Annex Orbis1. Principles
- We keep information only as long as it is needed to provide the Services, protect accounts, and meet legal, tax and regulatory obligations.
- For Customer Content, the Customer decides: many features let an organization set its own retention period, and the Customer can delete its content.
- A legal hold placed by a Customer suspends automatic deletion of the content it covers until the hold is released.
- We review this policy at least once a year, and whenever we add a feature that stores a new kind of information.
2. Retention periods
| Information | How long we keep it |
|---|---|
| One-time sign-in codes | Expire after 10 minutes; deleted 24 hours after expiry |
| Passkey sign-in challenges | Deleted when they expire, within minutes |
| Sign-in attempt records | 30 days |
| Sessions | Up to 30 days (shorter if you choose); records deleted 30 days after the session ends |
| Organization invitations | Expire after 14 days |
| Security and audit records (sign-ins, device changes, actions taken, with IP address and user agent) | Up to seven years |
| Files in trash | Permanently deleted 30 days after they are trashed |
| Earlier file versions | As set by the organization's version-retention rule |
| Unsent e-signature envelopes | Expire after 14 days unless the sender sets another period |
| Completed e-signature records and audit trails | While the organization is active, so signatures stay verifiable |
| Inbound email staging copies | 7 days after delivery |
| Undelivered outbound email | Abandoned after 24 hours |
| Inbound MMS media | 30 days unless saved |
| Call recordings held by our telephony provider | Deleted from the provider once copied into the Services |
| Background screening records | 90 days after the screening completes, or the period the organization sets (1 day to 10 years), unless a legal hold or open dispute applies |
| Employee presence records (active, idle or away, where the organization turns them on with notice and consent) | The period the organization sets (1 day to 10 years), unless a legal hold applies |
| Employee location samples (where the organization turns them on with notice and consent) | 30 days, and only while clocked in; sooner if the organization sets a shorter period, longer only while a legal hold applies |
| Exact clock-in location (latitude, longitude, accuracy), recorded only where a clock rule asks for it | Until 90 days after the pay period closes, longer only while a review, dispute or legal hold is open; then reduced to whether the clock-in was inside the work area and about how far |
| The copy of a clock-in saved on your phone or tablet before it is sent | Its position until the clock-in is received or refused; the rest until the app next runs 7 days after it was sent, or 30 days after it was refused; a clock-in not yet sent stays until it is sent with your sign-in or the app is removed |
| Whether a clock-in was inside the work area, about how far, and the clock-in times | With the pay records, at least six years |
| Clock-in photos (only where an organization turns them on) | 30 days unless flagged for review |
| Detailed driver positions | Reduced to one position every 15 minutes after 7 days; kept at that resolution while the organization is active |
| Driving telemetry samples | 30 days by default |
| Navigation records | 90 days by default |
| Proof-of-delivery images | 91 days after the route closes; a fingerprint of each image is kept as evidence |
| Fleet compliance records | Vehicle inspection reports 90 days; short-haul records 180 days; vehicle and maintenance records 1 year; driver files and accident records 3 years; fuel-tax GPS records 4 years |
| Wake-word recordings, if you opt in to saving them to your account | 1 year, and deleted as soon as you withdraw consent, delete them, or close your account |
| Text-message consent records (your phone number, when you opted in or out, which version of the wording you agreed to, and the IP address and device used), including the opt-out recorded when you delete your account | 5 years after each record, as evidence of your text-message consent choices; claims under the Telephone Consumer Protection Act can be brought for 4 years |
| Event messages between our services | 30 days |
| Database backups | 7 days, encrypted |
| Contact-form submissions | Until you ask us to delete them, or 3 years after our last contact with you |
| Public motor carrier directory | Current records while published, and earlier versions to show how a record changed |
Customer Content not listed above, including email, chat, text messages, call and meeting recordings, transcripts, HR records, accounting records and bank transactions, is kept while the Customer's organization is active, until the Customer deletes it, or until the organization closes as described in section 5.
