1. Purpose And Scope
Keep information only for a defined, necessary purpose, then securely delete it or make it irreversibly anonymous. This policy supports the Information Security Policy and applies to customer records, financial data, documents, AI inputs/outputs, logs, backups, and copies processed by service providers.
2. Retention Schedule
These are maximum retention periods, not reasons to keep unnecessary data or refuse a valid deletion request. The CEO must document the specific purpose and lawful basis for any retention after deletion; retain only the records needed for that purpose.
| Information | Retention And Disposal |
|---|---|
| Active customer and financial records, including documents and assistant history | While necessary for the requested service; remove unnecessary records earlier. Review inactive accounts annually for continuing need. Inactivity alone does not start the post-deletion clock. |
| Deleted account and related financial records | Up to two years from account deletion, only where a documented lawful need permits. Restrict access and use to that purpose; do not keep the bank connection active. Delete earlier when required by a valid privacy request or applicable law/contract. At expiry, securely delete identifiable records; retain analytics only under section 4. |
| Ordinary application/operational logs | Up to 60 days. Exclude credentials and raw financial payloads; minimize identifiers. |
| Security and administrative audit logs | Up to 180 days, with restricted access and tamper protection. Preserve relevant records longer only for a documented investigation or lawful obligation. Redaction alone does not make logs anonymous. |
| Rolling backups | Up to 14 days from creation. Inventory snapshots, replicas, and vendor backups separately; no indefinite backup copies. Longer recovery requirements need a documented schedule and approval. |
| Privacy-request and legal/incident records | Keep only the minimal evidence for the applicable legal or investigation period, recorded by the CEO. Do not retain an entire account merely to prove a request was handled. |
3. Deletion And Consumer Requests
On account deletion, disable login, revoke sessions and provider credentials, disconnect bank access, and stop synchronization and new collection immediately. Record the deletion date and scheduled final disposal. A new signup must not automatically restore a deleted account.
Receive privacy requests through [email protected] or the app’s supported request flow. Verify identity proportionately, assess applicable rights and exceptions, and respond within the applicable legal deadline. Explain any lawful partial refusal and remaining retention period. A general business preference for two years does not override deletion rights.
Delete due records from live stores, caches, files, and derived identifiable copies. Let isolated backups expire on their schedule and reapply deletion records before a restored system resumes service. Confirm the affected stores, completion date, exceptions, and verification result without copying the deleted data into the evidence.
4. Anonymous Analytics
After the permitted retention period, Moogul may retain only irreversibly anonymized or aggregated information for internal business and product analytics, where lawful, contractually permitted, and clearly disclosed to users. Remove identifiers, linkable references, and identifying combinations of financial details; destroy reidentification mappings and test whether a person can reasonably be singled out or linked back to the records. Do not attempt reidentification.
Redacted or pseudonymized records remain personal data when they can be linked back to a person. If reliable anonymization cannot be demonstrated, delete the information. Do not share analytics with external analytics or CRM partners without a separately approved data flow and updated notice.
5. Vendors, Holds, And Accountability
Approved vendors may process personal information to provide hosting, bank connections, email, or other necessary services. Maintain their data categories and retention/deletion terms in the inventory. Require deletion of copies they process on Moogul’s behalf when due, and record confirmation or contractual backup expiry. Identify any independent legal obligations and explain limits accurately; disconnecting a provider does not prove all provider-held data was erased.
Restrict and separately track records subject to a legal hold or documented lawful exception. Record purpose, authority, owner, scope, and review/expiry date; review holds every six months and dispose when released. Exceptions cannot override applicable law or contracts.
The CEO ensures schedules are configured, due disposals are checked monthly, and deletion/anonymization is tested before production use and after material changes. Retain dated results and review this policy every six months. Policy approval and publication must be reconciled with the public privacy notice and actual system behavior.