# How long data is kept

> The retention period for guest data and closed parcels in each Attendance and Parcels space (6 to 60 months, 12 by default), the 7-day rule for shortening it, the activity log after 2 years and what this rule does not cover, the 6-month access record (Brazil's Marco Civil da Internet) and the legal periods for payments, payee verification, time tracking and contact.

Some data about people who are not members, such as a guest's name or a parcel's sender, does not need to be kept forever. Each space sets how long it stays; after that, Memberfy **anonymizes** it: it erases the personal data and keeps the record, so counts and reports stay right.

## What it is for

So the community keeps only what it needs, for as long as it needs it, as the LGPD (and the GDPR) require: third-party personal data that is no longer used goes away on its own, without the team having to remember to delete it.

## How it works

### Each space's period

[Attendance](/espacos/presenca) and [Parcels](/espacos/encomendas) spaces have a **retention period**, in months:

| | |
|---|---|
| Default | **12 months** |
| Minimum | **6 months** |
| Maximum | **60 months** (5 years) |

Each space has its own period. A space that never changed it uses the 12 months.

**Where it is.** In **Configure space** (the **Manage attendance** or **Manage parcels** bar), the **Retention period (months)** field. In Attendance: *"After this period, the name, company and phone of guests and pre-registrations are erased. 6 to 60 months; the default is 12."* In Parcels: *"After this period, closed parcels lose their photos, sender, tracking code, notes and the name of whoever picked them up."* The field is for the owner and the admin only and does not appear when creating the space: a new space starts at 12 months.

**Shortening the period only applies after 7 days.** If you lower a space's period, the new period starts counting 7 days after the change. Until then, the previous period applies, and you can go back without losing anything. Lengthening applies right away. Every period change goes to the [activity log](/membros/registros-de-atividades), with the before and after.

**Before saving, you see the effect.** When you save a different period, the **Change the retention period?** window shows *"From 12 to 6 months."* and *"With the new period, the daily routine would anonymize today:"*, with the counts (**Guest visits**, **Pre-registrations**, **Closed parcels**, **Photos**, **History entries**). For a shorter period, it warns *"The reduction only applies from … Until then, the 12-month period stays in force."*; you confirm with **Confirm and save**. While the reduction is pending, the field shows *"Reduction to 6 months applies from …"*. The AI assistant shows the same count when it asks for confirmation.

### Guests

In an **Attendance** space, a guest's visit (someone who is not a member) keeps their name, company and phone. **Once the space's period has passed after the arrival**, the visit is anonymized:

- the guest's name, company and phone go;
- the visit stays, with the dates and the host, for attendance counts and reports.

The same applies to a **guest registered in advance** through [Visitors](/espacos/visitantes): once the period of the Attendance space where they arrive has passed, counted from the expected day, the name, company, e-mail and phone go.

### Closed parcels

In a **Parcels** space, a **closed** parcel (picked up, returned or discarded) is anonymized **once the space's period has passed after it was received and closed**:

- the sender, tracking code, notes, the name of whoever picked it up for someone else, the closing reason and the pickup code go;
- the **photos** are deleted;
- the parcel's history loses the same data;
- the parcel stays on the list, with the dates and the member who received it.

**A parcel waiting for pickup is never anonymized**, however old it is: the period only starts counting when it closes.

**On screen.** An anonymized visit, pre-registration or parcel stays in the list and the detail, with *"Data removed by the retention period"* in place of the erased data. On a parcel, the recipient's name stays, because it belongs to the member.

### The team's activity log

The [activity log](/membros/registros-de-atividades) keeps, for each change, how the item was before and how it ended up. **After 2 years**, that before-and-after detail goes. The log keeps showing who did what, on which item and when. This period is the platform's and does not change per community.

### The access record

A Brazilian law (the Marco Civil da Internet, art. 15) requires keeping an **access record** of who uses the platform. Memberfy keeps only the minimum:

- the **IP** you accessed from;
- the **day**;
- the **first** and **last time** you accessed that day, from that IP;
- how many times you signed in with email and password that day.

It does not keep the browser, the device, the pages you opened or your location.

**When it is recorded.** When you sign in to the community, when you use the app (the last time is updated at most every 15 minutes) and when you use the community through the **AI assistant** (Claude, ChatGPT and others), with the IP the assistant was called from. Calls with an [API key](/api/autenticacao#api-key), shared devices (kiosk, room and event panels) and visitors who do not sign in are not recorded.

**For how long.** **6 months**, the legal period. After that, the line is deleted automatically, every day. [Deleting your account](/membros/excluir-sua-conta) does not delete this record before the 6 months, because the law requires keeping it.

**Who sees it.** **No one in the community**: not the owner, not the admin, not the team. The record does not appear on any screen or in any API route; Memberfy only hands it over under a court order. You see yours in the [Download your data](/membros/baixar-seus-dados#what-comes-in-the-file) file, in `acessos.csv`.

### The platform's legal periods

Some records must be kept longer by law. They stay for the period below and, at the end, lose the personal data (or are deleted); what is accounting stays, without anyone's name. These periods are the platform's and do not change per community.

