# Does OCR Software Store My Documents? Retention 101

- Author: Schema Law (https://www.schemalaw.com/)
- Published: 2026-10-10T00:31:59Z
- Updated: 2026-10-11T19:22:20Z
- Category: Confidentiality
- Canonical: https://www.schemalaw.com/blog/does-ocr-software-store-my-documents

> Does OCR software store my documents? Online tools usually keep uploads for a while. Where copies sit, how to delete them, and how to set a retention period.

Yes, most online OCR software will store your documents for some period, because it has to hold the file to convert it and usually keeps the result so you can download it. Desktop OCR keeps everything on your own computer. How long an online service keeps copies, and where, is set by its retention policy.

So the question to put to a vendor is how many copies exist, where each one sits, when each is removed, and who decides. This post answers that in general and then for Schema Law's plans. It is practical guidance and is not legal advice. Record-keeping duties vary by jurisdiction, so check your own.

## Does OCR software keep your files after conversion?

Whether OCR software keeps your files after conversion depends on which kind you use. Installed software leaves the files on your machine. A browser-based service receives a copy and then follows one of three patterns: delete soon after processing, delete after a fixed period, or keep until you delete.

Take the installed case first. A desktop program reads the scan from your drive and writes the output back to it. Nothing is stored by a vendor, though you are now responsible for every copy on that computer and its backups. Some desktop products send pages to an online service for recognition, so check the settings before assuming everything stays local. The comparison of [online OCR and desktop OCR for law firms](https://www.schemalaw.com/blog/online-ocr-vs-desktop-ocr-for-law-firms) covers that choice.

Online services fall into three groups.

| Pattern | What the vendor says | What to check |
| --- | --- | --- |
| Delete after processing | "Files are removed once conversion finishes" or "within an hour" | Whether that covers the output, logs and backups as well as the upload |
| Fixed window | "Files are deleted after 24 hours", or 7 or 30 days | When the clock starts, and whether you can delete sooner |
| Keep until you delete | "Your documents stay in your account" | How deletion works, and what happens if you cancel |

None of the three is right for every job. A tool that deletes after an hour suits a one-off conversion and frustrates a paralegal who needs to export the same deposition in a second format next week. An account that keeps documents is convenient, and it accumulates client files unless someone clears it out.

Records retention for the matter file and retention inside the converter are separate clocks. Personal data should leave the service once the export is checked. Data minimization is the habit of uploading the pages the task needs and clearing the account the same week. Client confidentiality is what that weekly clear protects. Put the owner's name on the calendar entry so the clear does not depend on memory.

"Deleted after processing" describes the vendor's main copy. It says nothing by itself about the secondary copies covered later in this post. Before you take it at face value, ask what "deleted" includes.

## What is a retention period?

A retention period is the length of time a service keeps a piece of data before removing it. It is a rule with three parts: what is covered, when the clock starts, and what happens at the end. A number of days without those three parts tells you very little.

**What is covered.** One policy may set different periods for the uploaded file, the extracted text, the export files, account records and system logs. "We keep your documents for 30 days" may refer only to the first of these.

**When the clock starts.** The period can run from upload, from the last time you opened the document, from the moment you click delete, or from the day you close your account. Those are very different promises. "Deleted within 30 days" can mean 30 days after you ask, which is not 30 days after upload. Ask which.

**What happens at the end.** Removal from your screen, removal from the live system and removal from backups can be three separate events.

OpenAI's published policy is a clear example of how these parts are written. Its page on [chat and file retention policies in ChatGPT](https://help.openai.com/en/articles/8983778-chat-and-file-retention-policies-in-chatgpt) said, as archived in September 2026, that a deleted chat "is removed from your account immediately and scheduled for permanent deletion from OpenAI systems within 30 days", unless it has already been de-identified or must be kept longer "for security or legal obligations." That one sentence has a trigger (you delete), an immediate effect (gone from view), a later effect (gone from systems) and two exceptions. Read any vendor's retention line for the same four pieces. Policies are revised, so check the current page.

Two more terms come up.

