MailGuard retention and deletion policy

What expires and when

1. Original email, attachments and message-derived content: normally 30 days from receipt of each report. A newly reported instance has its own clock even when linked to an older case.
2. Investigation free text and public replies: removed with the related expired content, or after 30 days from being recorded if sooner. Expired replies are retired; erasure never requests another delivery.
3. Minimized case and chained audit records: 90 days after the case’s last recorded activity, once no retained original or approved hold requires them. A whole expired case chain is removed together; the remaining chains are not rewritten.
4. Account records: while active, then normally 30 days after recorded offboarding. Revoked Gmail membership records and expired reporter-device credentials are removed on this schedule. Approved non-administrator console accounts must remain disabled for at least 30 days after their last recorded change before removal; active, administrator and service accounts are protected from that automatic action.
5. AI results: normally about 20 minutes in application memory, with periodic cleanup. Content deletion also makes an old result unavailable; maintenance clears active application caches.
6. Backup generations, including isolated recovery copies associated with them: 30 days from generation creation. A restricted backup made before active deletion can therefore retain content for up to 30 additional days.

What automatic deletion does

Expired originals and their metadata are removed from active report storage. Derived content and related free-text responses are retired or removed. This is deletion from the managed application stores, not a claim of forensic overwriting of every storage device.

Checks run every 15 minutes. A shared workload, unavailable service, integrity failure or other safety problem can defer a batch. The condition is recorded for operator review, and processing resumes when it can complete safely. A failed or deferred check is not recorded as a completed deletion.

Closing a case, uninstalling the add-on or revoking authorization does not itself erase a report. Normal expiry still applies, and you can request earlier erasure.

Restricted exceptions

A necessary active-case or legal hold must identify a specific scope, an approved reason and a review/end date. A hold lasts no more than 90 days per documented approval and stops applying when it expires unless a further necessary approval is recorded. Reports are not kept indefinitely merely because their case is open.

Minimal protected identifiers may remain to prevent an old accepted or uncertain notification from being sent again, to deny reuse of an erased request, and to prevent restoration of an erased report or account. These identifiers do not retain the email body, attachments or recipient address. Continued necessity is reviewed on a 90-day cycle; their automatic erasure is withheld while old requests or backups could otherwise restore data or effects.

Historical audit attribution remains unchanged during its retention period. Erasing an account does not rewrite the identity of an actor in an independently retained security record.

Backups and recovery

Backups are restricted recovery copies, not an active report search service. Expiry includes the identified backup generation and its associated isolated recovery resources. A damaged, unexpected or in-use generation requires operator review rather than unsafe deletion.

An independent deletion registry must be preserved and checked during recovery. An old backup must not overwrite that registry or make an erased report, notification or account active again. The production application refuses to start without the registry.

The current recovery checks cover copies on the same host. Off-host recovery and independent custody are not claimed as verified.

Request earlier deletion

Contact mailguard@secopslife.ro and include a report reference where available. The operator verifies your authority, identifies the relevant records, checks any necessary restriction, records the decision and applies the same deletion protections. This is an operator-handled procedure, not an unauthenticated delete button.

Do not send passwords, MFA codes, complete unrelated emails or unsolicited identity-document copies. If a necessary exception prevents full erasure, the operator explains the retained category, reason and next review rather than claiming everything was deleted.

The application cannot delete a copy already downloaded by a person or delivered into an email provider’s mailbox through this maintenance process. Relevant requests concerning disclosed copies must also be addressed to the applicable recipient.

• Contact MailGuard support ↗
• Privacy policy ↗

Operator and changes

Denis Iana operates this personal MailGuard pilot under the SecOpsLife name. Contact mailguard@secopslife.ro for this policy and data requests. No company identity, paid subscription or public pilot approval is created by this notice.

A material change to these periods or purposes requires an updated version and appropriate notice. The Privacy policy and Pilot terms describe the personal pilot. These notices do not constitute Google approval, GDPR certification or an independent security audit.