Privacy Policy - Hiram Trade

Version: 2026-11-09. Effective date: 2026-11-09.

Changes compared with version 2026-11-08: added the check of the public Legal Entity Identifier (LEI) register kept by the Global Legal Entity Identifier Foundation (GLEIF) as one supporting input to verification of companies that have a legal form (section 2 point 4, section 3 - new table row, section 5 point 11, section 6 point 5, section 7 point 6, section 8 point 6 and the section "Data from the LEI register (GLEIF)"). The check is advisory and involves no automated decision; we send the query directly to GLEIF and display the result in a service running on the Cloudflare network (see section 6). We also clarified the information on transfers of data from the REGON register (section "Data from the REGON register (GUS)"). Version 2026-11-08 applied up to and including 2026-11-08.

Changes compared with version 2026-11-01: added the check of the public REGON register kept by Statistics Poland (GUS) as one supporting input to company verification for Polish companies (section 2 point 4, section 3 - new table row, section 5 point 10, section 6 point 4, section 7 point 5, section 8 point 5 and the section "Data from the REGON register (GUS)"). The check is advisory, involves no automated decision, and the query to GUS itself involves no transfer outside the EEA (we display the result in a service running on the Cloudflare network, see section 6); for sole proprietors it also serves as our information notice under Art. 14 GDPR. Version 2026-11-01 applied up to and including 2026-11-07.

Added PostHog (product analytics) and Google Analytics 4 (audience and traffic analytics) as analytics tools that load only after consent to the "Analytics" category: PostHog across the signed-in application and public pages, Google Analytics 4 on public pages only. Neither collects names, e-mail addresses or account identifiers. See section 3 (table), sections 5, 6 and 10, and the section "Product and traffic analytics (PostHog and Google Analytics 4)" below.

Changes compared with version 2026-10-09: added product samples - the sample delivery address and, optionally, the recipient ("attention of") (section 3 - new table row). Version 2026-10-09 applied up to and including 2026-10-11.

Correction of 2026-10-31 (no new version; no re-acceptance required): removed the statement that we use no advertising tools and disclosed the Meta pixel, loaded only with consent to the "Marketing" category (sections 5, 6 and the section "Advertising measurement (Meta pixel)"); Meta Platforms Ireland Limited named as an independent controller and recipient. The Marketing consent is collected separately through the cookie banner (Cookie Policy version 2026-10-31). Whether this disclosure should bump the policy version and ask for renewed acknowledgement is pending review.

Changes compared with version 2026-10-07: (1) the Microsoft Clarity tool also covers the pages of the listing wizard without an account on app.hiramtrade.com (/start/offer, /start/request) (section 3 - analytics row, section 10 point 2); (2) added machine translation of listing and message text on request (section 3 - new table row and paragraph after the table, section 5 points 2 and 3, section 6 point 3, section 7 point 4). Version 2026-10-07 applied up to and including 2026-10-08. The provisions on machine translation apply from the moment the translation feature is switched on; until then the feature remains switched off and no text is sent to the translator.

Changes compared with version 2026-10-06: added the Microsoft Clarity tool (section 3 - new table row and the amended sentence after the table, section 5 point 2, section 6 point 2 and section 10 point 2). Version 2026-10-06 applied up to and including 2026-10-06.

Changes compared with version 2026-10-03: public Listing Pages, the Partner code in links and view counting (section 3, new table rows and the subsection "Public Listings and natural persons running a business"), recipients of data (section 5 points 1, 7 and 8) and cookies (section 10 point 6). Version 2026-10-03 applied up to and including 2026-10-05.

This English version is a translation. The Polish version is legally binding.

This policy is the information referred to in Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (the "GDPR") for the persons whose data we process in connection with the Hiram Trade platform: users, representatives and employees of companies, persons submitting access requests and visitors to the website. Terms defined in the Terms of Service have the same meaning in this policy.

