Lunio applies different retention periods depending on the type of data processed, supporting both short-term operational monitoring and long-term fraud pattern analysis.
Retention Periods
Data Type | Retention Period |
Log-level data (e.g. raw request logs) | Up to 30 days |
Processed click data used for fraud detection and reporting | Up to two years |
Long-Term Pattern Analysis
Fraudulent activity, especially through bots, often involves sophisticated techniques that unfold over long periods. Attackers frequently change IP addresses or launch sporadic attacks, which means a longer retention period for processed click data is necessary to detect these threats effectively. Shorter periods would leave gaps in identifying fraud and reduce the effectiveness of detection systems.
Data Minimisation and Proportionality
Under GDPR, the principle of data minimisation requires personal data to be limited to what is necessary for specific purposes. Retaining processed click data for up to two years strikes a balance between providing enough time to analyse fraud patterns, including year-on-year seasonality comparisons, without holding onto data unnecessarily. It is worth noting that the primary data point in scope is the IP address, which is not combined with other data in a way that would elevate its sensitivity.
Account Termination and Data Deletion
In line with data minimisation principles, data associated with a customer account is automatically deleted 12 months after account termination, unless otherwise required for legal or regulatory purposes.
If you have specific requirements around data deletion timelines, please contact your account manager or reach out to [email protected] before terminating your account.
If you run into any issues, please reach out to your account manager or email [email protected] and we will be happy to help.