | Supabase |
| Payment records | Stripe. We hold an invoice reference; we never hold card details |
Files are stored in private buckets. They are not publicly reachable, and downloads are served only through short-lived links issued after we confirm the file belongs to you.
How long we keep it
| Data | Retention | Why |
|---|---|---|
| Uploaded documents | At most 12 months from upload, or within 30 days after your account closes — whichever is sooner. We email you 30 days before any document is removed | They corroborate a specific case and are not needed beyond it |
| Delivered reports and PDFs | While your account is active; removed within 30 days after your account closes | So you can read and download what you paid for |
| Case records, evidence, audit trail | While your account is active; removed within 30 days after your account closes | They are the record of what we delivered — including if a payment is ever disputed |
| Account details | Removed within 30 days after your account closes | |
| Transaction and invoice records | 7 years | Legal obligation — tax and accounting |
| Support correspondence | While your account is active; removed with it | |
| Marketing consent and unsubscribe records | Kept while you are subscribed; unsubscribe records kept permanently so you are not re-added |
Before we delete your documents
We email you 30 days before uploaded documents reach the 12-month limit, so you can download anything you want to keep.
Deletion is permanent. Once a file is removed there is no recovery — not by us, not by request.
What happens when you close your account
- Before closure: download any reports you want to keep. We prompt you to do this when you cancel
- On closure: no new submissions, sign-in disabled
- Within 30 days: reports, uploads, case records and account details deleted
- Retained: transaction and invoice records only, for 7 years
Dormant one-time accounts
If you bought a single report and never returned, we do not hold your data indefinitely. After 24 months with no activity we email you, and if there is no response within 30 days we close the account and follow the schedule above.
Deleting your data sooner
Email admin@hyprriq.com and ask. We will delete everything except transaction records we are legally required to keep, and confirm within 30 days.
Automated processing
Reports are produced by an automated research and analysis pipeline and reviewed by a person before delivery. No report is delivered without human review.