RETENTION, DELETION AND DE-IDENTIFICATION SCHEDULE
Effective Date: 24 August 2026
Version: 1
This Schedule forms part of Henry's standard Agreement and states the default lifecycle for information processed by Henry AI (Pty) Ltd, registration number 2023/620906/07, trading as Henry, Henry AI, Henry Ingest, Henry Insights and Henry Exchange (Henry). It must be read with the Terms of Service, Privacy Policy, Henry Consumer Privacy Notice, Operator Agreement, applicable Product and Processing Schedule, Online Order Record and signed Enterprise Annex.
Standard and Enterprise arrangements: The standard position described in this document applies unless a signed Enterprise Annex expressly varies an eligible, identified contractual matter. Where legally and operationally available, any enhanced or non-standard scope, service level, support, infrastructure, assurance, reporting, implementation or other commitment must be separately requested, assessed, approved and priced under the Enterprise Agreement. An Enterprise Annex cannot alter statutory rights or mandatory legal obligations.
1. Scope and Principles
1.1. Henry retains identifiable information only for an authorised purpose and no longer than the period below, unless a shorter lawful Tenant instruction applies or a longer period is required or permitted by law, contract, consent, security, fraud prevention, audit, dispute, claim or proof-of-compliance need.
1.2. A period runs from the stated trigger. Where more than one class applies, Henry uses the longest lawful period necessary for the relevant purpose and restricts the record to that purpose after ordinary use ends.
1.3. A Product and Processing Schedule or signed Enterprise Annex may state a shorter or longer period for a specific product, record or regulated workflow. It overrides this Schedule only for the identified record class. An Online Order Record selects an approved option but does not independently vary a legal clause.
1.4. A non-standard retention, deletion, backup, legal-hold, export or de-identification commitment requires Henry's documented internal compliance, legal where applicable, and technical approval before it is offered or enabled. No meeting statement, demonstration, proposal, email, customer instruction or individual representative's approval varies this Schedule.
2. Tenant Data During and After the Subscription
2.1. During an active paid subscription, the Tenant may access, export and delete Tenant Data through available product functions, subject to legal holds, product capability and minimum security or audit evidence.
2.2. After termination or expiry, Henry will ordinarily maintain a limited-function account or export process for 90 days so the Tenant may extract available Tenant Data and licensed Tenant-Specific Henry Outputs included in the applicable product export. Export is delivery under the Terms of Service licence and does not transfer ownership.
2.3. At the end of that 90-day period, Henry may disable the account and will delete remaining Tenant Data from active production systems and protected backups within an additional 90 days, unless Henry is lawfully authorised or required to retain the affected record.
2.4. Deletion-pending backups are isolated from ordinary production use and used only for continuity, security or recovery. If restored, the applicable deletion instruction is reapplied.
2.5. Henry is not liable for deletion performed in accordance with this Schedule after the Tenant's export opportunity, subject to mandatory law and Henry's express obligations.
3. Default Record-Class Periods
| Record class | Default retention period or deletion event | Qualification |
|---|---|---|
| Tenant source documents, emails, files and submitted content | Active subscription; 90-day post-term export period; deletion within the additional 90 days | Earlier deletion may occur on a lawful instruction or configured rule |
| Tenant-Specific Henry Outputs, including extracted fields, structured records, digital twins, reports and AI outputs | Same storage and deletion lifecycle as the source Tenant Data unless a lawful independent retention rule applies | Lifecycle treatment does not alter Henry ownership; a correction or deletion must be propagated where reasonably practicable |
| Integration tokens and refresh credentials | While the integration is enabled; disable promptly on disconnection; delete from active systems within 30 days | Protected backups follow the additional 90-day maximum; security evidence may exclude the secret itself |
| Tenant account, User profile, role and configuration data | Active subscription; 90-day export period; deletion within the additional 90 days | Minimal contract, billing, acceptance and security records follow their separate classes |
| General service-usage, performance and diagnostic logs | 90 days from creation | May be retained longer if aggregated, lawfully de-identified or required for a linked case |
| Authentication, administrator, access-change, deployment, production and security-event logs | 12 months from creation, with at least 90 days immediately searchable | The remainder may be held in protected archive storage; a material incident or investigation moves relevant records to the incident-evidence class |
| Support tickets and support attachments | Three years after closure | Unnecessary Tenant content must be removed earlier where reasonably practicable |
| Preliminary lead receipt, source, provenance and matching record | Five years after the lead is rejected, closed, converted or last relied upon | Limit the retained record to evidence reasonably necessary for source, authority, matching, fraud, dispute and compliance; remove unnecessary working content earlier where lawful |
| Selected-product application, routing, transaction, outcome, commission and reconciliation records | Five years after completion, cancellation or last financial activity | A shorter period applies where law and the Responsible Party's instruction permit; independent product providers may have separate duties |
| Source notice, Tenant warranty, product-category choice, consent, authority, terms-acceptance and withdrawal evidence | Five years after last reliance or end of the relevant relationship, whichever is later | Keep only the evidence reasonably necessary to show the authority or choice relied upon; minimal opt-out evidence may be kept longer under the suppression class |
| Contracts, Orders, invoices, tax and accounting records | Five years after the relevant financial period or transaction, or longer where law requires | Access limited after ordinary operational need ends |
| Marketing prospect data without an active customer relationship | 24 months after the last meaningful interaction | Delete earlier on a valid objection or withdrawal unless another lawful basis applies |
| Marketing suppression and opt-out record | For as long as reasonably necessary to honour the opt-out | Keep only the minimum identifier, channel, date and scope |
| Security incident, fraud and investigation evidence | Five years after closure | Longer only for a legal hold, regulatory direction or unresolved claim |
| Data-subject, POPIA and PAIA request records | Five years after final closure | Identity evidence must be minimised and protected |
| Provider due-diligence, transfer and compliance evidence | Five years after the provider or relevant processing ends | Security-sensitive evidence may be access-restricted |
| Session cookies | Until the browser session ends | Browser or security behaviour may end the session earlier |
| Persistent authentication, preference and consent-choice cookies | Up to 12 months | A shorter configured or browser period applies |
| Identifiable analytics event data | Up to 14 months | Aggregated or de-identified statistics may be retained longer |
| Personnel and recruitment records | Period required by applicable labour, tax and claims law or the documented employment purpose | Governed by Henry's internal employment schedule where more specific |
4. Legal Holds and Restricted Retention
4.1. Henry may suspend ordinary deletion for a record reasonably required for law, court or regulator process, tax, security, fraud prevention, billing, consent proof, dispute, insurance or legal claim.