- **Zero data retention** is a vendor's claim that it keeps neither input nor output once the job is done. Ask whether that is the default or something you must request.
- **Legal hold** is the usual exception: a vendor may keep data longer when the law requires it. Ask whether you would be told.

A retention period also works as a limit on your own access. If a free tier deletes after a week, download what you need before then.

## Where copies can linger: uploads, outputs, logs, backups

Copies can linger in at least four places on a vendor's side: the uploaded original, the generated text and export files, system logs, and backups. More sit on your side, in download folders, email and phone galleries. Deleting a document from a dashboard reliably reaches only the first.

| Where | What it holds | What to ask or do |
| --- | --- | --- |
| Upload | The scan as you sent it | Is the original kept, and for how long? |
| Outputs | Extracted text, tables, each export you generated | Are these deleted with the original? |
| Logs | File names, page counts, sometimes snippets or error details | Do logs ever contain document content? How long are they kept? |
| Backups | Snapshots of everything above | How long after deletion do backups still hold my file? |
| Other processors | Copies at any company the vendor passes pages to | Do they retain anything, and under what terms? |
| Support | Files you attached to a help request | Are support attachments covered by the same deletion? |
| Your devices | Downloads, email attachments, synced folders, camera roll | Clear them yourself |

File names deserve a thought of their own. "Smith v Jones - settlement offer DRAFT.pdf" discloses something even if the content is gone. If logs keep file names, a neutral name or matter number is safer.

Backups are the copy people forget. OpenAI's retention page gives a concrete illustration from its Enterprise product: after a file is deleted or expires, the page says, "OpenAI's internal backups may retain it for up to 30 additional days." The same page shows how two stores can behave differently inside one product: "deleting a chat does not delete files saved to Library." Neither point is a criticism. It is what a specific retention policy looks like, and it is the level of detail to ask every vendor for.

The profession has known this for some time. [ABA Formal Opinion 477R](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-477.pdf), on securing client communications, observes: "In the electronic world, 'delete' usually does not mean information is permanently deleted, and 'deleted' data may be subject to recovery."

Stored copies are also where encryption matters, since a file at rest is protected only if it is encrypted there. The post on [what encryption at rest protects](https://www.schemalaw.com/blog/encrypted-ocr#what-does-encryption-at-rest-protect) covers that, and the post on [OCR that does not train on your data](https://www.schemalaw.com/blog/ocr-that-does-not-train-on-your-data) covers what a vendor may do with a copy while it holds one.

## How do you delete a document for good?

To delete a document for good, remove it in the service, confirm what that removal covers, wait out any stated backup period, and then clear your own copies. You cannot watch a vendor's servers, so the last step on their side is a written answer about what was removed and when.

1. **Export what the file needs first.** Save the formats you want into the matter file. Deletion should not be reversible.
2. **Delete the document in the service.** Use the product's delete control. Archiving or hiding a document does not delete it.
3. **Check for a trash or recovery area.** Some products keep deleted items for a period so you can restore them. Empty it if there is one.
4. **Delete the outputs.** If exports are listed separately from the source document, remove those too.
5. **Read what the policy says deletion covers.** Find the period for live systems and for backups. Note the date on which the last copy should be gone.
6. **Ask about the rest.** Send a short written question: does deletion remove logs containing content, support attachments and any copies held by other processors?
7. **Clear your side.** Downloads folder, desktop, email attachments, shared drives, the phone you photographed the page with, and its "recently deleted" album.
8. **Record it.** A line in the matter file: what was deleted, where, on what date, and the vendor's stated purge period.

For a whole matter, or when you leave a vendor, ask whether deleting the account removes all documents, how long that takes, and whether the vendor will confirm in writing once it is done.

Common mistakes:

- Treating account cancellation as deletion. Stopping payment and removing data are different actions unless the terms say otherwise.
- Deleting the upload and forgetting three exports.
- Forgetting the copy you emailed to yourself to get the file from the scanner to the browser.
- Assuming a free tool with no account has nothing to delete. With no account, you have no delete control at all, and whatever the site's policy says is all you get.

One limit applies everywhere. If a vendor is legally required to keep something, your delete request may not override that. Ask how you would learn of it.

