A practical retention policy for visitor images

Retention is not a single number. It is a set of decisions about images, visit records and audit events, each with a different operational purpose.

Start with a short image window

Thirty days is a practical default for ID images. The visit record retains the outcome and metadata; the image is purged unless an investigation requires it.

Keep records and audits longer

Visitor records and audit events typically run to two years, or to your own policy. Anonymise idle visitors rather than keeping full profiles forever.

Make erasure explicit

A per-profile erase deletes documents, images and SMS rows, anonymises PII and leaves a metadata tombstone with a non-PII audit event. Document the path and test it before go-live.