1. Controller

1. The controller of personal data is JIII-LEGACY spółka z ograniczoną odpowiedzialnością, with its registered office at: ul. Jaworowa 19, Kuźniki, 63-500 Ostrzeszów, Polska, KRS 0001251213, NIP 5140369127, REGON 545127744 (the "Operator" or "we").
2. Contact on personal data matters: privacy@hiramtrade.com, or in writing to the registered office address marked "Personal data".
3. The Operator has not appointed a data protection officer, as it is not required to do so under Art. 37 GDPR. Personal data matters are handled by the Operator at the address given in point 2. If an officer is appointed, their contact details will be given here.
4. The Operator is an independent controller of the data processed on the Platform. The document "Data Controller Statement" (slug: dpa) explains why the Operator does not act as a processor on behalf of Companies.

2. Whose data we process and where we obtain it

1. From you: data provided at registration, in the profile, in Listings, messages, RFQs, Quotes, Deals, notices and complaints.
2. From your company or other Users (Art. 14 GDPR): a Company Administrator may provide your e-mail address in an invitation to a Company Account; the other party to a Deal may designate you as a contact person or include your data in Deal documents.
3. From identity providers: if you sign in with Google or Microsoft, we receive the account identifier at the provider (subject), the e-mail address, information whether it is verified, your name (if shared) and the Microsoft Entra ID tenant identifier. We do not receive your password or access to your mailbox; access tokens are discarded.
4. From public registers: as part of company verification we may obtain data from the National Court Register (KRS), CEIDG, the register of VAT taxpayers, VIES, GLEIF, the Central Register of Beneficial Owners (Centralny Rejestr Beneficjentów Rzeczywistych), foreign registers and sanctions lists, including data on members of governing bodies and beneficial owners. For Polish companies this includes the public REGON register kept by Statistics Poland (GUS), queried using the REGON, NIP or KRS number you gave us (see the section "Data from the REGON register (GUS)"). For companies that have a legal form this also includes the public LEI register kept by GLEIF, queried using the entity name (and country) or the LEI (see the section "Data from the LEI register (GLEIF)").
5. Automatically: IP address, browser and device data, timestamps, security event logs.

3. Purposes, legal bases and retention periods

We measure advertising only with your consent to the "Marketing" category, using the Meta pixel (see the section "Advertising measurement (Meta pixel)" below). We start third-party analytics tools (Cloudflare Web Analytics, Microsoft Clarity, PostHog and Google Analytics 4) only with your consent (section 10). If any of this changes, we will update the policy and, where required, ask for consent.

Machine translation. Text is sent to the translator only when a User clicks "Translate" next to a given text; nothing is translated in advance. The translation is displayed below the original text with the label "Machine translation", and the original text remains binding (Terms § 16). We do not use Users' texts to train models, and according to Microsoft's documentation Azure AI Translator does not use submitted text to train models. Daily character limits per Company and per User cap the volume of translations; once they are used up, translation is unavailable until the next day (UTC), and access to the original text does not change. Postal addresses and personal names that are not recognised as contact data but that the author typed into free text are sent to the translator together with the rest of the text.

Public Listings and natural persons running a business

1. Listings are public: every live public Listing is shown on a Listing Page that can be opened without signing in and that search engines may index, and services on which someone shares the link may fetch a preview of it (Terms § 8a). The Company cannot switch this presentation off or hide the price; it may pause or close the Listing at any time.
2. A Listing and the anonymous profile contain no first name and surname, no Company name and no contact details. If you are a sole trader, however, the content of a Listing (type of business, country, product, quantity, price, photo) combined with other information may in some cases make it possible to identify you. To that extent the Listing is your personal data, and the Operator is its controller (section 1).
3. The legal basis for the public presentation of a Listing is the contract for the provision of the Services (Art. 6(1)(b) GDPR): publication of a Listing on the public market is a Service that you order by publishing the Listing.
4. You may correct the content of a Listing at any time (rectification), and pause or close the Listing, which ends its public presentation within the time stated in the table above. A closed Listing is kept as part of the commercial history; a request for erasure (Art. 17 GDPR) is considered taking into account section 8 point 2. Your other rights are described in section 8.
5. Copies and previews of a Listing Page kept by search engines, social networks, messaging services and web archives are processed by those parties as separate controllers, under their own rules and outside the Operator's control. You may ask them directly to remove such copies.

4. Whether you must provide data

Providing an e-mail address and Company data is a condition for creating an Account and using the Platform. Providing data for DAC7 purposes is a statutory obligation of the seller; failure to provide it may result in the restriction of seller functions (Terms § 27). You provide other data voluntarily.

