Overview

This Data Retention & Deletion Policy explains how CoveScore retains, deletes, archives, and restricts access to account, financial, derived, and audit data. It works alongside our Privacy Policy and Plaid consent disclosures.

Scope

This policy covers the following data classes:

• Account and profile data, including authentication-related metadata
• Plaid connection data and raw Plaid-derived transaction data
• Normalized transactions, derived signals, scores, and analytical outputs
• Archived account snapshots created during account deletion workflows
• System, security, and audit logs
• Billing and payment records
• Email engagement and communications metadata
• Early-access requests and related customer-relationship records

Retention Periods

We retain different categories of data for different periods based on operational need, legal requirements, and audit obligations:

• Active account data is retained for the lifetime of the account.
• Raw Plaid transactions are retained while the account is active and are purged on disconnect or account deletion.
• Normalized transactions and derived signals are retained on a 36-month rolling basis.
• Scores are retained for 36 months.
• Archived account snapshots are retained for 7 years after deletion, then purged by monthly cron.
• System and security audit logs are retained for 7 years.
• Stripe billing records are retained for 7 years for tax, accounting, and legal recordkeeping.
• Email engagement data is retained for 24 months.
• Early-access request data, including company name, contact name, email address, monthly deal volume, current CRM, CRM notes, and related activity records, is retained for 24 months after the last CRM activity.

Deletion Mechanisms

We use three deletion paths, depending on the event and data type:

• Automated monthly purge cron. Our scheduled purge workflow includes the archival purge path at app/api/cron/retention-purge/route.ts, which destroys expired transactional data for archived accounts once the 7-year window has elapsed and no active legal hold exists.
• Self-service account deletion. Account deletion and downstream cleanup are available through the self-service deletion workflow shipped after Issue_003.
• Manual privacy request. Users may request deletion by emailing privacy@growspera.com. We process verified requests within 30 days unless a legal hold or mandatory retention obligation applies.

Legal Holds

We may suspend deletion when a legal, regulatory, dispute, fraud, or security investigation requires preservation of records.

• Legal holds are placed and lifted through the internal admin route app/api/internal/retention-hold/route.ts.
• While a hold is active, purge jobs skip the affected account even if its normal retention window has expired.
• Hold placement and removal are audit logged with the hold reason, actor, and timestamp.
• A hold remains in effect until it is explicitly lifted.

Data That Is Never Deleted Immediately

Some records are preserved even when an account is deleted or purge workflows run:

• Audit log entries
• archived_accounts snapshot rows
• Legal-hold records
• Billing records that remain subject to tax or accounting retention requirements

For archived accounts, the transactional and analytical data may be purged after the retention window, but the archive record remains as the historical deletion snapshot.

Plaid-Specific Retention Notes

Plaid-derived raw transaction data is not kept indefinitely. We retain it only while the connected account remains active for analysis and refresh workflows. When a user disconnects Plaid access or deletes the account, the raw Plaid transaction dataset and related Plaid connection rows are purged as part of the deletion lifecycle, subject to legal-hold and billing-record exceptions.

Review Cadence

We review this policy at least annually and whenever a material change is introduced to our data model, onboarding flow, deletion workflow, or legal obligations.

Questions

Questions or deletion requests can be sent to privacy@growspera.com.