Legal
Data Retention Schedule
Default ShipMsg retention periods and the exceptions that control deletion timing.
Effective September 8, 2026
Default schedule
| Data category | Default retention |
|---|---|
| Message content and media | Kept until the customer deletes it, or for the period the customer sets: 30 days to 10 years |
| Message records (metadata and delivery state) | Kept until the customer deletes them, or for the period the customer sets: 1 month to 10 years, never shorter than content |
| Contact identifiers | For the contact lifetime, then 30 days after deletion |
| Raw provider ingress | 7 days; unknown-asset quarantine 72 hours |
| Customer webhook attempts and event bodies | 30 days |
| Events API records | 30 days |
| Idempotency records | 24 hours by default |
| Encrypted broker content topics | No more than 7 days |
| Database event-log copies (used where the broker is not) | 30 days, and never before every consumer has read them |
| Application logs | 7 days in production (and at most 10 GiB); request traces are not stored in production |
| Content-free analytics facts | 13 months |
| Billing, invoices and pricing snapshots | 10 years |
| Audit records | 7 years |
| Consent evidence | Consent lifetime plus 3 years after withdrawal |
| Backups | A database backup is taken before each release and kept on the production server; an encrypted off-host backup with a published expiry is being introduced |
How retention is applied
A retention period the customer sets applies to data already stored as well as to new data: an hourly retention job removes what is older than the period, except anything under a legal hold. Shortening a period needs a step-up and shows what will be removed before it is saved. Financial, consent, security and audit evidence may outlive message content because law, dispute handling, abuse prevention and accountability require different periods. Retained records are minimized or pseudonymized when full identifying content is no longer needed.
Deletion and backups
Deletion removes or makes customer content unreadable across active databases, object storage, caches and indexes. Short-lived encrypted broker copies expire within seven days. Database backups are currently taken before each release and do not yet have a published expiry, so deleted data can remain in an older backup until that backup is replaced; the encrypted off-host backup being introduced will carry a published expiry, and this page will state it. A restore does not revive a completed deletion: the deletion ledger is reapplied before restored data is returned to service.
Legal holds and required records
A valid legal hold, fraud or security investigation, tax or accounting obligation, payment dispute, or binding legal demand may suspend deletion for the minimum necessary scope and time. Access remains restricted, the reason is recorded, and deferred deletion resumes when the hold ends. A customer's own owners, admins and compliance managers can place and release holds on their account, a contact or a conversation; ShipMsg compliance can place holds as well, and only ShipMsg can release those.
Contact
Reaching us today: open a support case from the console, or write to Bagadi LLC at the postal address below. The e-mail addresses named in this document are not yet receiving mail, so a message sent to one will not arrive.
Bagadi LLC operates ShipMsg. Legal questions: legal@shipmsg.com. Privacy questions and rights requests: privacy@shipmsg.com. ShipMsg support questions: support@shipmsg.com. Do not email passwords, payment-card data, message content, or identity documents; ShipMsg will provide a secure verification channel when needed.