5. Recipients of data

1. Other Companies on the Platform - within the staged disclosure of data (Terms § 10). Before a Connection, other Companies do not see your first name and surname, the Company name or contact details; this also applies to public Listings, subject to the information on sole traders in section 3. Data of contact persons is disclosed to the other party only in a Deal with the status AGREED.
2. Processors acting on our behalf - providers of hosting, database, cache and e-mail services, machine translation on request (Microsoft - Azure AI Translator) and - with your consent - analytics (Cloudflare Web Analytics, Microsoft Clarity, PostHog and Google Analytics 4) listed in the document "List of Subprocessors", under agreements concluded in accordance with Art. 28 GDPR.
3. Microsoft Ireland Operations Limited (Azure AI Translator) - as a processor for machine translation on request (point 2); the text is sent after contact data is masked (section 3).
4. Identity providers (Google, Microsoft) - if you choose to sign in through them; they act as separate controllers under their own privacy policies.
   • Meta Platforms Ireland Limited (Meta pixel) - only with your consent to the "Marketing" category, as an independent controller, for advertising measurement on Facebook and Instagram (section 10 and the section "Advertising measurement (Meta pixel)"). The data transferred is described there; a transfer outside the EEA is covered by section 6.
5. Public authorities - only on the basis of legal provisions, including the Head of the National Revenue Administration (Szef Krajowej Administracji Skarbowej) (DAC7), law enforcement authorities (Art. 18 DSA) and courts.
6. The Operator's advisers (legal, accounting, auditors) - bound by professional secrecy or a confidentiality agreement.
7. An acquirer of the business - in the event of a transfer of the Platform, with prior notice.
8. Anyone visiting the Platform, search engines and services that fetch link previews - for Listings presented publicly (Terms § 8a). Search engines and external services act as separate controllers and may keep copies of a Listing after it is withdrawn.
9. A Partner - if your Company has been attributed to a Partner, the Partner sees it in the list of attributed Companies together with its stage (registered, verified, active, first Deal), without prices, counterparties, messages or Deal terms (Trade Partner Programme Terms).
10. Statistics Poland (GUS), REGON register - receives only the identifier (REGON, NIP or KRS) of a Polish company in a query to the public register; GUS is the source of the data, not our processor (section "Data from the REGON register (GUS)").
11. Global Legal Entity Identifier Foundation (GLEIF), LEI register - receives only the entity name (and country) or the LEI of a company that has a legal form in a query to the public register; GLEIF is the source of the data, not our processor (section "Data from the LEI register (GLEIF)").

6. Transfers of data outside the European Economic Area

1. The database, the cache and the e-mail server are located in the EU (database and cache - Frankfurt am Main, e-mail - Ireland).
2. Some providers are established in the United States (Cloudflare, Supabase, Upstash, Resend, PostHog, Inc. and, for the Microsoft Clarity tool, Microsoft Corporation; the processor is Microsoft Ireland Operations Limited), and the Cloudflare network processes traffic in the data centres closest to the user, including outside the EEA, and data from the Microsoft Clarity tool may be processed in the USA. With your consent to the "Marketing" category, data from the Meta pixel is received by Meta Platforms Ireland Limited as an independent controller and may be processed in the USA by Meta Platforms, Inc. Transfers take place on the basis of the European Commission decision of 10 July 2023 on the adequate level of protection under the EU-US Data Privacy Framework - for certified providers - or of the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, together with supplementary safeguards (encryption in transit and at rest). With your consent to the "Analytics" category, PostHog Cloud EU stores data in Frankfurt and, according to PostHog, data does not leave EU jurisdiction (PostHog, Inc. is established in the United States; our DPA with PostHog covers any access from outside the EEA), and Google Analytics 4 data is received by Google Ireland Limited and may be processed by Google LLC in the United States, where Google LLC is certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and, where applicable, standard contractual clauses. Details for each provider are given in the "List of Subprocessors".
3. Machine translation is performed by Microsoft Ireland Operations Limited in the Azure AI Translator service in the Germany West Central region (Germany), through the Europe geography endpoint; according to Microsoft's documentation, processing takes place in the European Union (EU Data Boundary). Any remote access by Microsoft personnel from outside the EEA is subject to the mechanisms described in point 2 (EU-US Data Privacy Framework and standard contractual clauses).
4. We send the query to the REGON register (GUS) directly to GUS, a Polish public body, and the query itself involves no transfer of data outside the EEA. The result is displayed in our service, which runs on the Cloudflare network, so its processing is subject to the rules described in point 2.
5. We send the query to the LEI register directly to GLEIF, a foundation based in Switzerland, for which the European Commission has issued an adequacy decision. The result is displayed in our service, which runs on the Cloudflare network, so its processing is subject to the rules described in point 2.
6. A copy of the safeguards or information about them can be obtained by contacting us.