"Following year + 5" means: 5 years counted from January 1 of the year after the operation. A purchase from March 2026 counts from January 1, 2027 and expires on January 1, 2032.

| Record | Period | At the end of the period |
|---|---|---|
| Purchases | following year + 5 | the shipping address and the refund reason go; amounts, fees, status and dates stay |
| Refunds, subscription charges, withdrawals and credits | following year + 5 | reasons, notes and the withdrawal's bank details go; the accounting record stays |
| Notices from the payment processor (Stone) | following year + 5 | the content of the notice goes; the type, status and dates stay |
| Sealed copy of a [deleted account](/membros/excluir-sua-conta) | following year + 5, counted from the later of the deletion and the person's last financial operation | the copy is deleted; the record of the deletion request stays |
| Verification data of whoever receives the community's payments (company, partners, payout account) | 5 years after the relationship ends: the community closes or the payee or partner is replaced | documents, names, dates of birth, address, contact and bank details go, and the uploaded files are deleted; country, type, status and dates stay |
| [Time tracking](/espacos/controle-de-ponto) punches | 5 years after each punch | the CPF (Brazilian tax ID), IP, device and location go; the date, time, type and employee stay |
| Employee dismissed from time tracking | 5 years after the dismissal | the CPF and name go; hiring date, position and dates stay |
| Time punch refused outside the allowed area | 5 years after the attempt | deleted |
| Proof that a contact started receiving messages again after replying STOP | 5 years after resuming | deleted |
| [Access record](#the-access-record) | 6 months | deleted |

Since the platform's oldest records are from 2026, no 5-year period expires before 2031.

### What this rule does not cover

- **A member's visit** and **the member who receives a parcel** are the member's own data. They are not anonymized by period: they follow [account deletion](/membros/excluir-sua-conta), when the member requests it.
- **Orders, payments and invoices** are kept for the period the law requires for financial records: see [The platform's legal periods](#the-platform-s-legal-periods).
- The other periods Memberfy already applies, such as the 90 days of the [abandoned cart](/pagamentos/carrinhos-abandonados), stay as they are. See [Terms of use › Personal data](/conceitos/termos-de-uso#personal-data).

### Who can

The owner and the admin change a space's period. Anonymization does not depend on anyone: it runs on its own. The access record and the platform's legal periods have no setting: they are the same for every community.

## Examples

- **Coworking with a front desk.** Attendance with 12 months: the visit of a guest from March 2026 loses the name and phone in March 2027; the month's visit count stays the same.
- **Office building.** Parcels with 6 months: a package picked up on January 10 loses the sender and the photos on July 10. A package that arrived in January and is still at the front desk loses nothing.
- **Shortening from 24 to 6 months.** The change made on December 1 applies on December 8.

## Frequently asked questions

**Can anonymization be undone?**
No. Erased data does not come back. If you need to keep it longer, lengthen the period beforehand.

**Why does shortening the period take 7 days?**
So a mistake does not erase months of records at once. During the 7 days, you can go back to the previous period.

**Does anonymization delete the visit?**
No. The visit stays, without the guest's data. Counts and reports stay the same.

**Can the community see where I accessed from?**
No. The access record is not shown to anyone in the community, not even the owner. Only you see yours, in the [Download your data](/membros/baixar-seus-dados) file, and Memberfy only hands it over under a court order.

**If I delete my account, does the access record go too?**
Not right away: it stays until the 6 months the law requires are up, and then it is deleted.

**Where do I change the period on screen?**
In **Configure space**, in the **Retention period (months)** field, as the owner or an admin. See [Each space's period](#each-space-s-period).

## In the API

The period lives in `moduleConfig.attendance.retentionMonths` (Attendance) and `moduleConfig.parcels.retentionMonths` (Parcels), a whole number of months, when creating or editing the space. Out of range: `400` with `param` `moduleConfig.<module>.retentionMonths`. See [putSpacesById](/api/referencia/sections-spaces/put-spaces-by-id). Anonymized visits, guests and parcels come with `anonymized: true`. The access record has no route: no API call, with a sign-in or with a key, returns it.

Before saving, `GET /api/spaces/{id}/retention-preview?months=N` (owner and admin) returns the period in force, how many records would go (`counts`) and, for a shorter period, `effectiveAt` (7 days later); while a reduction is pending, the configuration carries `retentionMonthsPrevious` and `retentionMonthsEffectiveAt`. See [getSpacesByIdRetentionPreview](/api/referencia/sections-spaces/get-spaces-by-id-retention-preview). Through the assistant, [`create_space`](/mcp/ferramentas-comunidade#create-space) and [`update_space`](/mcp/ferramentas-comunidade#update-space) accept `retention_months` in Attendance and Parcels spaces; when the period changes, `update_space` asks for confirmation with the before and after, the count of what would be anonymized today and, for a shorter period, the date it starts to apply.

## Related

- [Attendance](/espacos/presenca)
- [Parcels](/espacos/encomendas)
- [Visitors](/espacos/visitantes)
- [Logs](/membros/registros-de-atividades)
- [Delete your account](/membros/excluir-sua-conta)
- [Download your data](/membros/baixar-seus-dados)
- [Terms of use](/conceitos/termos-de-uso#personal-data)