Data Retention and Deletion Policy 

1. Purpose of this Policy

The purpose of this Policy is to clearly explain: 

1. What data Galla.app retains. 
2. Why data is retained. 
3. How long different categories of data are retained. 
4. When data is deleted. 
5. How account closure and deletion requests are handled. 
6. How backups are handled. 
7. How legal, tax, accounting, GST, audit, security, and dispute-related retention works. 
8. How customer data export works. 
9. How WhatsApp, POS, WMS, ecommerce, integration, support, and hardware data is retained. 
10. What the Customer must do before account closure or deletion. 

2. General Retention Principle

Treewalker Digital Private Limited retains data only for as long as reasonably required for: 

1. Providing Galla.app services. 
2. Operating subscribed modules. 
3. Supporting retail, POS, warehouse, inventory, WhatsApp, ecommerce, and integration workflows. 
4. Providing customer support. 
5. Maintaining business records. 
6. Meeting legal, tax, GST, accounting, audit, security, and compliance obligations. 
7. Preventing fraud, abuse, spam, security incidents, or unauthorised access. 
8. Resolving disputes. 
9. Enforcing agreements and policies. 
10. Maintaining backups and business continuity. 

When data is no longer required for these purposes, it may be deleted, anonymised, archived, or securely restricted. 

3. Recommended Default Retention Schedule

Unless a separate agreement, law, product setting, or enterprise contract states otherwise, Galla.app follows the recommended retention schedule below. 

4. Important Deletion Timelines

The following deletion timelines are recommended for Galla.app: 

5. Scope of this Policy

This Policy applies to data processed through or in connection with: 

1. Galla.app SaaS platform. 
2. Retail Management module. 
3. POS Billing module. 
4. Warehouse Management module. 
5. Inventory Management module. 
6. WhatsApp Marketing and Customer Communication module. 
7. Ecommerce Development and Managed Ecommerce Services. 
8. Third-party integrations. 
9. APIs and webhooks. 
10. Reports and dashboards. 
11. Customer support. 
12. Implementation and onboarding. 
13. Data migration. 
14. Hardware support. 
15. Billing and invoicing. 
16. Website forms and demo requests. 
17. Security and audit logs. 
18. Trial, pilot, and demo accounts. 

7. Active Account Retention

During an active paid subscription, Galla.app retains Customer Data required to provide the service. 

Active account data is generally retained for the full subscription period unless: 

1. Customer deletes specific data using available tools. 
2. Customer requests deletion. 
3. Data is no longer needed. 
4. Data violates our policies. 
5. Data is unlawful. 
6. Legal or security reason requires restriction or deletion. 
7. A separate agreement defines a different retention term. 

Customer should not use Galla.app as the only archive for legal, tax, statutory, or accounting records. Customer should export and maintain required business records separately. 

8. Inactive Account Retention 

An account may become inactive due to: 

1. Subscription expiry. 
2. Non-renewal. 
3. Non-payment. 
4. Customer request. 
5. Suspension. 
6. Termination. 
7. Trial expiry. 
8. Project closure. 

Recommended inactive account retention: 

After the retention period, Galla.app may delete, restrict, archive, or anonymise data. 

9. Data Export Before Deletion 

Before account deletion, Customer should export all required data. 

Exportable data may include, depending on plan and module: 

1. Product master. 
2. Customer list. 
3. Vendor list. 
4. Employee/user list. 
5. Sales records. 
6. Purchase records. 
7. POS invoices. 
8. Stock reports. 
9. Warehouse movement records. 
10. Inventory reports. 
11. Dispatch records. 
12. Ecommerce orders. 
13. WhatsApp campaign reports. 
14. Payment records. 
15. Integration reports. 
16. Custom reports, where available. 

Customer is responsible for exporting data before expiry of the retention window. 

Galla.app is not responsible for loss of data if Customer fails to export data before deletion. 

10. Deletion After Account Closure 

After account closure, cancellation, expiry, or termination: 

1. Customer account may be moved to inactive state. 
2. Customer access may be restricted. 
3. Data may be retained for 90 days for export, reactivation, billing, dispute, and support purposes. 
4. After 90 days, production data may be deleted or anonymised. 
5. Backup copies may remain for up to 90 additional days depending on backup cycle. 
6. Legal, tax, accounting, security, dispute, or abuse records may be retained longer. 