7. Automated processing and profiling

1. The Match score is calculated automatically from Listing parameters (product, quantity, geography, dates, Incoterms, price, verification). It concerns companies' offers and demand, not an assessment of individuals. It produces no legal effects concerning you and does not similarly significantly affect you - every decision to make contact and conclude a Deal is taken by people. It is therefore not a decision referred to in Art. 22 GDPR.
2. Contact data masking and the Request quality check operate automatically, but only mask fragments of content or hold publication for review. Decisions to remove content or to suspend or close an account are taken by a human.
3. Trust indicators (number of completed Deals, on-time performance, repeat customer rate) concern Companies and are calculated exclusively from Deals on the Platform.
4. Machine translation is performed automatically by an external translation system (Azure AI Translator), only on the User's request, and serves as a reading aid: it produces no legal effects for anyone, sends nothing and creates no commitments, and commercial decisions are taken by people on the basis of the original text. Other artificial intelligence features are not currently used; we will update this policy before they are launched.
5. The check of the REGON register (GUS) is an advisory input only: its result never changes, grants or lowers a verification level and creates no badge by itself, and no decision is taken on it by automated means. It is therefore not a decision referred to in Art. 22 GDPR.
6. The check of the LEI register (GLEIF) is an advisory input only: its result never changes, grants or lowers a verification level and creates no badge by itself, and no decision is taken on it by automated means. It is therefore not a decision referred to in Art. 22 GDPR.

8. Your rights

1. You have the right to: access your data and obtain a copy (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), portability of data processed by automated means on the basis of a contract (Art. 20), and to object to processing based on legitimate interest (Art. 21).
2. The right to erasure does not cover data that we must retain under legal provisions or that is necessary for the establishment, exercise or defence of legal claims (Art. 17(3)(b) and (e) GDPR). Commercial history is immutable; after an Account is deleted, your data in the commercial history may be replaced with a pseudonymous designation, unless it is needed as evidence.
3. Please send requests to privacy@hiramtrade.com. We respond without undue delay and in any event within one month; in complex matters this period may be extended by two months, of which we will inform you. We may ask you to confirm your identity.
4. You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or with the supervisory authority in the Member State of your habitual residence, place of work or place of the alleged infringement.
5. If you run a sole proprietorship, you may object at any time to the processing of data from the REGON register (Art. 21 GDPR) at privacy@hiramtrade.com. If we accept your objection, we make no further queries to the register for your company and assess whether the earlier check record must be erased; the company remains at its existing verification level and is handled by manual review.
6. If you run a sole proprietorship or the LEI register contains data about you, you may object at any time to the processing of data from the LEI register (Art. 21 GDPR) at privacy@hiramtrade.com. If we accept your objection, we make no further queries to the register for your company and assess whether the earlier check record must be erased; the company remains at its existing verification level and is handled by manual review.

9. Security

We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR), including: encryption of connections (HTTPS, TLS with certificate verification to the database), storage of passwords only as argon2id hashes, storage of only hashes of session tokens, invitations and links, session protection (httpOnly, Secure, SameSite cookies), CSRF protection, rate limiting and account lockout after failed sign-ins, isolation of data between Companies enforced server-side, the principle of least privilege in the database, an immutable audit event log, and no recording of passwords, tokens or the content of private messages in technical logs. No system is fully immune to breaches; we will notify breaches resulting in a high risk in accordance with Art. 34 GDPR.

