Data Retention & Deletion Policy
Keep-It-Balanced Pro ("KIB Pro"), a subsidiary of Prestige VA Solutions, maintains this Data Retention and Deletion Policy to govern the lifecycle of personal and financial data processed through our platform. This policy is enforced and audited in compliance with applicable U.S. privacy laws and IRS recordkeeping requirements.
This is an internal compliance document. It is available to authorized reviewers, compliance partners, and regulatory bodies upon request. The consumer-facing summary is contained in our Privacy Policy.
1. Purpose and Scope
This Data Retention and Deletion Policy ('Policy') governs how Keep-It-Balanced Pro ('KIB Pro'), a subsidiary of Prestige VA Solutions, collects, retains, and deletes personal and financial data processed through our platform. This Policy applies to all data types including consumer financial data retrieved via the Plaid API, uploaded bank statements, transaction records, tax documents, and user account information. This Policy is designed to comply with applicable U.S. privacy laws, IRS recordkeeping requirements, and financial industry standards. This Policy is enforced and audited on a regular basis.
2. Data Classification
We classify data into the following categories for retention purposes: (a) Financial Transaction Data — individual transaction records, categorized entries, running balances; (b) Financial Account Data — account numbers (masked), institution names, account types, statements; (c) Tax Intelligence Data — deduction opportunities, tax strategies, tax year analyses, discovery sessions; (d) User Identity Data — name, email, business entity information, EIN; (e) Integration Data — OAuth tokens, Plaid connection metadata, Google Workspace sync state; (f) System and Audit Data — access logs, API call logs, error reports, security event logs; (g) Document Data — uploaded statements, receipts, tax transcripts, determination letters.
3. Retention Schedule
Data is retained according to the following schedule: Financial Transaction Data: active account duration + 7 years (IRS § 6001). Financial Account Data: active account duration + 7 years. Tax Intelligence Data: active account duration + 7 years. User Identity Data: deleted within 30 days of account termination. Integration Data (OAuth tokens, Plaid connections): revoked and deleted immediately upon disconnection or account termination. System and Audit Logs: 12 months, then automatically purged. Document Data (uploaded files): active account duration + 7 years, then permanently deleted from storage. During the active account period, all data is retained and accessible to the user. The 7-year post-termination retention period applies only where legally required for tax audit defense; data not subject to legal retention requirements is deleted within 30 days of account termination.
4. Deletion Procedures
When data is eligible for deletion (either by user request, account termination, or schedule expiration), the following procedure is executed: (1) The data is soft-deleted from production databases (marked as deleted, inaccessible to users and staff). (2) Within 7 days, the data is hard-deleted from all production database instances. (3) Within 30 days, the data is purged from all database backups and snapshots. (4) Uploaded files and documents are permanently deleted from cloud storage. (5) Plaid integration tokens are revoked via the Plaid API, and all cached financial data from those connections is purged. (6) An audit record of the deletion (deletion date, data type, volume) is logged and retained for 12 months, after which the audit record itself is deleted. Deletion is verified by automated checks and confirmed via email to the requesting user.
5. Data Subject Rights
Consumers have the following rights regarding their data: (a) Right to Access — request a copy of all personal and financial data we hold; (b) Right to Deletion — request deletion of all data, subject to legal retention obligations; (c) Right to Correction — request correction of inaccurate data; (d) Right to Data Portability — receive data in a structured, machine-readable format (CSV or JSON); (e) Right to Object — object to processing for specific purposes; (f) Right to Withdraw Consent — withdraw consent for data processing at any time. Requests are submitted to support@prestigevasolutions.com and are fulfilled within 30 days of identity verification. If we cannot fulfill a request (e.g., due to legal hold), we will explain why within the same timeframe.
6. Legal and Regulatory Basis for Retention
The primary legal basis for data retention beyond account termination is IRS recordkeeping requirements: Internal Revenue Code § 6001 requires taxpayers to maintain records sufficient to substantiate items reported on tax returns. Treasury Regulation § 1.6001-1 requires retention of records for as long as they may be material in the administration of any internal revenue law, generally interpreted as 7 years. Additional retention obligations may arise from: active legal holds, pending litigation, regulatory investigations, or court orders. In such cases, data is retained until the legal hold is released, after which the standard deletion procedure applies. No data is retained beyond the maximum legal retention period without an explicit legal basis.
7. Policy Enforcement and Audit
This Policy is enforced through: (a) Automated deletion jobs that scan for data exceeding retention periods and execute the deletion procedure described in Section 4; (b) Quarterly compliance audits reviewing data retention practices, deletion logs, and data subject request fulfillment; (c) Annual review of this Policy by the Head of Information Security to ensure continued compliance with applicable laws; (d) Access controls ensuring only authorized personnel can modify retention settings or override deletion schedules. Violations of this Policy are treated as security incidents and are addressed through our incident response procedures.
8. Vulnerability Management
As part of our overall data protection program, we maintain an active vulnerability management program: (a) Regular vulnerability scans are performed against all production assets, employee and contractor machines, and infrastructure components; (b) Vulnerabilities are triaged by severity — Critical (72-hour remediation), High (7 days), Medium (30 days), Low (90 days); (c) All consumer financial data, including data retrieved from the Plaid API, is encrypted at-rest using AES-256; (d) All data in transit is encrypted using TLS 1.2 or higher; (e) Multi-factor authentication (phishing-resistant passkeys and TOTP) is enforced for all access to systems processing consumer financial data; (f) Access is logged and auditable, with role-based access controls limiting data exposure to authorized personnel only.
Compliance Inquiries
For questions about this Data Retention and Deletion Policy, or to submit a data deletion request, please contact:
Eduardo Marines, Security Lead / Head of Information Security
support@prestigevasolutions.com