Delete data after the retention period

Open Settings, then Retention. Owner, admin, accountant and tax advisor can read the report. Deletion runs are off by default for every client: owner and admin turn them on with Allow deletion runs for this client. Owner, admin and accountant can propose a run, and only an owner can accept it, never the person who proposed it. The app never deletes anything on its own and never before the period ends.
The table Retention periods shows per kind of record how long it is kept and, in the columns Stored, Past their end and Next end, how many exist, how many are past their end and when the next end comes. Receipts, bank statements and issued invoices are kept 8 years, bookings (the books) and the audit log 10 years, counted from the end of the calendar year of the record (§147 AO). A late change moves the end back, never forward. The audit log is counted for the whole firm, all its clients together. Payroll records are shown for information only and are never proposed for deletion.
The list Past their retention end names every record that may go. A record can be held back, with the reason next to it: its file is locked until a date, lines were booked against records that are still kept, a booking that is still kept reversed it, or (for the audit log) every client of the firm must allow deletion runs. Stored files under a compliance lock are never deleted before their lock date; backups and GoBD packages expire on their own schedule.
With the switch on and at least one record that may go, choose the button Propose deleting N records. There is one open run per client. The owner who did not propose it then chooses Accept and delete or Reject. If a record is no longer past its end when the run is accepted, the app asks you to reject the run and propose again. If a run takes the client's last retained record, it also shreds the client's document key, so every stored copy, backups included, becomes unreadable.
Deleted records leave a tombstone (kind, ID and retention end) and an audit row, listed under Deleted records with how many files are deleted or still pending. The audit log stays verifiable. Nothing can be brought back after a run.
A person's request to have their data erased (Art. 17 GDPR) goes under Erasure requests (Art. 17 GDPR): choose the person under Choose a contact and select Record request. Inside the retention period the request is refused with the date until which the law requires the data; the contact's records are then left out of exports. Past it, the contact and its records are proposed for deletion and go through the same second-person step. With deletion runs off, the request is recorded and refused, and you still owe the person an answer.
How long invoices and offers are kept is explained in the page on keeping documents; the periods here are the German ones (§147 AO, §14b UStG). If you are unsure whether something may go, ask your tax advisor first: a deletion cannot be undone.