Recommended deletion timeline after account closure: 

11. Deletion Upon Customer Request

A Customer may request deletion of selected data or full account data by contacting Galla.app. 

Deletion requests should be sent to: 

Support Email: support@treewalkerlabs.com

The request should include: 

1. Customer name. 
2. Company name. 
3. Account ID or registered email. 
4. Data to be deleted. 
5. Reason for deletion. 
6. Authorised signatory confirmation. 
7. GST/legal/tax confirmation, where relevant. 
8. Contact person details. 

After verification and approval, Galla.app will use reasonable efforts to delete active production data within 30 days, unless retention is required for legal, tax, accounting, security, billing, contractual, fraud prevention, dispute, or compliance reasons. 

Backup copies may be deleted or overwritten within the normal backup cycle, generally within 90 days. 

12. Data Principal / Individual Deletion Requests 

Individuals may request deletion of their personal data. 

If the data belongs to a Galla.app business customer’s account, Galla.app may redirect the individual to the relevant Customer because the Customer controls the purpose and use of such data. 

Examples: 

1. Retail customer asking deletion from store records. 
2. Ecommerce buyer asking deletion from merchant records. 
3. WhatsApp recipient asking deletion from campaign list. 
4. Vendor contact asking deletion from vendor master. 
5. Employee asking deletion from employer’s warehouse/POS account. 
6. Galla.app may assist the Customer where technically feasible, but the Customer remains responsible for responding to such requests where the Customer controls the data. 

13. Deletion Exceptions

Galla.app may refuse, delay, restrict, or partially fulfil deletion requests where retention is required for: 

1. Legal compliance. 
2. GST records. 
3. Tax records. 
4. Accounting records. 
5. Company law records. 
6. Billing and invoice records. 
7. Audit requirements. 
8. Fraud prevention. 
9. Security investigation. 
10. Legal claims. 
11. Dispute resolution. 
12. Debt recovery. 
13. Contract enforcement. 
14. Law enforcement request. 
15. Regulatory request. 
16. Backup cycles. 
17. Technical limitations. 
18. Customer’s contractual obligations. 
19. Protection of rights, property, users, customers, or the public. 

Where full deletion is not possible, Galla.app may restrict access, archive data, anonymise personal fields, or retain only the minimum required records. 

14. Backup Retention and Deletion

Galla.app may maintain backups for service continuity, disaster recovery, and security. 

Recommended backup retention: 

Backup data is generally not edited or selectively deleted immediately after a deletion request. 

When production data is deleted, backup copies may remain temporarily and will be overwritten or purged in the normal backup cycle, generally within 90 days. 

If backup data is restored, Galla.app will take reasonable steps to re-apply deletion requests where technically feasible.

15. POS Billing Data Retention 

POS billing data may include: 

1. Invoices. 
2. Customer name. 
3. Customer phone number. 
4. Billing address. 
5. GSTIN, where applicable. 
6. Product details. 
7. Tax details. 
8. HSN/SAC codes. 
9. Payment mode. 
10. Return records. 
11. Credit notes. 
12. Debit notes. 
13. Cashier/user records. 
14. Store records. 
15. Billing counter records. 

Recommended retention: 

Customer is responsible for maintaining statutory records and verifying tax, GST, invoice, and accounting information. 

16. Retail Management Data Retention 

Retail data may include: 

1. Product master. 
2. Customer list. 
3. Vendor list. 
4. Sales data. 
5. Purchase data. 
6. Price data. 
7. Discount data. 
8. Loyalty data. 
9. Store user data. 
10. Reports. 

Recommended retention:

17. Warehouse Management Data Retention 

Warehouse data may include: 

1. Inward records. 
2. Outward records. 
3. Putaway records. 
4. Picking records. 
5. Packing records. 
6. Dispatch records. 
7. Stock transfer records. 
8. Cycle count records. 
9. Stock adjustment records. 
10. Location/bin records. 
11. Barcode/QR/RFID logs. 
12. Warehouse user activity. 
13. Device logs. 
14. Vendor and delivery contact data. 
15. ERP/ecommerce/logistics integration records. 