3. Deleting your account
You can delete your account in the Annex Orbis app on iPhone, iPad, Android phones and Android tablets (Account › Privacy › Delete account), in the web app, or at annexorbis.com/account-deletion, where you can sign in with a passkey or an email code. We confirm the request with a code sent to your email, and you choose to delete now or in 7 days (you can cancel a scheduled deletion until it takes effect). If you are the only owner of an organization, you must transfer ownership or close the organization first.
When deletion takes effect we:
- sign you out everywhere and revoke your sessions, devices and passkeys;
- remove your name, profile photo, email address and phone number, and delete your settings, preferences, recovery codes and sign-in codes;
- remove your device push tokens;
- delete your HAL wake-word recordings; and
- end your access to every organization.
We also send your request to each organization you belonged to. Deleted information can remain in encrypted backups for up to 7 days.
4. What we keep after you delete your account
Deleting your account removes your sign-in and your profile. Some records stay, for the reasons below.
- A disabled account record with no name or contact details, kept as long as the records below point to it, so they still show who did what without showing who you are.
- Your text-message consent records, ending with the opt-out recorded when you delete your account: 5 years, so we can show when you agreed to texts and when you stopped them if a claim is made under the Telephone Consumer Protection Act.
- Security and audit records (sign-ins, device changes and actions taken, with IP address and user agent): up to seven years, to investigate fraud and security incidents and to answer legal claims.
- The audit trails of documents you signed: while the organization that sent them is active, so each signature can still be verified.
Your organization's records stay with your organization. Messages, files, loads, hours-of-service logs, time and pay records and other records you created at work belong to the organization you worked for. We hold them for that organization; we don't decide whether they are deleted. When you delete your account, we send your request to each organization you belonged to, and each one decides what it can delete and what it must keep.
The law makes employers keep many of these records even after you leave. For example, a motor carrier must keep:
- hours-of-service (ELD) records and their supporting documents for 6 months (49 CFR 395.8(k));
- a driver's qualification file for as long as the driver works there and 3 years after (49 CFR 391.51);
- drug and alcohol testing records for up to 5 years, depending on the record (49 CFR 382.401); and
- payroll records for 3 years (29 CFR 516.5).
To ask an organization to delete records about you, contact it directly. We will help it answer.
5. When an organization closes
An organization closes when an owner closes it in the app, when its subscription ends, or when it asks us in writing. Then:
- The organization's apps turn off for every member.
- For 30 days, an owner can export the organization's content, ask support@annexorbis.com for a copy, or reopen the organization. Records the organization must keep by law are its to export in that time.
- After those 30 days, we delete the organization's data from our active systems, including stored files, email, messages, recordings and records, and we ask Plaid to revoke any remaining bank connections.
- Deleted data leaves our encrypted backups within 7 days after that.
- We keep only what the law requires us to keep, such as our own billing and tax records, and content under a legal hold or needed for an active legal claim, and only for as long as that obligation lasts.
- On request, we will confirm the deletion in writing.
6. Bank data from Plaid
- We never receive or store bank login credentials or full account and routing numbers.
- When a Customer disconnects a bank connection, we ask Plaid to revoke our access and stop importing new transactions.
- Transactions already imported are part of the Customer's accounting records and are kept while the organization is active, so its books stay complete. They are deleted when the organization closes, as described in section 5.
- Pending transactions that the bank later withdraws are deleted when Plaid reports them removed.
7. Legal holds
Customers with the right permissions can place a legal hold on email, files and other content. While a hold is in place, content it covers is not automatically deleted. We may also preserve information when the law or valid legal process requires it.
8. Requests and questions
To ask us to delete information, email privacy@annexorbis.com from the address on your account. We verify requests before acting and respond within the time the law requires. If the information is a Customer's content, we will refer the request to that Customer and help them respond.
ANNEX ORBIS Inc., Attn: Privacy, 30 N Gould St #68044, Sheridan, WY 82801.