Data Retention and
Disposal Policy

This policy defines how Proofey retains and disposes of personal data and sensitive information, in support of our Privacy Policy and compliance with GDPR, CCPA/CPRA, and other applicable regulations.

This Data Retention and Disposal Policy defines how Proofey (“we,” “us,” or “our”) retains and disposes of personal data and other sensitive information. It ensures that we:

• Retain data only as long as necessary for defined purposes or as required by law.
• Dispose of data in a secure, auditable manner when retention periods end or when individuals request deletion.
• Comply with applicable data protection laws, including the GDPR, CCPA/CPRA, and other relevant regulations.

This policy supports our Privacy Policy and is intended for use by personnel responsible for data handling, development, and compliance.

This policy applies to:

• All personal data and sensitive information collected, processed, or stored by us in connection with the Proofey application.
• Data held in our primary systems (e.g., Supabase databases and storage), backups, logs, and any third-party systems we use to process or store user data.
• All personnel, contractors, and agents who handle such data on our behalf.

4.1 General principle

We retain personal data only:

• For as long as necessary to provide our services and fulfill the purposes described in our Privacy Policy, or
• For as long as required by applicable law, regulation, or legitimate business need (e.g., tax, audit, dispute resolution).

4.2 Retention by category

4.3 Exceptions

• Legal hold: If we are required to preserve data for litigation, investigation, or regulatory request, we will retain it in accordance with that requirement until the hold is released.
• Regulatory requirement: Longer retention may be required by specific laws (e.g., tax, financial, employment). We will retain data for the minimum period required by such laws.

5.1 Disposal principles

• Secure: Disposal must prevent recovery of personal data by ordinary means (e.g., permanent deletion or overwriting; for physical media, secure destruction).
• Documented: Where feasible, disposal actions (e.g., account deletion runs) should be logged for accountability and audit.
• Complete: Disposal should cover all copies of the data in primary systems, backups (after the backup retention window), and any shared or derived datasets that can identify the individual.

5.2 User-initiated account deletion

When a user requests account deletion, we execute a defined deletion sequence that removes or anonymizes all user-related data, including but not limited to:

• Authentication identity (auth user)
• Profile and account data (e.g., users table)
• Receipts and related data: receipts, receipt conversations, categories
• Notifications: notification_tokens, notification_history, notification_settings
• Other user-scoped data: businesses, insurances, verified_sender_emails, email_forwarding_logs, subscription_events
• Files in object storage: profile pictures, receipt images, and other user-specific objects

Backups:We do not routinely restore backups solely to delete one user's data. Data in backups is retained for up to 60 days and then overwritten or retired in the normal backup cycle. We do not use backup data to reconstruct deleted user data for general use.

5.3 Disposal when retention period expires

For data categories with a defined maximum retention period (e.g., certain logs), we will delete or anonymize data when that period is reached, using automated or scheduled processes where possible. Disposal methods must be appropriate to the system (e.g., permanent delete in database and object storage; secure deletion or decommissioning of media).

5.4 Third-party and subprocessor data

Where we use third parties (e.g., Supabase, email providers) to process or store personal data, we:

• Choose providers that support secure deletion and comply with our instructions and applicable law
• Rely on contract terms and provider documentation for retention and deletion behavior
• Do not retain copies in our primary systems beyond the periods stated in this policy

Upon account deletion, we remove data from our primary systems; any residual data in a third party's environment is governed by our agreements and their policies (e.g., backup retention).

This policy is aligned with our Privacy Policy. In the event of conflict, applicable law and the Privacy Policy take precedence for user-facing commitments.

• GDPR: Data minimized and retained only as necessary; right to erasure implemented via account deletion and documented exceptions.
• CCPA/CPRA: Deletion requests honored in line with our Privacy Policy and this document.
• All other applicable laws in the jurisdictions where we operate.

• This policy will be reviewed at least annually (or more frequently if required by law or significant changes in processing).
• Changes will be approved by the policy owner and communicated to relevant personnel.
• Significant changes that affect user rights will be reflected in our Privacy Policy and communicated to users where required.

• Privacy Policy
• Account deletion: proofey-app.com/delete-account
• Internal: lib/account-deletion-service.ts, delete-user-account Edge Function, Supabase storage buckets (e.g., profile-pictures, receipt-images)

This document is intended for internal use and compliance. It supports our public Privacy Policy and account deletion process.