Harvey retains Personal Data for as long as necessary for the described purposes, including legal obligations, dispute resolution, agreement enforcement, and tax and audit requirements. Data held in backup archives that cannot be immediately deleted is stored securely and isolated from further processing until deletion is possible.
This analysis describes what Harvey AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The retention period for end users whose employers hold a Customer Agreement is governed by that agreement rather than solely by this policy, creating a dependency on enterprise contract terms for determining how long individual user data is held. The backup archive carve-out for data that cannot be immediately deleted is a standard but operationally relevant provision for deletion request management.
Under these terms, the retention period for Personal Data associated with employer accounts is determined by the Customer Agreement, not solely by this policy. Harvey states it will delete or anonymize Personal Data when there is no ongoing legitimate business or legal reason to retain it, with a carve-out for data stored in backup archives that are securely isolated pending deletion.
Cross-platform context
See how other platforms handle Data Retention Policy and similar clauses.
Compare across platforms →"We retain the Personal Data we collect from you for as long as necessary for the purposes described in this Privacy Policy. If you have a Customer Agreement with us, we will delete your data in accordance with your Customer Agreement. How long we retain Personal Data will depend on a number of factors including whether we need to retain your data to: to comply with the terms of your or your employer's Customer Agreement; to comply with or demonstrate compliance with our legal obligations, to resolve disputes, or to enforce our agreements; and in relation to Account Information, for our tax, accounting, and audit requirements. When we have no ongoing legitimate business need or legal reason to process your Personal Data, we will either delete or anonymise it or, if this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your Personal Data and isolate it from any further processing until deletion is possible.Excerpt from Harvey AI's Privacy Policy
(1) REGULATORY LANDSCAPE: This provision engages GDPR Article 5(1)(e) on storage limitation, which requires that Personal Data be kept in a form permitting identification no longer than necessary for the processing purpose.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The retention period for end users whose employers hold a Customer Agreement is governed by that agreement rather than solely by this policy, creating a dependency on enterprise contract terms for determining how long individual user data is held. The backup archive carve-out for data that cannot be immediately deleted is a standard but operationally relevant provision for deletion request …
Under these terms, the retention period for Personal Data associated with employer accounts is determined by the Customer Agreement, not solely by this policy. Harvey states it will delete or anonymize Personal Data when there is no ongoing legitimate business or legal reason to retain it, with a carve-out for data stored in backup archives that are securely isolated pending …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Harvey AI.