Data Retention and Disposal Policy
1. Purpose
This policy defines how CommVergent Automation LLC retains, manages, and disposes of data across all platforms we operate, including Elysian Money, FigrOut, BildOut, and HackHunters. The purpose is to ensure that data is retained only as long as necessary to fulfill its intended purpose, and that disposal is performed securely and in compliance with applicable data privacy laws including the California Consumer Privacy Act (CCPA) and other applicable U.S. state privacy regulations.
2. Scope
This policy applies to:
- All consumer personal data and financial data collected through CommVergent Automation platforms
- All data received from third-party data providers including Plaid Technologies, Inc.
- All personnel and systems involved in processing, storing, or disposing of such data
3. Data Categories and Retention Periods
| Data Category | Examples | Retention Period |
|---|---|---|
| Account data | Name, email address, account credentials | Duration of active account + 30 days after deletion request |
| Financial transaction data | Imported transactions, journal entries, ledger records | Duration of active account + 30 days after deletion request |
| Bank connectivity data | Plaid access tokens, linked account metadata | Revoked and deleted immediately upon account disconnection or account deletion |
| Uploaded files | OFX, QFX, CSV import files | Deleted after successful processing; not retained beyond 7 days |
| Audit logs | Ledger mutation records, authentication events | 1 year from creation, then permanently deleted |
| Billing data | Subscription records, payment history | 7 years (required for tax and accounting compliance) |
| Support communications | Emails, support tickets | 2 years from last communication |
| Application logs | Server request logs, error logs | 90 days, then automatically purged |
4. Consumer Data Deletion Rights
CommVergent Automation respects and enforces consumer rights to data deletion in accordance with applicable law.
4.1 Deletion Request Process
Consumers may submit a deletion request by:
- Using the account deletion feature within the application
- Contacting privacy@commvergent.com
4.2 Verification
Deletion requests are verified by confirming ownership of the registered email address before processing.
4.3 Deletion Execution
Upon a verified deletion request:
- All personal data and financial data is permanently deleted from active databases within 30 days
- Plaid access tokens are immediately revoked via the Plaid API and deleted from our systems
- Backups containing the user's data are purged on the next scheduled backup rotation cycle, not to exceed 90 days
- Billing records are retained for the legally required period (7 years) in anonymized or minimized form where possible
4.4 Confirmation
A confirmation of deletion is provided to the requester upon completion.
5. Third-Party Data Provider Obligations
Data received from Plaid Technologies, Inc. is subject to Plaid's own data retention and deletion policies in addition to this policy. Upon account deletion or bank account disconnection:
- CommVergent Automation revokes the associated Plaid access token immediately
- CommVergent Automation deletes all Plaid-sourced transaction data in accordance with Section 4.3
- CommVergent Automation requests deletion of consumer data from Plaid in accordance with Plaid's end user privacy policy
6. Data Disposal Standards
All data disposal is performed using methods appropriate to the storage medium:
Database records: Permanent deletion via database delete operations. Soft-delete patterns (flagging records as deleted) are not used as a substitute for permanent deletion in response to consumer deletion requests.
Backups: Backup files are retained for a maximum of 90 days. Backup systems are configured to automatically purge data beyond the retention window.
Application logs: Logs are automatically purged after 90 days. Logs do not contain consumer financial data, Plaid access tokens, or other sensitive personal information.
Uploaded files: Files uploaded by consumers for import (OFX, QFX, CSV) are deleted from storage within 7 days of upload, regardless of processing status.
7. Data Minimization
CommVergent Automation collects and retains only the data necessary to provide the Service. We do not retain data beyond its operational purpose. Specifically:
- Raw Plaid API responses are normalized and the source payload is retained only to support user-facing data review and dispute resolution
- No consumer financial data is retained for advertising, profiling, or sale to third parties
- No data is shared with third parties beyond the authorized service providers listed in our Privacy Policy
8. Policy Compliance and Review
This policy is reviewed annually by CommVergent Automation's designated privacy owner, or sooner in response to:
- Material changes to applicable privacy law
- Significant changes to platform architecture or data flows
- A data incident that reveals gaps in retention or disposal practices
Compliance with this policy is the responsibility of all personnel with access to consumer data.
9. Contact
For questions regarding this policy or to submit a data deletion request:
Approved by:
Kandus MacMillan
Founder, CommVergent Automation LLC
April 2026