Data Retention and Deletion Policy
Last Updated: September 20, 2026
This policy explains how long Murmur retains your personal data, what happens when you delete a memory, delete your account, or withdraw consent, and the minimum retention periods that the Digital Personal Data Protection Rules, 2025 ("DPDP Rules") require us to observe.
1. How Long We Retain Your Data
We retain your account information and memories while your account is active, until you delete a specific memory or your account, or until you withdraw your consent. Under the DPDP Act, we erase your personal data when you withdraw consent, or as soon as it is reasonable to assume the purpose for which we collected it is no longer being served, whichever is earlier, and we cause our service providers (Data Processors) to do the same. The only exceptions are where retention is necessary to comply with a law, including the retention periods in "Mandatory Retention Under the DPDP Rules" below.
2. Account Data
Your account information, including your name, email address, and authentication identifiers, is retained for as long as your account exists. This data is used to authenticate you and operate your account.
3. Memory Deletion
When you delete an individual memory within the app, we initiate deletion of:
- The associated audio recording from Cloudflare R2 storage
- The transcript, AI-generated title, and search embedding from our database
- Related metadata associated with that memory
The memory disappears from your app as soon as you delete it. Deletion from our live systems is processed as soon as reasonably possible; because our systems are distributed, complete removal may take a short time to propagate. Some data relating to the processing of that memory (such as logs) is retained for the period required by law, as described in "Mandatory Retention Under the DPDP Rules".
4. Account Deletion
If you delete your account, we will erase or anonymise your account information and associated memories, including audio recordings, transcripts, titles, and embeddings, within a reasonable period following your request, except for data we are required to retain (see "Mandatory Retention Under the DPDP Rules" and "Other Legal Retention Requirements").
To delete your account, use the account deletion option in the app, where available, or contact us using the details in the Contact Information section.
5. Withdrawal of Consent
If you withdraw your consent to the processing of your personal data, we will stop processing it, and ask our service providers to stop, within a reasonable time. Because our Service depends on that processing, we will then close your account and erase your data as described in this policy, subject to the mandatory retention described below. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.
6. Mandatory Retention Under the DPDP Rules
Rule 8(3) of the DPDP Rules requires every Data Fiduciary to retain, for any processing undertaken by it or on its behalf by a Data Processor, the personal data, associated traffic data, and other logs of that processing for a minimum of one year from the date of the processing, for the purposes specified in the Seventh Schedule to the Rules. Only after that period may the data be erased, unless another law requires further retention. Rule 6(1)(e) separately requires us to retain logs and personal data for one year so that unauthorised access can be detected and investigated.
This means that, even after you delete a memory or your account, or withdraw consent, we will:
- Retain the processing logs, associated traffic data, and related personal data that the DPDP Rules require us to keep, for at least one year from the date of the processing
- Where the law allows, limit what we keep to account identifiers, metadata, and logs of processing events, rather than the content of your recordings
- Keep retained data securely with restricted access, out of view in the app, and use it only for the purposes for which the law requires retention (including responding to Government requests under Rule 23), and not to provide the Service or for AI processing
- Erase it promptly once the required period has ended, unless another law requires longer retention
7. Backup Handling
Like most cloud-based services, we may maintain routine backups of our systems for disaster recovery and operational continuity purposes. Data deleted from our live production systems may persist in backups for a limited period before being fully purged as part of our standard backup rotation cycle. We do not use backup data for any purpose other than restoring service in the event of a system failure.
We maintain backups as one of our reasonable security safeguards, so that we can continue processing if data is lost, destroyed, or compromised. Backup retention is separate from, and does not extend, the retention periods described above.
8. Processing Deletion Timelines
As a general guideline:
- Deletion of an individual memory from active systems is typically completed within a short period after your request.
- Deletion of your full account and associated data from active systems is typically completed within a reasonable period after your confirmed request.
- Residual copies in backup systems are purged according to our routine backup rotation schedule, which is limited in duration and not indefinite.
- Data held under "Mandatory Retention Under the DPDP Rules" is erased after the required minimum period ends, not when you delete your data.
These timelines are general guidance and may vary depending on technical and operational circumstances.
9. Other Legal Retention Requirements
In some cases, we may be required by other laws, such as tax, accounting, or regulatory laws, to retain data for longer than the periods above, or to establish, exercise, or defend legal claims. Where this applies, we will limit retention to what is necessary for those specific purposes.
10. Your Rights
You may ask us to erase your memories or your entire account, correct your data, withdraw your consent, or give you a summary or export of your data, at any time. Erasure is subject to the mandatory and legal retention described above. See our Privacy Policy for your full rights, how to make a request, and how to raise a grievance or complain to the Data Protection Board of India.
11. Changes to This Policy
We may update this Data Retention and Deletion Policy from time to time. We will notify you of material changes through the app or other reasonable means.
12. Contact Information
To request deletion of your memories or account, or to ask about data retention, contact our Grievance Officer / Data Protection Contact. Every response we send to a rights request will include these details.
Grievance Officer / Data Protection Contact: [Insert name]
Email: subhrajyotisahoo08@gmail.com
Postal address: [Insert address]