Data Retention and Protection Policy

1. Data Minimization

HE365 collects only the data necessary to deliver its services. No unnecessary personal data, meeting recordings, or extraneous content is stored beyond what is required for authorized functionality.

2. Retention Periods

Data is retained only for the duration required to fulfill the purpose for which it was collected:

• Active session data — retained only for the duration of the user's session or event interaction
• Account-level data — retained while the user's account remains active on the HE365 platform
• Post-deauthorization — all associated data is purged within 30 calendar days following deauthorization or account termination

3. Data Protection Mechanisms

HE365 employs layered protection mechanisms to safeguard retained data:

• AES-256 encryption at rest
• TLS 1.3 encryption in transit
• Role-based access controls limiting data access to authorized personnel
• Regular audits and access reviews

4. Data Disposal

When data is no longer required or upon user deauthorization, HE365 applies secure disposal practices:

• Crypto-shredding — destruction of encryption keys rendering data unrecoverable
• Secure deletion — overwriting data in persistent storage to prevent recovery
• 30-day maximum purge window — all data is fully removed within 30 days of deauthorization

5. Compliance and Governance

Data retention and protection practices are governed by internal policies aligned with:

• SOC 2 Type II requirements
• ISO/IEC 27001 data management principles
• Zoom App Marketplace compliance requirements