Data Retention Policy
Last updated: October 12, 2026
This Data Retention Policy (the “Policy”) establishes the requirements under which Dominion Labs Inc. (“Dominion Labs” or the “Company”) retains, archives, and disposes of information collected or generated in connection with its websites, Lyric Ai, its mobile applications, and the systems that support them (collectively, the “Services”). This Policy supplements the Company’s Privacy Policy.
Where a written agreement between the Company and a customer specifies a different retention period, the terms of that agreement govern.
Purpose
This Policy ensures that information is retained no longer than necessary to fulfill the purposes for which it was collected, to satisfy applicable legal, regulatory, and contractual obligations, and to protect the security and integrity of the Services.
Scope
This Policy applies to all personal information and business records processed by or on behalf of the Company, in any format, including information held in production systems, archives, and backups.
Retention principles
- Information is retained only for the period required by its documented business purpose, applicable law, or a security requirement defined in this Policy.
- Each category of information is assigned a single retention period and a defined method of disposition.
- Upon expiration of the applicable retention period, information is securely deleted or irreversibly de-identified.
- Disposition extends to backup media in accordance with the backup rotation schedule set out in this Policy.
- Retention periods are suspended for any information subject to a legal hold.
Retention schedule
Lyric Ai: Lyric Starter, Lyric Pro, and Lyric Max
| Data category | Retention period | Disposition |
|---|---|---|
| Account informationName, email address, telephone number, postal address, authentication methods, and account settings | Duration of the account | Deleted within 30 days of account closure |
| User contextInformation Lyric maintains about the user and the evidence supporting it | Duration of the account, or until deleted by the user | Removed from active use upon deletion and permanently deleted within 30 days |
| ConversationsConversation history with Lyric | Duration of the account, or until deleted by the user | Permanently deleted within 30 days of deletion |
| Location historyLocation data transmitted by connected devices | 90 days | Deleted; derived place and pattern information is retained as part of user context |
| AudioAudio not directed to Lyric | Not retained | Processed transiently and discarded; speech directed to Lyric is retained as part of user context |
| Voice templatesCreated only with the user’s written consent | Duration of active voice recognition | Destroyed within 30 days of deactivation or account closure, and in no event later than three years after the user’s last interaction with Lyric |
| Connected service dataData indexed from services connected by the user | Duration of the connection | Deleted within 30 days of disconnection; evidence incorporated into user context is retained with that context |
| Activity recordsRecords of each action Lyric performs, including inputs, decisions, actions, and outcomes | 1 year | Deleted |
Lyric Ai: Lyric Enterprise
| Data category | Retention period | Disposition |
|---|---|---|
| Organization recordsOrganization profile, users, roles, seats, integrations, and policies | Term of the agreement | Available for export for 30 days following termination and deleted within 30 days thereafter |
| Work context and conversationsUser context and conversations within the organization’s Work context | As configured by the organization; by default, the term of the agreement | Available for export for 30 days following termination and deleted within 30 days thereafter |
| Activity recordsRecords of each action Lyric performs on behalf of the organization | 1 year by default; configurable by the organization up to 7 years | Deleted |
Security and authentication: all Services
| Data category | Retention period | Disposition |
|---|---|---|
| Security logsAuthentication and single sign-on events, administrative actions, permission and policy changes, and system access | 1 year, of which 90 days in active storage and the remainder in archival storage | Deleted, unless a longer period is required by contract |
| Session recordsActive sessions and device authentication keys | Until sign-out or session expiration | Deleted; the associated authentication event is retained in security logs |
| Security incident recordsIncident records, forensic images of affected systems, and associated monitoring data | A minimum of 90 days following the incident report, and until the investigation is closed | Deleted |
Billing and business records
| Data category | Retention period | Disposition |
|---|---|---|
| Billing and tax recordsInvoices, receipts, payment records, and tax records. Payment card data is held exclusively by the Company’s payment processors | 7 years following the transaction | Deleted |
| Agreement and consent recordsThe version of each agreement or consent accepted and the date of acceptance | Duration of the account and 5 years following closure | Deleted |
| Support recordsSupport requests and their resolution | 2 years following resolution | Deleted |
| Email suppression recordsEmail address and date of opt-out | For as long as the Company sends email communications | Retained to ensure that opt-out requests continue to be honored |
Websites and games
| Data category | Retention period | Disposition |
|---|---|---|
| Website analyticsPage views, referral sources, and approximate location | 14 months | Deleted by the analytics provider |
| Game dataGame progress, purchases, and settings | Duration of use | Deleted within 30 days of a deletion request; purchase records are retained as billing records |
| Advertising dataAdvertising identifiers and ad-interaction data | Retained by advertising partners | Governed by each partner’s retention policy |
Shared learning
| Data category | Retention period | Disposition |
|---|---|---|
| General knowledgeKnowledge derived from how work is performed. Contains no user context | Retained as part of Lyric’s general knowledge | Not associated with any individual and therefore not deleted upon account closure |
Biometric information
Voice templates are created only with the individual’s written consent. The Company destroys a voice template when the purpose for which it was collected has been satisfied, which occurs within 30 days after the individual deactivates voice recognition or closes the account, and in no event later than three years after the individual’s last interaction with Lyric. The Company does not sell, lease, trade, or otherwise profit from biometric information.
Government and regulated customers
For security logs, the retention periods in this Policy are minimums. For all other categories, they are defaults. Contracts with government agencies and regulated customers may specify alternative retention periods, and the Company will comply with the periods so specified. Such requirements commonly include one year of audit records with 90 days immediately available under FedRAMP, one year of audit records under the CJIS Security Policy, and preservation of forensic images and monitoring data for at least 90 days following an incident report under DFARS 252.204-7012.
Legal holds
Where litigation, a government investigation, or a lawful request requires the preservation of information, the Company suspends disposition of the affected information until the hold is formally released. The information then returns to its standard retention schedule.
Backups
Backups are encrypted and retained for 35 days, after which they are overwritten. Information deleted from production systems persists in backups until the applicable backup is overwritten and is not restored except to recover from an incident. Where information is restored from a backup, deletions performed after the backup date are reapplied.
Disposition
Information in production systems is disposed of by deletion from the Company’s databases and storage systems. Storage media leaving the Company’s control are sanitized in accordance with NIST Special Publication 800-88 or physically destroyed. Printed materials are cross-cut shredded.
Policy review
The Company reviews this Policy at least annually and upon the introduction of any new category of information.
Contact
Questions or requests regarding this Policy may be directed to [email protected].