10. Cookies and similar technologies

1. The Platform uses cookies and similar technologies (browser storage: localStorage and sessionStorage). Necessary ones - for sign-in, security, remembering the selected language, the forms you submit and storing your cookie choice - are used without consent (Art. 399(2) of the Electronic Communications Law).
2. With your consent (Art. 399(1) of the Electronic Communications Law; Art. 6(1)(a) GDPR) we use the "Analytics" category: (a) Cloudflare Web Analytics - measurement of page views, referring site and device type without cookies and without profiling, provider Cloudflare, Inc. as processor; (b) Microsoft Clarity - recordings of the visit (pointer movement, scrolling, clicks, pages visited) and heatmaps on the public pages of hiramtrade.com and on the pages of the listing wizard without an account on app.hiramtrade.com (/start/offer, /start/request), using Clarity cookies (_clck, _clsk, CLID, ANONCHK, MR, MUID, SM); strict masking hides the content of form fields and the text of pages, and the signed-in application and the sign-up, sign-in and onboarding pages are not recorded, and recording stops when you leave the wizard to sign up or sign in; provider: Microsoft Ireland Operations Limited as processor; (c) remembering in your browser the campaign source of your first visit (utm parameters, landing page, referring host) which, if you create an account, we store with the account to assess which channels bring users; (d) PostHog - product analytics across the signed-in application and public pages, with no cookies (data is kept in the browser's localStorage), loaded through our first-party /_ph proxy so that your IP is not sent to PostHog, with autocapture and session recording off; provider PostHog, Inc. as processor; (e) Google Analytics 4 - audience and traffic analytics on the public pages, using the cookies _ga and _ga_<container-id>, with no IP address logged or stored for users in the EU, the UK and Switzerland; provider Google Ireland Limited as processor. The basis is consent.
3. You give or refuse consent on your first visit and can change or withdraw it at any time through "Cookie settings" in the Platform footer or the user menu. Withdrawal does not affect the lawfulness of processing before it. Refusing does not limit your use of the Platform.
4. To be able to demonstrate consent (Art. 7(1) GDPR) we record for each choice: the date, the version of the notice, the choice, the language and page address, the browser family (not the full User-Agent), a keyed cryptographic hash of the IP address (not the address itself) and, if you are signed in, the account identifier. We keep this for 5 years from the choice (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR and the controller's legitimate interest in defending claims). When the account is deleted the link to the account is removed.
5. Details and the list of cookies are in the "Cookie Policy".
6. The Partner code in a referral link or in a link to a Listing Page is passed only in the page address and in the registration form; we do not store it in cookies or in browser storage. Counting views of Listing Pages (section 3) uses neither cookies nor browser storage and does not require consent to the "Analytics" category.

11. Changes to this policy

We will inform you of material changes by e-mail or on the Platform. A change takes effect upon publication of the new version; the current version, with its version date, is always available on the Platform. Where the Privacy Policy is a required document, a signed-in User is notified of the new version at sign-in.

Data from the REGON register (GUS)

For Polish companies we may query the public REGON register kept by Statistics Poland (GUS) using the REGON, NIP or KRS number you gave us. We do this to check that the entity exists and is active, as one supporting input to company verification and to prevent fraud and impersonation. The result is advisory: it never changes a verification level by itself and no automated decision is taken on it.

Data. Company name, address, legal form, PKD activity codes, status and related dates. If you run a sole proprietorship, this is information about you; we do not collect your PESEL number.

Legal basis. Our legitimate interest in trusted B2B trade and fraud prevention (Art. 6(1)(f) GDPR). You may object at any time (Art. 21 GDPR) at privacy@hiramtrade.com.

Storage and access. We keep a record of each check (source, identifier queried, time, a cryptographic hash of the response and a short summary), not the raw register response, for 5 years after the end of the relationship with your company, as other verification records. The summary is visible to your company and to our reviewers; other companies see only your verification level.

Source. Because this data comes from a public register and not from you, this is also our notice under Art. 14 GDPR. You can ask for access, rectification, erasure or restriction at privacy@hiramtrade.com and lodge a complaint with the President of the Personal Data Protection Office (UODO). We send the query directly to GUS, a Polish public body; the result is displayed in a service running on the Cloudflare network, see section 6 points 2 and 4.