Recommended retention: 

Customer should export warehouse records needed for audit, reconciliation, statutory, or business continuity purposes. 

18. Inventory Management Data Retention 

Inventory data may include: 

1. Product data. 
2. SKU data. 
3. Batch data. 
4. Serial number data. 
5. Stock balance. 
6. Stock movement. 
7. Adjustment records. 
8. Transfer records. 
9. Purchase records. 
10. Sales records. 
11. Expiry data, where configured. 

Recommended retention: 

19. WhatsApp Marketing Data Retention

WhatsApp Marketing data may include: 

1. Recipient name. 
2. Recipient mobile number. 
3. Campaign name. 
4. Message template. 
5. Message content. 
6. Delivery status. 
7. Read status, where available. 
8. Failed status. 
9. Response data. 
10. Consent status, where configured. 
11. Opt-out status. 
12. Campaign analytics. 
13. Provider logs. 
14. WhatsApp Business Account metadata. 

Recommended retention: 

Opt-out records may be retained longer than marketing lists to prevent sending future messages to recipients who have opted out. 

20. Ecommerce Data Retention

Ecommerce data may include: 

1. Buyer name. 
2. Email address. 
3. Phone number. 
4. Billing address. 
5. Shipping address. 
6. Order details. 
7. Payment status. 
8. Return/refund records. 
9. Cart data. 
10. Product catalogue data. 
11. Shipping and delivery details. 
12. Marketplace data. 
13. Ecommerce analytics. 

Recommended retention: 

For customer-owned ecommerce websites, the Customer is responsible for its own privacy, cookie, retention, and deletion obligations. 

21. Third-Party Integration Data Retention 

Integration data may include: 

1. ERP sync logs. 
2. Accounting sync logs. 
3. Tally sync data. 
4. Payment gateway response. 
5. Marketplace sync data. 
6. Ecommerce sync data. 
7. Logistics sync data. 
8. WhatsApp provider response. 
9. API request and response logs. 
10. Error logs. 
11. Webhook payloads. 

Recommended retention: 

Third-party platforms may retain data under their own policies. Galla.app does not control third-party retention. 

22. API Logs Retention

API logs may include: 

1. API key ID. 
2. Endpoint. 
3. Timestamp. 
4. IP address. 
5. Request metadata. 
6. Response status. 
7. Error reason. 
8. Rate-limit event. 
9. Webhook delivery status. 

Recommended retention:

API payloads containing personal or business data should be retained only where necessary for troubleshooting, security, billing, or compliance. 

23. Support Ticket Retention

Support data may include: 

1. Ticket details. 
2. Email communication. 
3. Chat transcripts. 
4. Call notes. 
5. Screenshots. 
6. Attachments. 
7. Videos. 
8. Error logs. 
9. Remote support session details. 
10. Resolution notes. 

Recommended retention: 

Customers should avoid sharing unnecessary personal or sensitive data in support tickets. 

24. Hardware Data Retention

Hardware data may include: 

1. Hardware purchase records. 
2. Invoice records. 
3. Serial number. 
4. Device model. 
5. Warranty details. 
6. Delivery records. 
7. Installation records. 
8. Replacement request. 
9. Repair records. 
10. AMC records. 
11. Service partner reports. 
12. Photos/videos for defect verification. 

Recommended retention: 

Hardware records may be retained longer where required for warranty, legal, tax, accounting, service, or dispute reasons. 

25. Billing, Finance, GST, and Accounting Records 

Billing and accounting records may include: 

1. Invoices. 
2. Payment receipts. 
3. Credit notes. 
4. Debit notes. 
5. GST records. 
6. Subscription records. 
7. Payment gateway references. 
8. Bank transaction references. 
9. Purchase orders. 
10. Order forms. 
11. Contracts. 
12. Tax records. 
13. Refund records. 
14. Hardware invoices. 
15. Vendor invoices. 

Recommended retention: 

These records may not be deleted on customer request if legal retention applies. 

