Draft, updated 15 Sep 2026. Companion to the privacy policy. Not a substitute for legal advice.

Data retention and deletion

This is how long we keep different kinds of data, so the homepage promise — photos are not kept forever — has a real rule behind it.

What we keep

• Raw uploaded photos — deleted 30 days after the order ships, or immediately on request once the book is finalised. If you never complete an order, deleted after 30 days of inactivity.
• Final print file — kept for 12 months to support reprints, then deleted.
• Account details (name, email, shipping) — while the account is active; deleted after a closure request, except records we must keep for tax.
• Order and transaction records — at least 5 years, even if you ask us to delete the account. We can delete photos without deleting the fact a transaction happened.
• Support email — 2 years.

Our processors

Anthropic: API copies are not used for training by default and are deleted from their backend within 30 days, unless flagged for safety review (up to 2 years).

Prodigi: production files are kept as long as needed for print, quality, reprints, and support, then deleted. Order/shipping records follow their own tax and dispute rules. Tripleaf cannot force an exact deletion date once an order has shipped.

Stripe (once live): payment data stays with Stripe under their terms.

Asking us to delete

Email contact@tripleaf.app. We will:

1. Delete your raw library and finished print file within 7 business days of a verified request, or once an in-progress order ships.
2. Delete account details except the minimum transaction record the law requires — and tell you what we keep.
3. Confirm by email when it is done.

Deleted data may remain in encrypted backups for about 30 days. Anthropic’s 30-day window means a photo you asked us to delete today may still exist on their backend for up to 30 days.