Question record retention notice
Effective 15 October 2026. This notice explains what Ontolix Pty Ltd ("Ontolix", "we") keeps when people ask the Ontolix platform questions, how long we keep it, and how it is deleted.
What the question record is
Where your organisation turns it on, Ontolix keeps a question record for your organisation: each question an authorised person asks, and its outcome, including the answer, its sources, the AI model used and whether the answer drew on an administrator's access. It also records every time someone opens a question's text. Your organisation uses it for accountability and audit, and we keep it on your organisation's instruction.
The record is hash-chained: each entry is linked to the one before it, so any change to an entry, or a missing entry, can be detected.
Who can see it
Each person can see their own questions under My questions. Your organisation's administrators can see the question log, which shows who asked, when and the outcome. Reading a question's text is itself recorded in the log, with the reader's name, before anything is shown. Ontolix staff can read question content only inside an audited support session your organisation can see, must give a reason for each read, and each read is recorded in your question log first.
How long we keep it
Ontolix deletes each entry, including the question and answer content it holds, 45 days after it is created. Encrypted backups of the record roll off within a further 35 days, so every copy is gone within 90 days of creation. Ontolix sets this period and your administrators cannot lengthen it. Deletion runs daily and leaves only a content-free checkpoint, a sequence range and a hash, so the rest of the record can still be checked.
Integrity anchors
Every hour, Ontolix stores a cryptographic anchor of each organisation's record in locked storage. An anchor holds only hashes: no questions, answers, names or other identities. Anchors are kept for eight years and cannot be altered or deleted during that time, including after your organisation's other data is deleted when it leaves Ontolix. They let the record be shown not to have been altered.
Legal hold
If your organisation needs to keep records for a legal reason, an administrator can place a legal hold. While it is on, nothing expires: entries are kept past 45 days until an administrator releases the hold, and requests to erase a person wait unless an administrator records a reason to proceed. A hold also keeps conversation history. When it is released, everything older than 45 days is deleted.
Deleting a conversation and erasure
Deleting a conversation hides it from you and removes it from your conversation list. Its questions and answers stay in the question record until they expire.
On your organisation's instruction, such as an administrator's request to erase a person or chosen questions, Ontolix deletes the question and answer content and every stored copy of it. Each affected entry is replaced with a record that an erasure took place, holding no erased personal information, so the chain can still be checked. Erased content can remain in encrypted backups until they roll off, up to 35 days later, and is never restored into the live record.
Related records
- Conversation history: each turn of a conversation, including the question, the answer, the results shown beside it and the prompt sent to the AI model, is deleted 45 days after it is created. A conversation nobody uses for 45 days is deleted entirely. Backups roll off within a further 35 days.
- Logs of AI model requests and responses are deleted after 60 days.
- Internal telemetry that copies a question is deleted 45 days after it is written.
- Activity records of what each person does, such as which assistant they asked or which document they opened, hold no question, answer or document content and are deleted 45 days after creation, within 90 days including backups.
- Records of how long a job took hold no user and are kept for 13 months.
- Records of which version of our terms and privacy notice each person accepted, and when, hold no name or email address and are kept as evidence of the agreement, including after other data is deleted.
Export
When an administrator exports your organisation's data, the export includes every question and answer the record still holds, with what you need to check that nothing in it was changed. The export is itself recorded in the log.
Contact
Questions about this notice, or help with a legal hold or an erasure, can go to support@ontolix.ai. Our privacy policy explains how we handle personal information more generally. We may update this notice as the platform changes; the current version and effective date will appear on this page.