# Data privacy and retention

What happens to the content you send us, and for how long.

## Retention

| Data | Retained for | Deleted when |
|---|---|---|
| Uploaded files | 24 hours after successful document creation | automatically |
| Documents and parsed text | until you delete them | `DELETE /v1/documents/{id}`, effective ≤ 24 h |
| Chat messages and answers | 90 days | automatically, or on chat deletion |
| Search queries and results | 90 days | automatically |
| Extraction results | until you delete them | on deletion of the extraction or its documents |
| Request logs (metadata only, no content) | 30 days | automatically |
| Test-key results | 7 days | automatically |

Deleting a document cascades to its parsed text, embeddings, and extraction rows. Backups are purged
within 30 days. Enterprise plans can set chat and search retention anywhere from 0 to 365 days, and
zero-data-retention is available.

## Training

Customer content — uploaded documents, queries, and generated answers — is **not used to train
models**. This is contractual, not a preference; the commitment lives in the DPA.

## Data residency

Requests are served from `us-east` by default. `eu-central` processing and storage is available on
Enterprise plans; when enabled, document content and generated answers stay in region. Paper metadata
is global.

## Sub-processors

AWS (hosting and object storage) and third-party model providers, all under data-processing
agreements. The current list is maintained at `scispace.com/subprocessors`, and changes are announced
30 days ahead by email to organization owners.

## Personal and regulated data

> [!danger] Do not send regulated personal data
> The API is not HIPAA-eligible. Do not upload documents containing protected health information,
> payment card data, or government identifiers. Redact before upload.

## Your obligations

If your users upload documents, you are the controller and we are the processor. You need a lawful
basis for the upload, and you must pass through deletion requests via
`DELETE /v1/documents/{id}`.

## Related

security-compliance · documents · content-licensing · teams-and-scopes