Data Retention & Disposal Policy

1. Purpose and Scope

This Data Retention and Disposal Policy governs how Pilot Wealth retains and disposes of personal and financial data collected through the Pilot Wealth platform. It applies to all data collected from users including financial account data, transaction history, investment holdings, personal profile information, and any data received via third-party integrations such as Plaid.

This policy is designed to ensure Pilot Wealth retains data only for as long as necessary to provide services and meet legal obligations, and that data is disposed of securely when no longer needed.

2. Data Retention Principles

Pilot Wealth adheres to the following principles for data retention:

• Minimum necessary retention — data is retained only as long as required to provide the service or meet legal obligations
• Purpose limitation — data is not retained beyond the purpose for which it was collected
• User control — users may request deletion of their data at any time
• Secure disposal — data is permanently and irreversibly deleted when no longer needed

3. Data Retention Schedule

The following table outlines retention periods for each category of data:

Data Category	Retention Period	Basis for Retention
Plaid access tokens	Duration of active bank connection	Required to maintain bank sync functionality
Transaction history	Duration of active account	Core service functionality
Account balances & holdings	Duration of active account	Core service functionality
AI chat history	Duration of active account	Personalized AI context
Income & budget settings	Duration of active account	Core service functionality
Subscription & billing records	7 years after account closure	Canadian tax and financial record obligations
Security & access logs	90 days	Security monitoring and incident response
Survey responses	Duration of active account	Product improvement
Resume generations	Duration of active account	User access to generated content

4. User-Initiated Data Deletion

Pilot Wealth provides users with full self-service account and data deletion directly within the application. When a user deletes their account:

• All personal financial data is permanently deleted from the database immediately
• Transaction history, account balances, investment holdings, income sources, assets, debts, budget settings, AI chat history, and resume generations are all deleted
• Plaid access tokens are revoked with Plaid and deleted from our database
• The Clerk user account is permanently deleted
• Active Stripe subscriptions are cancelled immediately
• Billing records are retained for 7 years as required by Canadian law

5. Bank Connection Disconnection

Users may disconnect individual bank connections at any time without deleting their full account. When a bank connection is removed:

• The Plaid access token for that institution is revoked with Plaid and deleted from our database immediately
• All synced accounts and investment holdings associated with that connection are removed
• Transaction history previously synced from that institution is retained as part of the user's financial record until full account deletion

6. Data Disposal Procedures

When data reaches the end of its retention period or a deletion request is received, Pilot Wealth ensures permanent disposal through the following methods:

• Database records — permanently deleted via SQL DELETE operations. Records are not soft-deleted or archived
• Plaid access tokens — revoked via Plaid's API before database deletion, ensuring the token cannot be used even if somehow recovered
• Clerk user accounts — permanently deleted via Clerk's API, removing all authentication data
• Backups — Render's managed database backups are retained for a short rolling window per Render's platform policy, after which they are automatically purged

7. Third-Party Data Retention

Pilot Wealth uses third-party services that maintain their own data retention policies. Users should refer to the relevant policies for each:

• Plaid — subject to Plaid's Privacy Policy and data retention practices
• Stripe — payment and billing records retained per Stripe's Privacy Policy and financial regulations
• Clerk — authentication records subject to Clerk's Privacy Policy
• Anthropic — AI interactions subject to Anthropic's Privacy Policy

8. Compliance

This policy is designed to comply with:

• Canada's Personal Information Protection and Electronic Documents Act (PIPEDA)
• Applicable Canadian provincial privacy legislation
• Plaid's Developer Policy and data handling requirements

9. Policy Review

This policy is reviewed at minimum annually and updated whenever there are material changes to our data practices, applicable law, or third-party integrations. The last review date is shown at the top of this document.