Data from the LEI register (GLEIF)

For companies that have a legal form we may query the public Legal Entity Identifier (LEI) register kept by the Global Legal Entity Identifier Foundation (GLEIF). The query contains only the entity name (and country) or the LEI; we never query the register for natural persons or for sole traders searched by name. We do this to check that the legal entity exists and what its status is, as one supporting input to company verification and to prevent fraud and impersonation. The result is advisory: it never changes a verification level by itself, creates no badge, and no automated decision is taken on it.

Data. LEI number, entity name, country and registered address, legal form, status and related dates.

Legal basis. Our legitimate interest in trusted B2B trade and fraud prevention (Art. 6(1)(f) GDPR). You may object at any time (Art. 21 GDPR) at privacy@hiramtrade.com.

Storage and access. We keep a record of each check (source, identifier queried, time, a cryptographic hash of the response and a short summary), not the raw register response, for 5 years after the end of the relationship with your company, as other verification records. The summary is visible to your company and to our reviewers; other companies see only your verification level.

Source and transfers. Because this data comes from a public register and not from you, this is also our notice under Art. 14 GDPR. You can ask for access, rectification, erasure or restriction at privacy@hiramtrade.com and lodge a complaint with the President of the Personal Data Protection Office (UODO). We send the query directly to GLEIF (a foundation based in Switzerland; European Commission adequacy decision for Switzerland), and the result is displayed in a service running on the Cloudflare network, see section 6 points 2 and 5.

Advertising measurement (Meta pixel)

If you accept the Marketing category in our cookie banner, public pages load the Meta pixel provided by Meta Platforms Ireland Limited. It tells Meta which of our public pages you viewed (the events PageView and ViewContent), so we can measure how well our advertising on Facebook and Instagram works. We do not send your name, e-mail address, telephone number or company information, and nothing about counterparties, listings, quotes or deals; advanced matching is off. Marketing is off unless you turn it on, and you can withdraw at any time under Cookie settings, after which the pixel and its cookies (_fbp, _fbc) are removed. Meta acts as an independent controller for the data it receives; see Meta's data policy.

Product and traffic analytics (PostHog and Google Analytics 4)

If you accept the "Analytics" category in our cookie banner, two analytics tools load: PostHog (product analytics), across the signed-in application and public pages, and Google Analytics 4 (audience and traffic analytics), on public pages only. Nothing is started, stored or sent before you consent. Withdrawing consent under "Cookie settings" stops both tools. PostHog stops capturing, its identifier is reset, and only a technical opt-out marker remains in local storage. The Google Analytics cookies (_ga, _ga_<container-id>) are removed.

PostHog is served through our own first-party path (/_ph) that forwards to PostHog Cloud EU (Frankfurt); because of this your IP address is not sent to PostHog, geo-IP is disabled and project-level IP anonymisation is on, autocapture, session recording and page-view capture are off, URL, path and referrer are stripped, and PostHog stores data in your browser's localStorage rather than in cookies. Today PostHog sets only a pseudonymous, random identifier; it does not capture page views and does not set a user identifier. The core-loop product events and identifying you by an internal id are implemented but not yet enabled, and will require a privacy-policy update before they are. According to PostHog, data in PostHog Cloud EU does not leave EU jurisdiction. With Enhanced Measurement on, Google Analytics 4 automatically collects on public pages: page views, scrolls (at 90% depth), outbound link clicks, video engagement and file downloads. It also collects location to city level and detailed device, browser and operating-system data. According to Google it does not log or store the IP address of users in the EU, the UK and Switzerland. Google Signals and data sharing with Google are off, no user identifier is set, and data are retained for 14 months (extended on new activity). The gtag.js script is loaded from googletagmanager.com.

Google Analytics 4 data is received by Google Ireland Limited and may be processed by Google LLC in the United States under the EU-US Data Privacy Framework and standard contractual clauses (section 6).

We send no names, e-mail addresses, telephone numbers or company information to either tool, and nothing about counterparties, listings, quotes, deals or prices; no user identifier is set, Google Signals and advertising features are off. Data retention: Google Analytics 4 - user-level and event-level data are retained for 14 months, extended on new activity; aggregated reports are not subject to this limit; PostHog Cloud EU keeps events up to 1 year on the free plan (7 years on paid plans); the person profile is a pseudonymous random identifier, deleted on request via PostHog's deletion tools.