# Privacy controls for your coaching business Open **Settings → Privacy & exports**. These controls are available to the workspace owner. They help you act on requests; they do not decide whether a particular request must be granted. ## Review a request Record the request and its receipt date, verify the person's identity and authority, then set it to **Reviewing**. Prepare an athlete export to understand the associated records. Review shared material and content that has not been assigned to an athlete before sending anything to the requester. ## Pause processing Under **Processing & retention**, select the workspace pause and save. This blocks normal data access, imports, AI creation, builder access and MovePacket-hosted published pages across the workspace. Owner privacy tools, account/billing access and aggregate analytics remain available. This first control is workspace-wide because custom software can combine multiple athletes' information. Requests already underway may finish; allow at least 16 minutes before destructive work. The deletion process enforces this delay. External services and copies already downloaded need separate instructions. Pausing does not revoke those copies or stop a third-party system. Resume only when the restriction can be lifted and remaining systems have been reviewed. An unfinished deletion pins the pause until it finishes or is resolved. ## Delete linked live athlete data After identity and authority review, an erasure request must be in Reviewing status. Pause the workspace, select the athlete, acknowledge the scope and type **DELETE LIVE DATA**. Scheduling deletion is irreversible once processing starts. The job removes linked legacy activity originals and decoded files, the athlete's bulk import files and recording data, import history, profile name and notes, and privacy-review note content. It revokes athlete-scoped activity credentials and invalidates all existing workspace export downloads, since they may contain the athlete. A minimal athlete identifier and request/deletion history remain for accountability and recovery checks. Linked custom projects or app records stop automatic deletion. Review these through an assisted process: shared content can concern other people. Do not simply remove associations to bypass that check. Unassigned content, event analyses, source code, external services, operational logs and backups need separate review. The job waits at least 16 minutes, then removes files in small batches and checks that each object is absent before completing the live-data stage. The scheduler normally picks up eligible work within five minutes. Large jobs take longer. **Needs operator attention** keeps processing paused; contact [MovePacket support](mailto:damian@semiprocycling.com). Retry checks only after the cause is resolved. Bounded automatic preparation supports up to 1,000 linked legacy activities, 1,000 objects in the athlete's import prefix and 100 existing export packages; larger scopes need assisted deletion. **Live data deleted** does not close the privacy request or confirm erasure from every system. Record the remaining actions and your response separately. ## Delete a project Open the project, choose **Settings**, then open **Delete this project**. The workspace owner can review the number of saved versions, private app records, project connections and recovery snapshots before continuing. The owner must type **DELETE** and acknowledge that the deletion is permanent. The project disappears from Projects immediately. Its hosted address, builder access and project credentials are disabled before background cleanup starts. Cleanup removes the project brief, draft, releases, project-owned records and objects, project connections, app analytics, access grants and project-specific recovery evidence. Shared athletes and source data under **Data** remain because they belong to the workspace and can serve other projects. Deleting a MovePacket project does not erase data held by an external provider. MovePacket records a content-free deletion receipt. The receipt contains internal identifiers, status and dates, but no project name, brief or content. **Privacy & exports** shows whether live data is being removed, off-site snapshots are being purged, the provider recovery window is still open, or operator attention is required. Verified off-site snapshots are purged by the restricted backup-maintenance workflow. Cloudflare recovery history can remain inaccessible for up to 35 days, so the receipt does not say **Permanently deleted** until that window has ended and any tracked off-site purge has succeeded. Completed receipts expire automatically after 12 months. Required account, security, usage and billing records follow their own documented rules and must not contain the deleted project content. ## Retention rules - **Analytics:** daily aggregate measurements cover the current UTC day and the previous 29 days. Older rows are removed by the scheduled cleanup and excluded from reads immediately. - **Exports:** downloads expire after 24 hours. The background cleanup removes expired packages. Scheduling deletion invalidates existing packages immediately. - **Archived athletes:** the default review reminder is 90 days after archiving. Change it to fit your documented purpose. An athlete's explicit review date takes precedence. This is a review reminder, not a claim that 90 days is a legally required or universally appropriate period. - **Athlete data and custom content:** retained until an instructed deletion or another documented rule applies. Archiving alone does not delete data. Record why records remain necessary and the next review date. - **Athlete deletion and request records:** keep only what is necessary to demonstrate action and prevent a restore from reintroducing deleted data. Review these when backup expiry and any justified retention period have been established. Athlete deletion ledger cleanup remains an assisted review. - **Project deletion receipts:** project content is excluded. A completed receipt is removed automatically after 12 months. - **Backups, provider logs and external systems:** confirm the actual provider schedules and applicable retention duties separately. Do not promise immediate backup erasure or a fixed period without evidence. ## Before restoring a backup Keep the restored system inaccessible. Obtain the latest privacy restrictions and deletion ledger from outside the backup being restored; reconcile them against the restored data. Reapply deletions and restrictions, verify affected files and derived records, then approve reopening. If the current ledger cannot be obtained, do not reopen the restored system. MovePacket does not yet automate this whole-application restore gate. ## Your obligations and MovePacket's role The coaching business decides its purposes, lawful basis, permitted retention and the appropriate response. MovePacket provides tools and processes data on instructions within its service scope. Account and billing data may have different purposes and retention duties. A data-processing agreement and an accurate privacy notice remain necessary where applicable. Guidance: [EDPB: controllers and processors](https://www.edpb.europa.eu/sme/learn-the-basics/data-controller-or-data-processor_en), [ICO: erasure and backups](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/), [ICO: storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/).