## Retention settings by plan in Schema Law

Schema Law has no retention setting on any plan. Nothing is deleted automatically, so a document stays in your account until you delete it. The one line about deletion, listed for every plan on the [pricing page](https://www.schemalaw.com/pricing), is "Delete any document, at any time". The table shows how little the plan changes.

| Plan | Automatic deletion | Retention setting | How a document leaves |
| --- | --- | --- | --- |
| Free | None | None | You delete it |
| Solo | None | None | You delete it |
| Team | None | None | You delete it |
| Enterprise | None | None | You delete it |

The [security section of the homepage](https://www.schemalaw.com/#security) adds, under the heading "You decide how long anything is kept": "Delete any document whenever you choose. The original file and everything parsed from it are removed."

What follows from those lines, and what does not:

- **It is a "keep until you delete" service.** That is the third pattern in the table near the top of this post. A second export next week is easy, and client files pile up unless someone clears them out.
- **The plan does not change the answer.** The plans differ in price, page allowance and support. Moving up does not add a timer, and the Free plan does not clear itself after a set number of days.
- **Delete after export.** Once the exports are saved to the matter file and checked against the scan, delete the document. By the homepage's wording, that removes the original and everything parsed from it.
- **Set your own reminder.** No timer will do it for you, so the period is whatever you put in your calendar. A dated entry for each matter, or a monthly review of what is in the account, does the work a retention setting would do.
- **Ask about backups.** The site says what deletion removes. It gives no period for backups or logs, so put that question in writing.

These are Schema Law's statements about itself. This post does not verify them and says nothing about how documents are held. The questions in the table of lingering copies apply here exactly as they apply to any vendor. Ask Schema Law whether that removal also covers exports, logs and backups, over what period, and which document says so. Keep the reply with your vendor records.

## Matching retention to your file-closing policy

Match retention in an OCR tool to your file-closing policy by treating the tool as a workbench. It is not where the file lives. The record copy belongs in the firm's own system under the firm's own schedule. The copy in the converter should last only as long as the conversion work does.

Your jurisdiction's rules on how long client files must be kept, and what you must return or destroy at the end of a matter, apply to the file you maintain. They differ from state to state, and this post does not summarize them. What they share is the assumption that you know where the client's documents are. A forgotten converter account undercuts that.

A simple way to set the period:

| Kind of work | Sensible retention in the tool | Why |
| --- | --- | --- |
| One-off conversion of a single document | Delete the same day, after export | Nothing more will be needed |
| Active matter with repeat exports | Keep through the active phase, review monthly | You may need another format |
| Production set under a protective order | Follow the order's terms | The order may require return or destruction |
| Closed matter | Delete at closing | The record copy is in the firm's system |

### A worked example

A solo practitioner settles an injury case. During the matter she converted 600 pages of medical records and exported them to Word and Excel. Her closing checklist has a line for outside tools. She confirms the exports are saved in the matter folder, deletes the documents from the converter, clears her Downloads folder, and notes the date in the closing memo. If the settlement agreement or a protective order required destruction of the other side's records, the same step covers the converter copy. Without it, that copy is the one she would miss.

Three habits make this routine:

- **Add "outside tools" to the closing checklist,** next to returning originals and final billing.
- **Name one person** who reviews what is sitting in each tool every month.
- **Set the shortest retention the work allows** where the product lets you choose, and lengthen it only for a reason. Where it has no setting, as in Schema Law, a calendar reminder is the setting.

If your firm has a written technology policy, retention in outside tools belongs in it. The template in the post on [law firm AI policy rules for document uploads](https://www.schemalaw.com/blog/law-firm-ai-policy-document-upload) is a place to start. For the wider set of vendor questions, see [which questions to ask an OCR vendor](https://www.schemalaw.com/blog/is-it-safe-to-upload-client-documents-to-an-ocr-tool#which-questions-should-you-ask-an-ocr-vendor).

## Try it on a real document

Upload a scanned PDF and export it as Word, a searchable PDF or plain text on the free plan. Your documents are never used to train an AI model. [Start free](https://www.schemalaw.com/api/auth/google)