26. Security Logs and Audit Logs 

Security and audit logs may include: 

1. Login records. 
2. Failed login attempts. 
3. Password reset logs. 
4. Admin activity. 
5. User activity. 
6. API access logs. 
7. Data export logs. 
8. Permission change logs. 
9. Suspicious activity logs. 
10. Incident records. 
11. IP address and device metadata. 
12. Integration activity logs. 

Recommended retention: 

Security logs may be retained longer to investigate incidents, prevent fraud, enforce policies, or defend legal claims. 

27. Website and Marketing Lead Data 

Galla.app may collect website and marketing data through: 

1. Contact forms. 
2. Demo requests. 
3. Landing pages. 
4. Webinars. 
5. Campaigns. 
6. Email inquiries. 
7. Chat tools. 
8. Cookies and analytics. 
9. Download forms. 
10. Sales calls. 

Recommended retention: 

28. Trial, Demo, and Pilot Data

Trial, demo, and pilot accounts are not intended for long-term data storage. 

Recommended retention: 

Customers should not upload sensitive, statutory, or production data into demo/trial accounts unless expressly approved. 

29.Deleted Data and Soft Delete 

Some modules may support soft deletion. 

Soft deletion means data is removed from normal user view but may remain recoverable for a limited period. 

Recommended soft-delete period: 

After the soft-delete period, data may be permanently deleted, anonymised, or archived. 

Some records may not be deletable if they are linked to invoices, tax records, audit logs, security logs, or legal records. 

30. Anonymisation 

Where full deletion is not possible or not required, Galla.app may anonymise data. 

Anonymisation may include: 

1. Removing names. 
2. Removing phone numbers. 
3. Removing email addresses. 
4. Removing addresses. 
5. Removing identifiers. 
6. Aggregating data. 
7. Masking personal fields. 
8. Replacing values with random identifiers. 
9. Removing direct customer/user references. 

Anonymised data may be used for: 

1. Product improvement. 
2. Security improvement. 
3. Usage analytics. 
4. Performance benchmarking. 
5. Internal reporting. 
6. Service reliability. 
7. Statistical analysis. 

Anonymised data should not identify a specific individual. 

31. aggregated data

Galla.app may retain aggregated data that does not identify individual users or customers. 

Aggregated data may include: 

1. Total number of transactions. 
2. Feature usage trends. 
3. Average system performance. 
4. Error frequency. 
5. General product analytics. 
6. Industry-level benchmarks. 
7. Anonymous campaign statistics. 
8. General API usage patterns. 

Aggregated data may be retained indefinitely if it does not identify an individual or customer. 

32. Legal Hold

Galla.app may place data under legal hold where required for: 

1. Legal claims. 
2. Regulatory inquiry. 
3. Court order. 
4. Government request. 
5. Tax investigation. 
6. GST proceedings. 
7. Audit. 
8. Security incident. 
9. Fraud investigation. 
10. Customer dispute. 
11. Debt recovery. 
12. Policy violation. 
13. Law enforcement request. 

Data under legal hold will not be deleted until the hold is released. 

After the legal hold is released, data will be deleted, archived, or retained according to the normal retention schedule. 

33. Customer-Controlled Third-Party Platforms 

Customers may connect Galla.app with third-party platforms such as: 

1. ERP systems. 
2. Accounting software. 
3. Tally or similar tools. 
4. Ecommerce platforms. 
5. Marketplaces. 
6. Payment gateways. 
7. Logistics providers. 
8. WhatsApp/Meta. 
9. SMS providers. 
10. Email providers. 
11. Analytics tools. 
12. Custom APIs. 

These third parties may retain data under their own policies. 

Galla.app cannot delete data from customer-controlled third-party platforms unless technically supported and expressly agreed. 

Customers should review third-party retention and deletion policies separately. 

34. Subprocessor Retention 

Galla.app may use subprocessors for hosting, messaging, email, payment, analytics, security, support, storage, and other services. 

Subprocessors may retain data according to: 

1. Their service terms. 
2. Data processing agreements. 
3. Technical requirements. 
4. Backup cycles. 
5. Security and compliance needs. 
6. Legal obligations. 
7. Galla.app instructions. 

