# Forms Privacy and Retention Planning

Help4's **Privacy & Retention** workspace is a planning, hold, and exact-export tool for stored Form Entries. It does not decide a lawful retention period, certify compliance, delete records, anonymize records, or schedule automatic work.

## Staff workflow

1. Confirm the site's operational policy with the site owner or their adviser.
2. Choose the included forms, age threshold, and staff statuses that must stay outside the review set.
3. Save the draft. The cutoff instant is stored in UTC and displayed in the WordPress site timezone so daylight-saving changes or a later page refresh do not silently move the same preview.
4. Find any active dispute, audition, registration, or other exception by message ID and place a privacy hold with a short operational reason. Do not paste personal answers into the reason.
5. Review the exact eligible count, exact within-policy hold count, and bounded non-personal sample.
6. If separately authorized, export the exact fingerprint. The export is refused when the policy, eligible message set, hold state, status, form scope, or message revision changed.

Holds record actor and time, use stale-save and replay protection, and remain separate from operational Archive. Releasing a hold requires its own reason. The audit history stores operational IDs and hashes, never message answers or hold-reason text.

Help4 1.3.393 marks every new form-message timestamp explicitly as UTC. The Older message date readiness panel separates those records from historical records whose basis is unknown. An administrator may record evidence and review a non-personal, preview-only cutoff delta. There is no Apply or automatic migration control: ambiguous dates must remain held, excluded, or be exported for authorized offline review.

## Safety boundaries

- Archive is reversible staff filing. It is not erasure.
- No background scheduler or automatic deletion exists.
- No destructive Apply control exists.
- Exact preview queries fail closed when the database cannot prove the complete eligible set.
- Preview samples omit names, email addresses, phone numbers, source URLs, and answers.
- The exact CSV contains the authorized matching records, may contain personal data, is limited to 10,000 rows and 64 MiB, and requires `export_help4_form_privacy` in addition to workspace access. Formula-like spreadsheet cells are neutralized.
- Administrators receive all new capabilities by default. Other staff need `access_help4_form_privacy`, plus only the job capabilities they require: `manage_help4_form_privacy` for policy drafts, `manage_help4_form_privacy_holds` for holds, and `export_help4_form_privacy` for exact exports.

The site remains responsible for its published privacy notice, required legal review, response to data-subject requests, backup policy, and any later authorized destruction process.
