Data Retention Schedule
Last updated: 30 October 2026
MimmoBook follows the GDPR principles of data minimisation and storage limitation. We only keep personal data for as long as it serves a clear purpose. The table below lists the categories of data we process and how long each is retained. When a retention period ends, the data is deleted or irreversibly anonymised.
| Category | Data | Retention period |
|---|---|---|
| Active reservations | Guest name, contact, date, resource, notes | Until the tenant deletes them or closes the account |
| Past reservations | Same as above | Archived 30 days after the event date, permanently deleted after 400 days |
| Audit log | Who changed what and when | 90 days, then automatically purged |
| Booking validation log | Anti-abuse signals on public booking pages | 30 days |
| Storage rejection events | Upload anti-abuse signals | 7 days (events), 90 days (resolved alerts) |
| Email send log | Message id, recipient, status | Rolling, aligned with deliverability TTLs |
| Email suppressions | Bounced or unsubscribed addresses | Kept indefinitely to honor opt-outs |
| Login history | Timestamp, device, IP hash | 180 days |
| Account profile | Email, display name, avatar | Until account deletion plus a 30 day cancellation window |
| Backups | Encrypted full database backups | 30 days rolling, then overwritten |
| Support requests | Message content, contact info | 24 months after resolution |
Deletion on request
You can request deletion of your personal data at any time by using the self-service account deletion in your profile, or by emailing our privacy contact . The address is hidden from automated crawlers and revealed on click. Some data may be retained for a limited period to meet legal obligations (for example, invoicing records under Finnish accounting law).
What to expect: we confirm your request within 2 business days and complete it within 30 days, as required by the GDPR. Please write from the email address on your account and name the business, so we can verify the request without asking for extra personal data.