Where applicable, Galla.app will take reasonable steps to ensure that subprocessors delete or return Customer Personal Data after the relevant processing purpose ends, subject to legal and technical limitations. 

35. Data Deletion from Subprocessors

When Customer Data is deleted from Galla.app production systems, Galla.app will use reasonable efforts to ensure that relevant subprocessors delete or stop processing such data where required. 

Deletion from subprocessors may depend on: 

1. Subprocessor systems. 
2. Backup cycles. 
3. Legal retention obligations. 
4. Contractual obligations. 
5. Technical feasibility. 
6. Security needs. 
7. Billing and audit records. 
8. Third-party platform rules. 

Some subprocessors may retain limited logs or billing records for legal, security, or operational reasons. 

36. Customer Responsibilities

The Customer is responsible for: 

1. Exporting required data before cancellation or deletion. 
2. Maintaining its own statutory records. 
3. Keeping accounting, GST, tax, and audit records. 
4. Responding to data principal/customer deletion requests. 
5. Deleting data from customer-controlled third-party systems. 
6. Managing users and access permissions. 
7. Deleting inactive users. 
8. Avoiding unnecessary personal data upload. 
9. Keeping data accurate and updated. 
10. Removing unlawful contact lists. 
11. Maintaining consent and opt-out records. 
12. Protecting exported files. 
13. Not using Galla.app as the only legal archive. 
14. Reviewing retention needs before account closure.

37. Data Deletion Request Process

To request deletion, Customer should contact: 

Support Email: support@treewalkerlabs.com

The request should include: 

1. Company name. 
2. Registered account email. 
3. Authorised requester name. 
4. Designation. 
5. Data category to be deleted. 
6. Reason for deletion. 
7. Confirmation that required exports are completed. 
8. Confirmation that deletion is authorised by the Customer. 
9. Any legal, tax, or accounting instructions. 
10. Contact details for follow-up. 

Galla.app may verify the requester’s authority before processing deletion. 

38. Deletion Verification 

Before deleting Customer Data, Galla.app may verify: 

1. Customer identity. 
2. Authorised signatory approval. 
3. Account ownership. 
4. Subscription status. 
5. Payment status. 
6. Export completion. 
7. Legal retention requirement. 
8. Tax/accounting retention requirement. 
9. Pending disputes. 
10. Security or abuse investigation. 
11. Technical feasibility. 

Galla.app may refuse deletion requests from unauthorised users.

39. Deletion Confirmation 

After deletion is completed, Galla.app may provide confirmation where commercially and technically feasible. 

Deletion confirmation may state: 

1. Account name. 
2. Data category deleted. 
3. Date of deletion. 
4. Whether deletion applies to production systems. 
5. Backup deletion timeline. 
6. Exceptions, if any. 
7. Legal retention records retained, if any. 

Deletion confirmation does not mean all backup, legal, accounting, security, or third-party records were immediately deleted. 

40.  Data Restoration 

Data restoration may be possible only in limited cases. 

Restoration depends on: 

1. Backup availability. 
2. Retention period. 
3. Account status. 
4. Technical feasibility. 
5. Type of deleted data. 
6. Customer approval. 
7. Support plan. 
8. Payment status. 
9. Legal restrictions. 

Galla.app does not guarantee restoration of deleted data. 

Once production data and backup data are permanently deleted or overwritten, restoration may not be possible. 

41. Deletion Due to Policy Violation

Galla.app may delete, restrict, or disable access to data if it violates: 

1. Terms of Service. 
2. Acceptable Use Policy. 
3. WhatsApp Marketing Policy. 
4. Data Processing Addendum. 
5. Applicable law. 
6. Third-party platform rules. 
7. Security requirements. 
8. Abuse prevention rules. 
9. Examples include: 
10. Unlawful contact lists. 
11. Spam records. 
12. Fraudulent campaign data. 
13. Malware. 
14. Illegal content. 
15. Prohibited business data. 
16. Fake invoices. 
17. Unauthorised personal data. 
18. Harmful files. 
19. Data causing legal or security risk. 

42. Special Rule for WhatsApp Opt-Out Records

Opt-out records may be retained even after marketing contact deletion. 

