When a customer asks you to delete their personal data, you erase it on their PIPEDA deletion request once all their lines have ended. The erasure removes everything that has no purpose after the service, and it keeps what proves the terms they agreed to, their consent and their complaints, for as long as tax and complaint rules require. Those kept records move to the Privacy archive.
Only your admin account opens Configurations → Privacy Archive. Support, sales and bookkeeping staff do not see it, and kurnl staff do not either. Every view is recorded in your audit log.
The Privacy Archive: an erased customer's number, the erasure date, the date the records are kept until, and an open complaint that holds them

The Privacy Archive

​
How a customer asks for deletion

Only the account holder can ask, signed in to the customer portal. An authorized user on the account cannot; the portal tells them that only the account holder can. The customer can ask once every one of their lines has ended, with you and with any other provider on kurnl. A line that is cancelled but still running until its last day counts as running. Until then the portal shows “Cancel your service first” and does not take the request. While a deletion request is pending, the portal offers no second one. The customer finds it in two places:
  • Settings › Security, under Delete my account, which opens a confirmation dialog;
  • the Privacy page, reached from the portal footer, which also takes access and correction requests.
Before they confirm, the portal tells the customer:
  • you answer within 30 days;
  • their sign-in ends with the erasure;
  • their invoices, payments and refunds, the service agreement they accepted, their consent and any complaints are kept in the Privacy archive for six years after the end of your fiscal year that contains their final invoice, and are deleted after that.
Once they confirm, the request is recorded against you, as the controller, with its 30-day deadline. kurnl reminds you by e-mail on day 20 and again once the deadline has passed. You erase the customer once their lines have ended, as described above, and the kept records move to the archive this page describes. While the request is pending it holds the customer’s records (see Holds).

​
What the archive keeps

For each erased customer, until their retention date:
  • the Service Agreements with their PDFs, and the record of every e-mail that carried them;
  • the consent and contract-acceptance records from checkout;
  • complaints;
  • the customer number (and an earlier one), which your invoices refer to;
  • their support tickets;
  • a partner’s references to the customer, if the order came through a partner.
An erased customer no longer appears anywhere else: not in the customer list, not in search, not on a customer page, and their tickets are out of your ticket views. A complaint that is still open stays in your complaint list until it is resolved.

​
The retention date

The retention date is the last day of your fiscal year that contains the customer’s final invoice, plus your retention period. By default the period is 6 years and your fiscal year ends on 31 December. A customer whose final invoice was in October 2026 is kept until 31 December 2032. Without an invoice, the clock starts when their last line ended.

​
Holds

A hold keeps a customer’s records past the retention date:
  • an open complaint and a pending access request hold automatically;
  • you can set a legal hold with a reason, for example during litigation or a tax objection, and lift it when it no longer applies.

​
At the retention date

Once the retention date has passed and nothing holds the records, they are deleted everywhere: the agreements and their PDFs, the e-mail records, the consent and contract records, the complaints, the tickets, the customer number and the invoices in kurnl. In your Invoice Ninja the customer is deleted with its invoices, payments and credits; Invoice Ninja keeps deleted records until you purge them there. Only counts remain, such as how many agreements of a version were issued in a month. The first deletion run for your account counts what it would delete and deletes nothing.

​
When a customer never asks

A customer whose lines with you have all ended, and who never asked to be deleted, reaches the same retention date. On that date kurnl deletes what it kept for you, as above, and the customer leaves your lists. A hold stops it, as for an erased customer. Once the customer’s period with every provider is over, kurnl also deletes their personal data. Before the first such deletion, kurnl counts once what it would delete and deletes nothing.