We automatically de-identify the data after 60 days. We are hoping to make this a customisable value, however currently we de-identifiy the data after 60 days. All sensitive information (ie name, contact details etc) is deleted, however we keep a record of when the checkin/out occured. This data is kept to provide reporting stats for businesses.
The only exception to this is when a customer 'opts-in' to marketing (available on the premium plan). We will keep that customer data alone, along with the date that the email requesting feedback from the customer.