Data retention

Kept for a reason. Never forever.

How long GalaxyXplore keeps your data, and when it is deleted.

All of GalaxyXplore

Search this page

Answers are quoted word for word from this page.

Search all policies

The short version

Your account lasts while you want it. Account data is kept while the account is open.
Deleting is real. A deleted account can be restored for 90 days, then it is erased for good.
The law keeps the receipts. Orders and invoices are kept for as long as accounting and consumer law require.
Messages don’t linger. Contact-form messages are kept for up to 12 months, unless an ongoing request or the law needs them longer.
Invitations don’t keep your address. Once an invitation is used or expires, only a one-way hash is left.
Lists end when you leave. Unconfirmed sign-ups are deleted after 30 days, and leaving deletes your address.

What we keep

galaxyxplore.com and GXS3 orders.

Your orders
Name, email, phone, billing and delivery address, and payment status.
Why
To deliver your order, send the receipt and owner code, and handle returns or warranty.
How long
As long as Norwegian bookkeeping and consumer law require.
Your control
The law requires us to keep these records.
Card details
Your card number and payment details.
Why
To take your payment.
Never: We never see or store your card details. Stripe, our payment provider, keeps them.
Shopping account
Verified email, name, language, date of birth, country, saved addresses, wishlist and links to your orders.
Why
To run your account and check the age rules for your country.
How long
While your account is open.
Your control
Delete it under Your account. You can restore it for 90 days, then it is erased.
Back-in-stock list
Email, country, browser language, the colour you want and when you agreed.
Why
One email when that colour is back.
How long
Until you leave. Unconfirmed sign-ups are deleted after 30 days.
Your control
Every email has a link to leave, which deletes your address.
Never: Never shared and never used for ads.
Cookies
Only essential ones: keeping you signed in, your cart and your saved products.
Why
To make the shop work.
How long
7 to 30 days.
Your control
Details are in the cookie policy.
Never: Never for analytics, tracking or ads.
Messages to us
What you send through the contact form.
Why
To answer you.
How long
12 months, then deleted.

What we keep	Why	How long	Your control
Your ordersName, email, phone, billing and delivery address, and payment status.	To deliver your order, send the receipt and owner code, and handle returns or warranty.	As long as Norwegian bookkeeping and consumer law require.	The law requires us to keep these records.
Card detailsYour card number and payment details.	To take your payment.		Never: We never see or store your card details. Stripe, our payment provider, keeps them.
Shopping accountVerified email, name, language, date of birth, country, saved addresses, wishlist and links to your orders.	To run your account and check the age rules for your country.	While your account is open.	Delete it under Your account. You can restore it for 90 days, then it is erased.
Back-in-stock listEmail, country, browser language, the colour you want and when you agreed.	One email when that colour is back.	Until you leave. Unconfirmed sign-ups are deleted after 30 days.	Every email has a link to leave, which deletes your address. Never: Never shared and never used for ads.
CookiesOnly essential ones: keeping you signed in, your cart and your saved products.	To make the shop work.	7 to 30 days.	Details are in the cookie policy. Never: Never for analytics, tracking or ads.
Messages to usWhat you send through the contact form.	To answer you.	12 months, then deleted.

From the Privacy policy

01Data retention

We retain your personal data for as long as necessary to provide our services and fulfil our obligations to you.

Order and invoice records are kept for the periods required by applicable Norwegian and EU accounting and consumer-protection laws.

Account data is retained while your account is active and, where necessary, for as long as required to complete the services you have requested. When the data is no longer needed, it is deleted or anonymised unless a longer retention period is required by law.

Messages sent through our contact form are retained for up to 12 months, unless they need to be kept longer to resolve an ongoing request or meet legal obligations.

Deleted accounts: when you delete your account it is switched off at once. You can restore it for 90 days; then your account and personal data are erased for good. Items you delete one by one in the Nutrition app can be restored for 90 days, then they are erased.

Invitation emails: the invited address is kept in plain form only while the invitation is waiting (the link works for 14 days). When it is confirmed, expires or is withdrawn, only a one-way hash of the address is kept, to prevent misuse.

Referral records: kept while your account exists. One-way hashes of the friend’s email address and sign-in id stay after an account is deleted, so the same person can’t claim the friend’s discount twice.

Family and organisation seats: the seat status and the masked invited address are kept with the plan’s record. Invoices are kept as long as accounting law requires.

Campaign checks: the 18+ confirmation and the hashed email address used for one-per-customer checks are kept with the order records, as long as accounting and consumer law require.

Error reports and logs: server logs are kept for up to 30 days. Error reports are kept in our own error monitoring, on our own servers.

Backups: deleted data can remain in our encrypted backups for up to 30 days, until those backups are deleted.

Email lists: unconfirmed back-in-stock and launch-list sign-ups are deleted after 30 days. Leaving a list deletes your address at once. Optional product analytics from the app are deleted after 13 months.

What we keep and why is in the privacy policy.

Every kind of data has a time limit. This page lists them.