Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Harvey retains Personal Data for as long as necessary for the described purposes, including legal obligations, dispute resolution, agreement enforcement, and tax and audit requirements. Data held in backup archives that cannot be immediately deleted is stored securely and isolated from further processing until deletion is possible.
This analysis describes what Harvey AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The retention period for end users whose employers hold a Customer Agreement is governed by that agreement rather than solely by this policy, creating a dependency on enterprise contract terms for determining how long individual user data is held. The backup archive carve-out for data that cannot be immediately deleted is a standard but operationally relevant provision for deletion request management.
Under these terms, the retention period for Personal Data associated with employer accounts is determined by the Customer Agreement, not solely by this policy. Harvey states it will delete or anonymize Personal Data when there is no ongoing legitimate business or legal reason to retain it, with a carve-out for data stored in backup archives that are securely isolated pending deletion.
Cross-platform context
See how other platforms handle Data Retention Policy and similar clauses.
Compare across platforms →Monitoring
Harvey AI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We retain the Personal Data we collect from you for as long as necessary for the purposes described in this Privacy Policy. If you have a Customer Agreement with us, we will delete your data in accordance with your Customer Agreement. How long we retain Personal Data will depend on a number of factors including whether we need to retain your data to: to comply with the terms of your or your employer's Customer Agreement; to comply with or demonstrate compliance with our legal obligations, to resolve disputes, or to enforce our agreements; and in relation to Account Information, for our tax, accounting, and audit requirements. When we have no ongoing legitimate business need or legal reason to process your Personal Data, we will either delete or anonymise it or, if this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your Personal Data and isolate it from any further processing until deletion is possible.Excerpt from Harvey AI's Privacy Policy
(1) REGULATORY LANDSCAPE: This provision engages GDPR Article 5(1)(e) on storage limitation, which requires that Personal Data be kept in a form permitting identification no longer than necessary for the processing purpose. The backup archive carve-out is recognized under GDPR guidance but requires that archived data be effectively isolated from active processing. CCPA deletion request obligations similarly apply, with recognized exceptions for legal obligations and internal uses. (2) GOVERNANCE EXPOSURE: Low to Medium. The delegation of retention periods to Customer Agreements for enterprise users creates variability in actual retention durations that is not visible in this policy alone. Organizations should review their Customer Agreement retention terms to confirm alignment with their own data governance obligations and applicable law. (3) JURISDICTION FLAGS: EU and UK data subjects may invoke GDPR Article 17 deletion rights, which Harvey must honor subject to the stated exceptions. California residents may submit CCPA deletion requests subject to the same exceptions. The effectiveness of deletion requests for data in backup archives depends on Harvey's backup rotation and isolation procedures, which are not described in this document. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers should review the retention and deletion terms in their Customer Agreements to confirm specific timelines, deletion confirmation mechanisms, and coverage of backup data. Subprocessor contracts should align with these retention commitments. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should confirm that data subject deletion requests trigger a documented review of all storage environments including backup archives, and that isolated backup data is flagged for deletion at the next practicable opportunity. Retention schedules should be aligned across the Customer Agreement, this policy, and internal data governance documentation.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The retention period for end users whose employers hold a Customer Agreement is governed by that agreement rather than solely by this policy, creating a dependency on enterprise contract terms for determining how long individual user data is held. The backup archive carve-out for data that cannot be immediately deleted is a standard but operationally relevant provision for deletion request …
Under these terms, the retention period for Personal Data associated with employer accounts is determined by the Customer Agreement, not solely by this policy. Harvey states it will delete or anonymize Personal Data when there is no ongoing legitimate business or legal reason to retain it, with a carve-out for data stored in backup archives that are securely isolated pending …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Harvey AI.