01What "keeping a recording" can mean
Every retention period below is assigned object by object, not as one blanket "we keep data for X" rule — a transcript, a recording, an order, and a payment record each have a different reason for existing and a different justified lifetime, and collapsing them into one number would either overstate what's kept or understate it.
02Call transcripts
A text transcript of each completed call is generated and kept as part of standard service delivery, for a defined default period, then removed on a schedule rather than kept indefinitely by default. Access to it is limited to staff whose role at the restaurant actually needs it — not open to the whole team by default.
A restaurant can shorten that default window for its own account. It's a target-state design decision on which day count is right, still pending sign-off from the reviewers who'd actually approve a specific number, but the mechanism — a role-gated, time-bound transcript, deletable early on request — isn't in question.
03Call audio
Raw audio recording is a separate, explicitly disclosed capability a restaurant turns on for itself — off by default, and independently gated from the transcript described above. Where a restaurant has enabled it, the caller is told at the start of the call, consistent with the disclosure practice described at state recording law.
Where recording is on, the retained audio follows its own schedule, which does not have to match the transcript's — a restaurant can, for instance, keep transcripts for its normal operational window while retaining recordings only for the shorter period an active dispute or quality review actually needs.
04Orders and payment evidence
Order records — what was ordered, at what price, fulfilled how — are kept for a restaurant's own operational and accounting history, and aren't deleted on the same short, rolling cycle as call artifacts. A restaurant generally needs its order history far longer than it needs a specific call's transcript, and the schedule reflects that.
Payment evidence is kept even more narrowly: the minimum non-secret record needed to reconcile a transaction, support a refund, or respond to a dispute — never the actual card number, security code, or other payment credential, which is never stored in the first place regardless of retention period. See why card data never enters Dohos systems for how that boundary works mechanically.
05Backups
A backup exists only to support recovery if something breaks — not as a second, quieter copy for analytics or anything else. Backups are encrypted, restricted from ordinary access, and tested periodically to confirm a restore actually works, not just that a backup file exists.
When something is deleted from the live system — a transcript past its window, an audio recording a restaurant turned off — that deletion has to survive a later restore from backup, not get quietly reintroduced. That's enforced through a deletion marker kept outside the recoverable backup content itself, so a restore reapplies prior deletions instead of undoing them.
06Legal holds
If a specific piece of data becomes relevant to an actual or reasonably anticipated legal matter — a dispute, an investigation, a subpoena — its normal deletion schedule pauses for exactly that data, under a documented hold with a stated scope, an owner, and a review date. A hold isn't a way to keep data indefinitely by default; it has to be tied to a real, identified matter, and it gets released once that matter closes.
07What a deletion request actually goes through
A deletion — whether it's a schedule running its course or an early request — moves through a sequence of states, not a single instant flip from "exists" to "gone":
- requested
- validated
- blocked-by-hold
- queued
- executing
- completed per system
- verified
- closed
"Blocked-by-hold" is a real, expected state, not a failure — it means a legal hold covers that specific data, and the request will complete once the hold releases. A request isn't marked complete until deletion is verified across every system it touched, including any vendor that was holding a copy, not just the primary database.
08Asking for something sooner
A restaurant or a caller can ask for something to be deleted before its scheduled date. How to actually submit that request covers the process end to end, including what happens when a legal hold or another retained-record exception applies to part of what was asked for.