What is kept and for how long
You have the right to know what is held about you and to have it deleted. This article says what snapdue holds, how long it holds it, and exactly what survives a deletion request and why.
What is held
Your account, meaning the address you sign in with and the name you chose.
The public register record for every company you follow, which snapdue copies so pages load quickly and so changes can be spotted.
Your answers and your documents in the due diligence pack.
Identity records, if you have completed an identity check.
A log of every read and write of sensitive data, and counts of what your account has used.
How sensitive fields are stored
Fields carrying tax references, bank account details, payroll figures, litigation detail and identity answers are encrypted before they are written, so the database file alone reveals nothing.
If the encryption key is not configured on a deployment, a section carrying one of those fields refuses to save rather than storing it in plain text and hoping nobody notices.
Deleting your account
The account page has a deletion control. It asks you to type your own email address, and then it anonymises your profile, deletes your sign in account, and deletes every document you uploaded to a company that only you belong to.
A company you share with somebody else stays, because it is theirs as well as yours. You leave it rather than deleting it under them.
A company nobody belongs to any more is removed with everything under it after thirty days, so a change of mind is possible for a month.
What survives, and why
The record that a deletion was asked for and answered, because a regulator asks whether requests are honoured and a record naming nobody proves nothing. It holds a one way hash of the address rather than the address.
The log of sensitive reads and writes, with your name removed from it. The entries stay because they are the evidence that access was controlled.
Usage counts, with your name removed, because they are billing evidence.
Identity records, in full. Money laundering rules require five years after the business relationship ends, and a legal obligation to keep something outranks a request to delete it. This is the one place snapdue will say no, and the account page tells you so before you press the button.
The public register, which was never snapdue to delete.