4.2. A legal hold must identify the affected record or class, reason, owner and review trigger. Ian Fourie approves the hold for Henry after review by Air Counsel or other appropriately qualified external legal counsel where the matter is legally material. A hold does not justify retaining unrelated information.
4.3. Held information is restricted to the hold purpose, protected against ordinary use and reviewed at least annually. Henry will delete it when the hold ends and no other retention ground applies.
5. Deletion and Return
5.1. Henry may provide an export through an available application function, download, structured file or other reasonable standard method. Export of a Henry Output remains subject to the limited licence in the Terms of Service and does not transfer ownership. The export does not include Henry Technology, Proprietary Methodology, model weights, prompts, internal logic, lawfully De-identified Data, another person's protected information or security-sensitive internal records.
5.2. Deletion means reasonable measures designed to render the information irretrievable or unintelligible in ordinary operation, taking account of the system, medium and provider capability. Physical media, where used, will be securely destroyed or sanitised when retired.
5.3. Henry will pass a lawful deletion instruction to an affected Suboperator and rely on its contractual deletion process and confirmation where available.
5.4. If information is restored from a backup, Henry will reapply the deletion, restriction and access rules that applied before restoration.
5.5. Henry will apply a verified correction, restriction or deletion to Henry-controlled records and notify affected active Tenants, Suboperators or independent recipients where reasonably necessary and legally required. Henry may coordinate a request but does not promise to alter or erase an independently controlled or lawfully retained recipient copy. Each independent Responsible Party remains accountable for its own response and record.
6. De-identification
6.1. De-identified Data must not identify or reasonably permit identification or singling out of a person or Tenant by Henry or a recipient, taking account of other data reasonably available to that party.
6.2. Pseudonymised, tokenised or hashed data remains protected where a link, key, combination or reasonably foreseeable method can identify or single out the person or Tenant.
6.3. Henry will document the de-identification method and intended use, restrict access to any re-identification key, prohibit attempted re-identification, assess reasonably foreseeable auxiliary data and review material residual risk before a new use or disclosure.
6.4. Henry may retain lawfully created De-identified Data for service evaluation, security, reliability, generic feature improvement and aggregate benchmarks. It will review continuing usefulness and re-identification risk at least every 24 months.
6.5. Henry will not replace a specific Operator deletion instruction with de-identification for Henry's independent purpose unless the Agreement, the Responsible Party's documented instruction and applicable law authorise that outcome.
7. Roles and Requests
7.1. Where Henry acts as Operator, the Tenant remains responsible for setting a lawful retention instruction and identifying mandatory sector periods. Henry will reasonably assist with product-capability information.
7.2. Where Henry acts as Responsible Party, it determines and documents the applicable period and handles valid data-subject requests subject to lawful exceptions.
7.3. A deletion or retention request may be sent to legal@henryai.co.za. Henry may verify identity, authority, Tenant and record scope before acting.
7.4. A Tenant or source organisation remains responsible for its independently controlled pre-delivery records. Henry remains responsible for Henry-controlled preliminary matching, product-category, routing and compliance records. A participant remains responsible for records it independently controls for product assessment, fulfilment, statutory duties and its customer relationship.
8. Changes
8.1. Henry may shorten a period without adverse notice. A materially longer period or new use ordinarily applies on renewal or after at least 30 days' notice and any additional notice or consent required by law. An urgent legal hold or security preservation requirement may apply immediately to the affected records.
8.2. A Product Schedule, Online Order Record or Enterprise Annex may select only a retention option that Henry has approved and can operationally support. A customer instruction does not require Henry to implement an unlawful, technically unsupported, materially insecure or internally unapproved lifecycle.
END OF RETENTION, DELETION AND DE-IDENTIFICATION SCHEDULE