Purpose of retaining opt-out records: 

1. To prevent future unwanted messages. 
2. To prove opt-out handling. 
3. To defend against complaints. 
4. To support compliance. 
5. To avoid re-importing unsubscribed contacts. 

Recommended retention: 

Active account period + 3 years, unless a longer period is required due to dispute, legal claim, or regulatory issue. 

Opt-out records should be used only for suppression and compliance, not for marketing. 

43. Special Rule for Billing and Invoice Records

Billing and invoice records cannot normally be deleted on customer request during the statutory retention period. 

These records may include: 

1. SaaS invoices. 
2. Hardware invoices. 
3. GST invoices. 
4. Credit notes. 
5. Debit notes. 
6. Payment records. 
7. Refund records. 
8. Purchase orders. 
9. Contracts. 
10. Tax records. 
11. Recommended retention: 

8 financial years, or longer where required due to legal, GST, tax, audit, investigation, or dispute requirements. 

44. Special Rule for Security Incident Records 

Security incident records may be retained longer than normal operational logs. 

Security incident records may include: 

1. Incident timeline. 
2. Affected systems. 
3. Logs. 
4. IP addresses. 
5. User activity. 
6. Investigation notes. 
7. Remediation actions. 
8. Customer notifications. 
9. Legal advice. 
10. Regulatory communication. 

Recommended retention: 

45. Retention Review 

Treewalker Digital Private Limited may review retention practices periodically. 

Retention review may include: 

1. Data category review. 
2. Legal requirement review. 
3. Product module review. 
4. Subprocessor review. 
5. Backup review. 
6. Security log review. 
7. Customer request review. 
8. Deletion process review. 
9. Audit readiness review. 
10. Policy update review. 

Recommended review frequency: 

At least once every 12 months, or earlier if there is a legal, product, security, or business change. 

46. Internal Data Disposal 

When data is deleted or disposed, Galla.app may use reasonable methods such as: 

1. Database deletion. 
2. File deletion. 
3. Record anonymisation. 
4. Secure overwrite, where feasible. 
5. Backup expiry. 
6. Token/key revocation. 
7. Access restriction. 
8. Log expiry. 
9. Vendor deletion request. 
10. Account deactivation. 

The method may depend on data type, system design, backup cycle, subprocessor capability, and legal obligations. 

47. Retention Schedule Summary 

The following summary can be used as a quick reference. 

48. Changes to this Policy

Treewalker Digital Private Limited may update this Policy from time to time to reflect: 

1. Product changes. 
2. Legal changes. 
3. GST/tax/accounting changes. 
4. Security requirements. 
5. Backup changes. 
6. Subprocessor changes. 
7. Customer requirements. 
8. Operational improvements. 
9. New Galla.app modules. 
10. Changes in deletion processes. 

When we update this Policy, we will revise the “Last Updated” date. If changes are material, we may notify Customers through email, dashboard notice, website notice, or other reasonable means. 

Continued use of Galla.app after the updated Policy becomes effective means the Customer accepts the updated Policy. 

49. Contact Information

For questions about data retention, deletion, export, or privacy requests, contact:

Treewalker Digital Private Limited
Product: Galla.app
Registered Office: Vikas Plaza.38/ 1A (4), Kanappana Agrahara, Hosur Rd, Phase II, Electronic City, Bengaluru, Karnataka 560100
Legal Email: legal@treewalkerlabs.com
Support Email: support@treewalkerlabs.com
Phone: +91-6366-740-274
CIN: U72900KA2021PTC153840
GSTIN: 29AAICT9733E1ZX 

50. Related Policies

This Data Retention and Deletion Policy should be read together with: 

1. Terms of Service. 
2. Privacy Policy. 
3. Cookie Policy. 
4. Data Processing Addendum. 
5. Subprocessor List. 
6. Acceptable Use Policy. 
7. WhatsApp Marketing Policy. 
8. Security Overview. 
9. SLA and Support Policy. 
10. Refund, Billing, Cancellation, and Hardware Replacement Policy. 
11. Responsible Disclosure Policy. 
12. Incident Response Policy.