Data handling
What we store, for how long — and what happens afterwards
This page explains in ordinary language what the privacy policy sets out in legal terms. It does not replace it.
The short answer
Most of your data never comes into being on our side.
Scanning and recovery with File Recovery Hero run entirely on your own computer. File names, thumbnails, hit lists and the recovered recordings themselves never leave your device. What we do store arises solely from purchase and activation — and for that a baseline rule of 365 days applies, with clearly named legal exceptions.
01 / Baseline
365 days from collection
Customer data is kept for 365 days from collection, and for contact enquiries from the moment the matter is closed. If purpose and legal basis fall away sooner, the data is deleted sooner — the 365 days are an upper limit, not a minimum.
That rule is deliberately short. A program that is bought and activated once does not need a growing customer file. What is still needed after the purchase is the ability to verify your licence — and that requires far less than most people expect.
02 / Overview
Every category with its period
| What | How long | What happens afterwards |
|---|---|---|
| Abandoned, unpaid order | 365 days from collection | Removed in full. Without payment there is neither a licence nor a record. |
| Email address and encrypted licence key after delivery | 365 days | Removed. Activation continues to work from the key hash. Keep your purchase email. |
| Licence identifier, key hash, status, start and expiry, device hash | For the ten-year term | After expiry the device activations are removed; the minimal records are then checked against statutory periods. |
| Accounting records | As a rule eight years from year end | Separate records archive. Not touched by the clean-up script. |
| Business letters · books and annual accounts | As a rule six · ten years from year end | By type of document, not as a blanket period for all data. |
| Other contact enquiries | 365 days after closure | Sooner if the purpose falls away sooner. Legally relevant correspondence is archived separately. |
| Specific legal or tax matter | Until the reason ends | Only the necessary documents. An open dispute is never cleaned up automatically. |
03 / Exceptions
Why some things stay longer
Two things outlive the 365 days, and both have a comprehensible reason. The first is the minimal licence data: your licence runs for ten years from confirmed payment for the major version you bought. For as long as it is valid, the activation server has to be able to verify it — otherwise a device change in year eight would simply fail.
The second is statutory retention duties. Accounting records, business letters and annual accounts may not be deleted just because a year has passed. Those periods are set by law, not by us; in an individual case they can be longer than the standard figures in the table.
A statutory retention duty covers exactly the documents it applies to — it is not a reason to keep the entire data set. When an exception ends, that is documented and the regular period applies again.
04 / Procedure
How a deletion actually runs
Here is the honest version: there is no background service quietly removing data overnight. Deletion is triggered and reviewed by the operator. That is a deliberate choice, because an automatic run that nobody looks at will, in case of doubt, also delete what is currently needed for an open withdrawal or a tax audit.
Even so, this is not improvisation. The procedure is fixed in a script that first only counts, in a dry run, how many records would be due. Only once those figures have been checked and confirmed does the same procedure carry out the deletion — after writing an encrypted backup of the affected tables.
- 1
Dry run: the procedure counts the due records per category and changes nothing.
- 2
Review: open withdrawals, holds and disputes are held against those figures.
- 3
Backup: before any change, an encrypted copy of the affected tables is stored.
- 4
Deletion: the three narrowly defined database actions run in one transaction; differing figures stop the run.
- 5
Separately: mailbox, records archive and withdrawal receipts are checked on their own, because they do not live in the database.
05 / Never collected
What never reaches us during a scan
The most effective data protection is the kind where no data comes into being. The application examines your storage device locally. During the scan it loads nothing from the network and transmits nothing to us.
- No file names, no hit lists and no thumbnails.
- No recovered recordings — the export goes to a device of your choosing, not to us.
- No images or sector contents of your medium.
- No usage statistics about what you scanned or found.
- The only connection to our server is licence activation. Neither file names nor scan results are transmitted in the process.
06 / Your rights
Access, correction, deletion
You can ask at any time which data is stored about you and request its correction or deletion. A message to info@file-recovery-hero.com is enough; there is no customer account, and none is needed for this.
One limitation belongs here: as long as a statutory retention duty or an open legal matter exists, we cannot delete the affected documents. In that case we say which ones and for how long. The full account of your rights, including legal bases, is in the privacy policy.
Common questions
Are my recovered files transmitted to you?
No. Scanning, verification and export run on your computer. The recovered files end up on the target device you choose. We see neither the files nor their names.
I lost the purchase email — do you still have my key?
Only to a limited extent. The address and the encrypted key are removed 365 days after delivery; after that activation works from the key hash, from which the key cannot be reconstructed. So keep your purchase email.
Do you actually delete, or does it just say so on the page?
Deletion is a fixed procedure with a dry run, a review and a backup, triggered by the operator — not an unattended background service. We expressly do not claim a daily automatism here.
Why do you keep licence data for ten years?
Because the licence runs for ten years from confirmed payment for the major version you bought. Without the minimal verification data, an activation in later years could no longer be confirmed. It is identifier, key hash, status, term and device hash — no content.
What about the payment provider?
Stripe and Link operate their own retention under their own responsibility. We can neither shorten nor extend those periods; details are in the privacy policy.